reasoning: This paragraph is purely a cross-reference directing readers to another section for cybersecurity risk disclosures. It contains no substantive cybersecurity content—no governance structure, management roles, security processes, or actual incident descriptions. It is procedural incorporation-by-reference language with no facts whatsoever.


content_category: Board Governance

category_confidence: high

specificity_confidence: medium

reasoning: The paragraph describes board oversight structure (Audit Committee, Board-level incident reporting, annual CISO discussions) which is governance-chain content. The CISO is mentioned but only as a title reference, not as the grammatical subject of a firm-specific organizational claim—the paragraph's primary thrust is describing generic board-level oversight practices that any public company could state. The Audit Committee, quarterly management presentations, and annual board discussions are all standard governance cadences, not company-distinguishing facts.

provider: minimax

stage: benchmark


content_category: Risk Management Process

fact: threat modeling

fact: vulnerability testing

fact: information security control environment

fact: operating effectiveness

specificity_confidence: high

reasoning: The paragraph primarily describes what the cybersecurity program does — testing, assessments, audits, and vulnerability management activities — which directly answers 'What does the cybersecurity program do?' This is Risk Management Process. The specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (threat modeling, vulnerability testing, information security maturity assessments, control environment, operating effectiveness) that demonstrates domain expertise beyond generic risk management language. A non-security ERM professional would not naturally use these specific technical terms. No firm-specific identifiers (named officers, specific committees, named programs) or externally verifiable claims (named third parties, specific dates, specific numbers) are present.


reasoning: The paragraph describes the board's oversight structure and delegation of cybersecurity oversight to the audit committee, which directly addresses how the board oversees cybersecurity. Specificity is Level 1 (Generic Boilerplate) because it contains only generic governance language ('board of directors,' 'audit committee,' 'risk oversight function') with no cybersecurity domain expertise, firm-specific facts, or verifiable claims.


content_category: Strategy Integration

reasoning: The paragraph's primary purpose is to convey cybersecurity's business/financial impact, featuring explicit backward-looking and forward-looking materiality assessments ('have not materially affected' and 'reasonably likely to materially affect us') and a cyber insurance reference—all hallmarks of Strategy Integration. The specificity is Generic Boilerplate because despite referencing cybersecurity controls and insurance, no specific domain terminology (no named frameworks, tools, or specific security practices), firm-specific details (no named roles/committees/teams), or externally verifiable facts (no coverage amounts, specific incidents, or named third parties) are provided; the content relies entirely on generic statements any company could make about its cybersecurity risk posture.


fact: firewalls

fact: intrusion prevention and detection systems

fact: anti-malware functionality

fact: access controls

reasoning: The paragraph primarily describes what technical safeguards the cybersecurity program uses (firewalls, intrusion prevention/detection, anti-malware, access controls), making it fundamentally about the cybersecurity program's activities → RMP. The third-party content describes assessors/consultants hired to evaluate the company's controls (RMP under Rule 3), not vendor oversight requirements imposed on the company's supply chain. Specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise through specific technical tool categories (firewalls, IDS/IPS, anti-malware, access controls) that go beyond generic risk language any ERM professional could write about any risk domain — these are terms requiring cybersecurity-specific knowledge to enumerate and deploy.


category_confidence: medium

reasoning: The paragraph answers 'How does cybersecurity affect the business or finances?' by referencing a cyber liability insurance policy, which falls under Strategy Integration. However, it contains no substantive details—just a bare acknowledgment of the policy's existence and a cross-reference elsewhere in the filing. No specific facts (policy limits, coverage details, premiums, named carriers) are provided, making this Generic Boilerplate at Level 1.


content_category: None/Other

reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors. It contains no substantive cybersecurity disclosure about governance, management roles, risk management processes, third-party risks, incidents, or business impact assessments.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A for cybersecurity risk information. It contains no substantive disclosure about the company's actual cybersecurity governance, management, processes, or incidents—only a quoted risk factor snippet that describes potential generic threats ('could cause a disruption'). Cross-references and pointers to other sections are N/O by definition, as they do not convey any specific facts about the company's cybersecurity posture.


reasoning: Category: This paragraph states a conclusion about whether cybersecurity has materially affected (or is reasonably likely to materially affect) the company's business strategy, results of operations, or financial condition — the core question of Strategy Integration. The opening negative assertion is a backward-looking materiality statement per Rule 5. Specificity: The paragraph contains zero specific facts. It is entirely a negative assertion ('we have not identified any...') and speculative language ('may, from time to time, experience threats') with no verifiable claims, domain-specific technical terms, or firm-specific details. A negative assertion about not experiencing incidents is not externally verifiable, and no hard numbers, named entities, or cybersecurity-specific technical language appear.


reasoning: This paragraph is a cross-reference directing readers to another section for cybersecurity risk information. It answers no substantive question about governance, management, processes, third parties, incidents, or strategy. Per Rule 6 (N/O threshold), when no actual cybersecurity measure, process, or assessment is described, the category is None/Other. The phrase 'could have a material adverse effect' is the standard speculative disclaimer that Rule 5 explicitly excludes from Strategy Integration.


reasoning: The paragraph primarily answers 'What does the cybersecurity program do?' by describing risk assessment activities, monitoring, testing, and security tools—placing it in RMP rather than BG (brief board mention) or TP (third parties as one component of the program). For specificity, the paragraph uses only generic language: 'Management and Strategy' (not named), 'various security tools' (unnamed), 'third parties' (unnamed), and 'cybersecurity policies, processes, and practices' (generic descriptors). No domain-specific terminology (ERM test: risk assessment, monitoring, testing, policies—all standard ERM vocabulary), no named roles above VP level, no specific security technologies, no named third-party assessors, and no verifiable metrics. The materiality conclusion is a standard forward-looking disclaimer that provides no verifiable facts about actual incidents.


content_category: Management Role

fact: Head of IT reports directly to Chief Financial Officer

fact: Over twenty years of experience managing information technology and cybersecurity matters

fact: Holds Master of Science degree in Telecommunications and Computer Networks

fact: Project Management Professional certified

fact: Certified Scrum Master

fact: IT Infrastructure Library certified

reasoning: The paragraph is primarily about Management Role — it centers on the Head of IT's reporting line, qualifications, certifications, and collective responsibility with senior leadership for assessing cybersecurity risks. Specificity is Level 4 because multiple individual credentials (PMP, CSM, ITIL certifications, MS degree, 20 years experience) are independently verifiable through certification registries, educational records, and professional history. The materiality assessment near the end is secondary to the management organization focus.


reasoning: The paragraph describes categories of third-party service providers used to support the company's cybersecurity risk management program. Per Rule 3, third parties hired to serve the company (assessors, pen testers) fall under RMP, not TP. The specificity is Generic Boilerplate because the paragraph lists only generic vendor categories (threat intelligence service providers, cybersecurity consultants, penetration testing firms, etc.) without naming any specific providers, tools, practices, or verifiable facts — this language appears in virtually every 10-K with a cybersecurity disclosure.


fact: CISO has over 18 years of information technology leadership experience

fact: CISO has 8 years of experience leading information security oversight

fact: Information security team members have various information security degrees and certifications

fact: CISO reports to CRO (Chief Risk Officer)

reasoning: The paragraph primarily describes cybersecurity leadership roles, qualifications, and organizational structure, fitting Management Role. Specific years of experience (18 years IT leadership, 8 years security oversight) and mention of certifications make the specificity Level 4 — these are externally verifiable claims about named leadership.


reasoning: The paragraph describes the Board's oversight responsibility for cybersecurity risk and identifies CFO and CEO as the management members responsible for managing cybersecurity practices—establishing the top of the governance chain. No firm-specific cybersecurity roles (CISO, VP of Security), domain-specific security practices, or externally verifiable claims are present; the named roles (Board, CFO, CEO) are generic governance positions that exist at every public company.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is third-party vendor/service provider oversight, including a committee, written policies, due diligence processes, security assessments (questionnaires, meetings, onsite visits), and contingency planning—all hallmarks of Third-Party Risk. However, the specificity remains Level 1 because the language describing the oversight approach (selection, due diligence, contracting, ongoing monitoring) applies to vendor management across any risk domain, not specifically cybersecurity. No cybersecurity-specific terminology appears, no named security standards, no specific tools or practices unique to cybersecurity risk management, and no firm-specific identifiers (the committee is described generically by function, not a unique name).


fact: Chief Information Security Officer (firm-specific leadership role)

fact: 25 years of prior experience in information systems, cybersecurity, risk management, and infrastructure management

fact: Holds master's and bachelor's degrees in Computer Information Systems and Business Administration

fact: Certified Internal Controls Auditor (CICA) — verifiable via the Institute of Internal Auditors

fact: Payment Card Industry Professional (PCIP) — verifiable via PCI Security Standards Council

fact: Certified Information Systems Security Professional (CISSP) — verifiable via (ISC)² registry

fact: Certified Information Systems Auditor (CISA) — verifiable via ISACA registry

fact: Certified in Risk and Information Systems Control (CRISC) — verifiable via ISACA registry

reasoning: The paragraph is primarily about the CISO's role, qualifications, and credentials — establishing who is responsible for cybersecurity and what makes them qualified. This is Management Role content. Specificity reaches Level 4 because the CISO's 25 years of experience and five named certifications (CISSP, CISA, CRISC, CICA, PCIP) are externally verifiable through professional certification registries — one quantifiable claim plus multiple independently checkable credentials.


reasoning: The paragraph is a simple enumeration of external partnerships with no substantive description of activities, processes, or outcomes — it answers no meaningful question about cybersecurity governance, risk management, or strategy. As a list with no informative content, it warrants None/Other at Generic Boilerplate specificity.


content_category: Incident Disclosure

fact: February 23, 2023 network outage affecting internal servers and IT telephony

fact: February 28, 2023 disclosure that certain data was extracted from DISH Network IT systems

reasoning: This paragraph describes an actual past cybersecurity incident with specific dates (February 23, 2023 and February 28, 2023), describing what happened (network outage, data extraction), the company's response (activated incident response plans, engaged cybersecurity experts, notified law enforcement), making it clear Incident Disclosure. The two specific calendar dates are externally verifiable claims that anchor the specificity at Level 4.


reasoning: The paragraph describes the company's cybersecurity program activities (engaging third-party specialists for reviews, implementing controls and technologies), making RMP the primary category. However, all content uses generic cybersecurity language that any company could use — 'effective and efficient controls,' 'formal reviews and assessments,' 'actionable recommendations' — with no firm-specific identifiers, named tools, specific third parties, or verifiable facts. This is standard boilerplate with no elevatable specificity.


fact: June 2018 incident: unauthorized third-party access to email system

fact: Forged and fraudulently induced electronic payment disbursements

fact: Aggregate amount of $10 million

reasoning: The paragraph centers on describing the June 2018 cybersecurity incident (unauthorized access to email system resulting in $10M in fraudulent payments), making it an Incident Disclosure. The $10 million aggregate amount is a hard verifiable number, and the June 2018 date with specific incident details (fraudulently induced electronic payment disbursements) constitutes externally verifiable factual content, elevating specificity to Level 4 despite the paragraph also containing a materiality assessment.


fact: threat intelligence feeds

fact: vulnerability management

fact: simulations and drills

reasoning: The paragraph describes what the cybersecurity program does—incident response framework, monitoring threat intelligence, vulnerability management, and training drills—making Risk Management Process the primary category. The specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise: 'threat intelligence feeds' and 'vulnerability management' are terms a generic ERM professional would not naturally use (they pass the ERM test), elevating this beyond generic process language. No firm-specific roles, named programs, or verifiable facts are present.


fact: January 2021 — specific date of incident discovery

fact: Information technology systems hosted by a third-party cloud provider were improperly accessed

fact: Source code and credentials were compromised

fact: Company received a threat to publicly release materials unless payment was made

fact: Company did not make the demanded payment

reasoning: The paragraph describes an actual cybersecurity incident from January 2021 — unauthorized access to IT systems, compromised source code and credentials, and an extortionate demand — which directly answers 'What happened in a cybersecurity incident?' The specific date (January 2021), nature of the breach (source code/credentials compromised), and the company's response to the threat (payment not made) are all externally verifiable details that elevate this to Quantified-Verifiable specificity.


reasoning: The paragraph is primarily a forward-looking disclaimer and negative assertion about past incidents, with a brief mention of incident classification but no substantive description of the cybersecurity program. The single phrase 'classify it based on its significance and track remediation actions' is too thin to constitute a Risk Management Process disclosure, making this effectively a None/Other classification dominated by speculation and cross-references. No domain expertise, firm-specific details, or verifiable facts are present.


reasoning: This paragraph describes a governance-chain for cybersecurity oversight: an IT employee monitors systems and incidents, consults the CEO, and the CEO reports to the Board as necessary. This directly addresses 'how the board oversees cybersecurity' via the information flow. The specificity is Generic Boilerplate because there are no named individuals, no VP-level cybersecurity titles, no named committees with distinguishing identifiers, and no domain-specific cybersecurity expertise demonstrated beyond generic risk management language ('prevention, detection, mitigation, and remediation') that any ERM professional could use.


fact: Information Technology Steering Committee (named internal committee)

reasoning: The paragraph focuses on the Information Security Officer's role and reporting structure (to CRO, IT Steering Committee, Audit Committee, and board), which is the primary content about management organization for cybersecurity. Specificity is Firm-Specific because the 'Information Technology Steering Committee' is a named internal committee that distinguishes this company's governance structure from generic references to audit or IT committees.


reasoning: The paragraph is centrally about third-party cybersecurity risk management, describing contractual safeguards (security and privacy addendums), continuous assessment processes, and supplier engagement practices. For specificity: the language is entirely generic—'processes and procedures to continuously assess,' 'security and privacy addendums where applicable,' 'work directly with suppliers'—which any company could use without demonstrating cybersecurity domain expertise. No specific tools, named assessors, frameworks, or verifiable claims are present.


reasoning: The paragraph describes the existence and general purpose of an incident response plan (defining roles, responsibilities, and recovery steps), which answers 'what does the cybersecurity program do?' — fitting RMP. However, specificity is Level 1 because the language is entirely boilerplate: 'incident response plan,' 'address and contain breaches,' and 'steps to recover' are generic phrases any ERM professional could use about any type of risk. No domain-specific terminology (SIEM, SOC, NIST CSF), no firm-specific details (named committees, named officers), and no verifiable claims appear.


reasoning: This paragraph primarily answers 'Has cybersecurity affected our business outcomes?' through a negative assertion ('We did not experience a material cybersecurity incident'), which per Rule 5 maps to Strategy Integration. The paragraph contains no specific facts — the date 'December 27, 2024' is merely the reporting period anchor, and the negative assertion about absence of incidents is not independently verifiable (per the rules, you cannot externally confirm the absence of something). No domain expertise, firm-specific claims, or verifiable facts are present.


reasoning: The paragraph's primary function is a negative materiality assessment — stating that management has NOT identified specific cybersecurity risks that have materially affected the company. Per Rule 5, this is a Strategy Integration assessment. However, it contains zero domain-specific terminology, firm-specific facts, or verifiable claims; it is entirely composed of standard boilerplate disclaimers and generic speculative language about safeguarding information systems, warranting Level 1 specificity.


fact: enhanced risk assessments

fact: ongoing monitoring

fact: contractual controls

reasoning: The paragraph's central topic is vendor/supplier cybersecurity oversight—describing a Vendor Management Policy, security standard requirements imposed on vendors, and risk-based heightened requirements (enhanced risk assessments, ongoing monitoring, contractual controls). This is the textbook definition of Third-Party Risk. For specificity, the language demonstrates cybersecurity domain knowledge by referencing specific evidence types vendors must provide (assessments, monitoring, controls) rather than generic 'measures to protect' language any ERM professional could write—these terms pass the ERM test as domain-specific vocabulary even without named frameworks or tools.


reasoning: The paragraph primarily consists of a backward-looking materiality assessment ('risks from cybersecurity threats have not materially affected our Company') paired with a cross-reference to Item 1A Risk Factors. The statement that defensive measures 'are designed to mitigate loss' is generic boilerplate that any public company could claim, containing no specific security practices, tools, or processes. The paragraph contains no domain-specific terminology (ERM test passes — phrases like 'defensive measures' and 'processes and controls' are generic ERM language), no firm-specific facts, and no verifiable claims. The negative assertion about past incidents is a self-reported claim, not independently verifiable.


reasoning: Category: The paragraph primarily answers 'How does cybersecurity affect the business or finances?' through explicit backward-looking and forward-looking materiality assessments ('have not materially affected' and 'reasonably likely to materially affect'), which Rule 5 classifies as Strategy Integration. The cross-reference to Item 1A is ancillary. Specificity: The paragraph contains no domain-specific cybersecurity terminology, no firm-specific organizational facts, and no externally verifiable claims—only self-reported negative assertions about incident absence and generic forward-looking speculation, both of which Rule 5 explicitly excludes from higher specificity levels.


fact: CISO role title

fact: over 30 years of experience in cybersecurity

fact: Security Officer in the United States Navy

fact: CISO at Amgen

fact: CISO at Warner Bros

fact: Cybersecurity roles at KPMG

fact: Cybersecurity roles at Forrester

reasoning: The paragraph centers on the CISO role and the person's background, fitting the Management Role category—specifically describing how management is organized (CISO with cross-functional team) and who is qualified (extensive prior experience at named firms). Specificity reaches Level 4 due to the hard number 'over 30 years of experience' and named prior employers (Amgen, Warner Bros, KPMG, Forrester, US Navy) which are externally verifiable through employment records or public profiles.


fact: National Institute of Standards and Technology

fact: Center for Internet Security Controls

reasoning: The paragraph describes the foundational framework of the cybersecurity risk management program, directly answering what the program does (RMP). Specificity is Domain-Adapted because the named references to NIST and CIS Controls pass the ERM test — a general enterprise risk management professional would not naturally cite these cybersecurity-specific frameworks as the basis for a risk program. The vocabulary demonstrates cybersecurity domain expertise beyond generic risk management language.


reasoning: The paragraph primarily describes management's organizational role in cybersecurity oversight—specifically identifying the CEO and SVP Finance/CFO as responsible parties and their relevant experience in enterprise risk management. This answers 'How is management organized to handle cybersecurity?' making it MR. The specificity is Generic Boilerplate because 'at least quarterly' is a generic cadence, 'periodic' is soft, and no firm-specific titles (CISO, VP of Cybersecurity), named committees, or externally verifiable facts are present—the CEO/CFO titles and ERM experience are generic governance concepts found at every public company.


reasoning: The paragraph consists entirely of self-reported beliefs and negative assertions ('we do not believe,' 'have not experienced any material cybersecurity incidents') about whether cybersecurity threats affect or are likely to affect business outcomes — which maps directly to the Strategy Integration question. Per Rule 5, these are materiality assessments, but they contain no specific facts, domain terminology, firm-specific details, or externally verifiable claims; the entire paragraph is boilerplate.


reasoning: The paragraph centers on third-party vendor oversight requirements—specifically certification mandates imposed on service providers—which directly maps to Third-Party Risk (TP) under Rule 3. The paragraph describes what Jaguar Health REQUIRES of vendors rather than describing actual verified security measures the company maintains, resulting in Generic Boilerplate specificity with no domain-specific cybersecurity terms, firm-specific facts, or externally verifiable claims.


reasoning: The paragraph focuses on how key cybersecurity leadership (VP of IT and Digital and CISO) stay informed and enhance processes to handle threats, making it primarily about management's organizational role in handling cybersecurity. However, the specificity is Generic Boilerplate because the terminology used ('identify, prevent, mitigate and remediate cybersecurity threats') is standard ERM language that any enterprise risk management professional could apply to any risk domain—it does not demonstrate cybersecurity-specific expertise beyond using 'cybersecurity' as a modifier.


fact: System and Organization Control reports

reasoning: The paragraph's central topic is third-party cybersecurity risk management, covering due diligence, contractual data protection requirements, ongoing vendor monitoring, and risk-based reassessment cycles — all of which directly answer how the company manages third-party cyber risks. Specificity is Domain-Adapted because the reference to System and Organization Control (SOC) reports demonstrates cybersecurity domain expertise; SOC reports are a specific IT audit mechanism that general ERM professionals would not typically reference, passing the ERM test for Level 2 terminology.


reasoning: This paragraph describes the board's oversight structure and information flow for cybersecurity—specifically, that the Board of Directors receives regular reports from the Cybersecurity Committee and SMIS on cyber risks, threats, and incidents. The primary question answered is how the board oversees cybersecurity, making it Board Governance. For specificity, while the paragraph discusses reporting relationships, it uses only generic cadences ('regular reports', 'promptly informed', 'regularly updated') without specific frequencies, dates, or named programs. The terms used (cyber risks, threats, incident response plan, security program) are standard governance vocabulary that any enterprise risk management professional could use about cybersecurity—nothing demonstrates cybersecurity domain expertise beyond the topic itself.


reasoning: This paragraph is primarily a regulatory cross-reference with minimal substantive content—it states that the company is subject to financial privacy laws and federal banking agency oversight, then points to another section for details. It does not describe the board's governance structure, management's organizational role, or any cybersecurity program activities. Specificity is Level 1 (Generic Boilerplate) because the paragraph contains only generic regulatory descriptors (federal banking agencies, financial privacy laws) and a section cross-reference, with no domain-specific expertise, firm-specific facts, or verifiable claims.


fact: February 23, 2023 date of network outage affecting internal servers and IT telephony

fact: Incident response and business continuity plans were activated

fact: Cybersecurity experts and outside advisors were engaged

fact: Law enforcement authorities were notified

fact: February 28, 2023 date of subsequent disclosure

fact: Certain data was extracted from DISH Network IT systems

reasoning: This paragraph describes a real cybersecurity incident with specific dates (February 23, 2023 and February 28, 2023), specific scope (internal servers, IT telephony, data extraction), and specific response actions (engagement of cybersecurity experts, law enforcement notification) — all hallmarks of Incident Disclosure per Rule 4. The two specific dates tied to actual events elevate this to Quantified-Verifiable specificity, as both dates and the claim of data extraction are externally verifiable facts about a real incident.


reasoning: The paragraph describes the board oversight structure for cybersecurity: the ISO's annual reporting cadence to the board and the topics covered (risk assessment, service provider arrangements, testing results, security breaches). This is about governance flow, not management organization or program activities. The reference to the Interagency Guidelines for Safeguarding Customer Information demonstrates domain knowledge of banking-specific cybersecurity regulatory requirements, qualifying as Domain-Adapted specificity.


reasoning: The paragraph's entire focus is vendor oversight — assessing third-party service providers' IT and security controls, policies, and overall posture — making Third-Party Risk the central category per Rule 3. The paragraph contains no domain-specific cybersecurity terminology, no firm-specific structures or named programs, and no verifiable claims; it describes a generic third-party risk framework in language any ERM professional could apply to non-cyber vendor risk, resulting in Generic Boilerplate specificity.


reasoning: The paragraph's central topic is clearly third-party cybersecurity risk management, describing due diligence on vendors with system/data access, contractual requirements, and audit rights for high-risk third parties. However, all content consists of generic descriptions of standard third-party oversight processes ('perform diligence,' 'continually monitor,' 'agree by contract') without any firm-specific identifiers, named programs, specific thresholds, or externally verifiable claims. No named vendors, committees, leadership roles, specific tools, or quantified metrics appear.


fact: Insurance coverage for liability, privacy and regulatory actions

fact: Insurance coverage for incident response

fact: Insurance coverage for business interruption

fact: Insurance coverage for data recovery

fact: Insurance coverage for hardware replacement

fact: Insurance coverage for extortion

fact: Insurance coverage for reputational harm

reasoning: The paragraph describes cybersecurity insurance coverage types, which is a financial/strategic tool for managing cyber risk rather than a governance, operational, or incident topic. It answers 'how does cybersecurity affect the business?' through insurance strategy (SI). The specificity is Domain-Adapted because the enumerated coverage types (extortion, privacy/regulatory actions, business interruption, data recovery, hardware replacement, reputational harm) are domain-specific cyber insurance terminology that demonstrates expertise in what cyber policies cover — a non-security ERM professional would not naturally enumerate these specific coverage categories.


reasoning: The paragraph describes what the cybersecurity program includes (mechanisms, controls, technologies, systems, policies) and its purpose (prevent/mitigate data loss, theft, misuse, security incidents), which answers 'what does the cybersecurity program do?' → RMP. The specificity is Level 1 because every term ('mechanisms,' 'controls,' 'policies,' 'risk assessment') passes the ERM test — these are generic risk management concepts any business professional could write, with no domain-specific cybersecurity terminology, no firm-specific operational details, and no verifiable claims.


reasoning: The dominant thrust of this paragraph is making conclusions about whether cybersecurity has or will materially affect the Company's business strategy, results of operations, or financial condition—per Rule 5, this is Strategy Integration. While the Clarium assessment is mentioned, it serves as supporting context for the SI assertion rather than being the paragraph's primary purpose. Specificity is Level 1 (Generic Boilerplate) because no domain-specific expertise is demonstrated (a 4.8/5 score without naming what framework was used fails the ERM test), no firm-specific facts are present (Clarium is an external assessor, the 4.8 score is not independently verifiable without the framework context, and the negative assertion about no incidents is not an externally verifiable claim), and there are no quantified-verifiable facts.


reasoning: This paragraph is primarily a cross-reference to Item 1A Risk Factors that acknowledges generic cybersecurity risks and vaguely notes they 'from time to time' experienced incidents. It contains no substantive disclosure about governance structure, risk management processes, specific incidents, or business impact—only points readers elsewhere. Contains no domain terminology, firm-specific facts, or verifiable claims.


reasoning: This paragraph is a standard negative assertion (no material incidents have occurred) combined with a forward-looking statement and a cross-reference to risk factors—classic SI content per Rule 5. It contains zero specific facts: no domain terminology (fails ERM test), no firm-specific details, and no externally verifiable claims. One could not distinguish this from any other public company's boilerplate.


fact: March 2023 targeted by a complex criminal scheme

fact: Fraudulently-induced outbound wire transfers to a third-party account

fact: Self-discovered fraudulent activity and contacted banks, dispute resolution experts, federal and local law enforcement

fact: $2.7 million net loss (with recovery) including professional fees for independent forensic investigation

fact: Promptly informed the audit committee with regular updates during investigation and recovery

fact: Unaware of any other significant security breaches at business locations

reasoning: This paragraph describes an actual cybersecurity incident (business email compromise/wire fraud scheme in March 2023), including the nature of the attack, timeline, response actions, and quantified financial impact of $2.7 million loss net of recovery—all of which constitute externally verifiable facts about a real event, warranting Incident Disclosure at Quantified-Verifiable level.


reasoning: This paragraph is a SI assessment: it contains a stated conclusion about whether cybersecurity risks materially affect the company's business strategy, results of operations, or financial condition (per Rule 5). The specificity is Generic Boilerplate because there are no domain-specific terms (ERM test fails — 'cybersecurity risks' and 'cybersecurity threats' are generic), no firm-specific facts (management and unnamed consultants are not distinguishing), and no externally verifiable claims (the negative materiality assertion cannot be independently confirmed). This is standard boilerplate appearing in most 10-K cybersecurity disclosures.


reasoning: The paragraph's primary purpose is a backward- and forward-looking materiality assessment (SI under Rule 5), making multiple assertions that cybersecurity has not and is not reasonably likely to materially affect the business. It contains no specific facts — no named frameworks, no quantifiable metrics, no verifiable claims, and all substantive content is expressed in generic/negative terms.


reasoning: The paragraph describes general cybersecurity risk management processes (assessing, identifying, managing risks, protecting information assets), which maps to Risk Management Process as the primary question answered. However, it contains no domain-specific cybersecurity terminology, no firm-specific details, and no verifiable claims — all language is generic boilerplate that any company could use. The phrase 'informed by industry standards' is aspirational, not a claim of actual framework adoption.


reasoning: The dominant frame of this paragraph is a backward-looking materiality assessment ('have not experienced any material losses') combined with a forward-looking conclusion ('are reasonably likely to materially affect us') regarding cybersecurity's impact on business strategy, operations, and financial condition, making it Strategy Integration per Rule 5. No specific facts are present: the 2019 phishing mention is incidental context within the assessment rather than a substantive incident description, and the negative assertions about material losses and material effect are self-reported claims without externally verifiable detail.


reasoning: This paragraph describes aspects of an actual cybersecurity incident (services remained operational, restoration timeline), making Incident Disclosure the primary category. However, the paragraph lacks any specific facts—it contains only a reporting-period date anchor ('March 31, 2023') and self-reported negative assertions ('remained operational at all times', 'no reason to believe...has not been concluded') that cannot be independently verified. The specificity falls to Generic Boilerplate.


reasoning: The paragraph is introductory framing language explaining why cybersecurity matters to the company rather than describing any substantive cybersecurity measures, governance, or processes. It asserts that they 'have established a strong cybersecurity program' but provides no details about what the program actually does, how it is organized, or any specific processes or activities — making it N/O per Rule 6. No domain-specific terminology, firm-specific facts, or verifiable claims are present; all language is generic boilerplate that could appear in virtually any company's disclosure.


reasoning: The paragraph is squarely about third-party cyber risk management, describing questionnaires, evidence requests (SOC2 T2, penetration testing, ISO 27001), contractual clauses, and annual reviews — all as the central topic. Specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise through the specific evidence types requested from vendors (SOC2 Type 2 attestation, penetration testing reports, ISO 27001 certification scope) — an ERM professional would not naturally know to request these specific artifacts without cybersecurity domain knowledge. No firm-specific claims are made (no named programs, roles, or hard numbers), so the paragraph describes a generic third-party risk management approach that could apply to any company.


reasoning: The paragraph describes how the Board oversees cybersecurity through its committees — the cadence of reporting, the escalation process for significant incidents, and the flow of information from Committee to Board. This directly answers the board governance question. However, the paragraph contains only generic governance language: 'periodic performance and effectiveness review,' 'regularly scheduled meetings,' and 'significant new cybersecurity threats' — all of which any public company could state. No named individuals, no named committee with distinguishing characteristics, no specific dates, no cybersecurity-specific tools or practices, and no verifiable claims. The governance structure described is standard boilerplate.


reasoning: The paragraph's central question is whether cybersecurity threats have or are reasonably likely to materially affect the company's business strategy, results of operations, or financial condition—a Strategy Integration assessment. For specificity, the paragraph contains no domain-expertise language (the threat observations are generic and not cybersecurity-practice-specific), no firm-specific facts, and no externally verifiable claims; 'As of December 31, 2024' is a reporting-period anchor, not a cybersecurity fact. This is entirely boilerplate.


fact: VRM performs due diligence based on vendor risk profile

fact: Three-factor review framework: information security controls (third-party audit), disaster recovery and business continuity testing, geographic location (country risk)

reasoning: The paragraph directly addresses how the company manages third-party cyber risks through its VRM function's due diligence process, listing specific evaluation factors (third-party audit review for security controls, DR/BC program review, geographic risk). Specificity is Domain-Adapted because it demonstrates knowledge of what specific evidence to review in vendor assessments (third-party audits, DR/BC programs) that goes beyond generic risk management language, but contains no firm-specific facts like named roles, team composition, or externally verifiable claims.


reasoning: The paragraph primarily describes general cybersecurity preventive measures (protocols, controls, systems) and ongoing monitoring, which falls under RMP. However, specificity is Level 1 because all language is generic boilerplate — 'protocols, controls, and systems' are universal terms any ERM professional could use, 'sophisticated and rapidly evolving attempts' is vague threat language without domain-specific terminology, and no firm-specific roles, named programs, tools, or verifiable facts are present. The negative assertion about no material incidents is a self-reported claim, not independently verifiable.


fact: Management Enterprise Risk Committee

fact: Vendor Management Committee

reasoning: The paragraph's central topic is third-party vendor cybersecurity oversight—how the company manages cyber risks from service providers through due diligence, risk assessment-based oversight, and contractual requirements. Rule 3 (TP vs RMP) applies: vendor oversight as the central topic → TP. The two named management committees (Management Enterprise Risk Committee and Vendor Management Committee) are firm-specific facts that distinguish this company's governance structure, elevating specificity to Level 3.


fact: penetration testing

fact: malware risks

fact: logs and events

fact: network perimeter

fact: internal systems

fact: third-party vendors

fact: security technologies

fact: vulnerabilities

reasoning: This paragraph describes concrete cybersecurity program activities (scanning, penetration testing, monitoring, vendor due diligence), directly answering 'what the program does' → RMP. The specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (penetration testing, malware, log monitoring, network perimeter) that an ERM professional would not naturally use in describing general business risks — these concepts require cybersecurity domain expertise.


fact: CSO (Chief Security Officer)

reasoning: The paragraph's primary content describes what the cybersecurity program does (protecting information systems, responding to incidents, deploying multidisciplinary teams) rather than how management is organized or qualified, making it RMP rather than MR. The CSO title represents a firm-specific fact, as it identifies a named leadership role at the company that would appear in TTEC's governance documents — this elevates the paragraph above generic boilerplate to Firm-Specific level, though the description of program activities otherwise uses standard language any company could deploy.


reasoning: The paragraph primarily makes a negative assertion about not identifying material cybersecurity incidents in 2023, which maps to SI under Rule 5 ('have not experienced any material cybersecurity incidents' → SI). However, specificity is Generic Boilerplate because the only facts are a reporting year ('2023') and a negative self-assertion about incidents — neither is externally verifiable, and the materiality language is standard boilerplate that appears in virtually every 10-K.


reasoning: This paragraph merely states that the company uses third-party vendors for general IT services and is 'exploring' cybersecurity vendors — it does not describe any vendor oversight process, contractual security requirements, or third-party risk management program. The language 'exploring other third-party vendors' is aspirational/speculative rather than a substantive disclosure of measures taken. Contains no firm-specific facts, domain expertise, or verifiable claims — purely generic boilerplate.


reasoning: This paragraph is forward-looking disclaimer language about future cyber risks, not a substantive disclosure about any of the six categories. While it references the 'February 2023 cyberattack,' the purpose is to disclaim future liability (what cannot be assured), not to describe what happened, the scope, or the response. No cybersecurity expertise, firm-specific organizational details, or verifiable claims about the program are present—only generic speculation about future incidents and potential impacts.


reasoning: This paragraph answers 'How does the board oversee cybersecurity?' by describing the audit committee's delegated oversight role, management reporting cadence, external specialist engagement, and board training. All content describes standard board governance practices without firm-specific identifiers (audit committee exists at every public company, internal audit firm is unnamed). The January 2024 date anchors a training event but lacks verifiable specifics about the training itself. No domain-adapted security terminology appears beyond generic terms any ERM professional would use.


fact: Head of Resources Management (a member of the Board of Directors) leads cybersecurity management

fact: CCO (Chief Compliance Officer) is involved in assessing and managing cybersecurity

fact: Head of Resources Management has more than 30 years overall experience and more than 20 years assessing/managing cyber IT systems

fact: CCO has more than 30 years experience as a CPA

fact: CCO has more than 15 years managing IT systems and databases

fact: CCO has 15-plus years supporting the Adviser's and Administrator's resource management department

reasoning: The paragraph is primarily about WHO manages cybersecurity (Head of Resources Management and CCO) and their specific qualifications/experience, making it Management Role. The specificity is Level 4 because the paragraph contains multiple verifiable factual claims: the named management titles at this firm, CPA credential (externally verifiable), and specific experience timeframes (30+ years, 20+ years, 15+ years, 15-plus years) — all are hard numerical lower bounds that could be independently checked.


reasoning: The paragraph states a conclusion about whether cybersecurity has materially affected business outcomes (per Rule 5, backward-looking assessments about business/financial impact are SI). However, the paragraph contains no domain terminology, firm-specific facts, or verifiable claims—it is pure boilerplate negative assertion about the absence of material impact. The specificity level is Generic Boilerplate since there are zero specific facts to evaluate.


reasoning: This paragraph describes the audit committee's oversight role and reporting cadence for cybersecurity, which directly answers 'How does the board oversee cybersecurity?' — a Board Governance question. The specificity is Generic Boilerplate because the paragraph contains only generic governance language (audit committee, annually, from time to time, immediately) with no domain-specific cybersecurity expertise, firm-specific identifiers (e.g., named committees, specific roles), or externally verifiable claims.


reasoning: The paragraph describes board-level oversight structure (Audit Committee receiving periodic reports on cybersecurity) and how information flows to the board—a governance-chain question. The paragraph fails the ERM test: 'oversees operational information technology risks, including cybersecurity' and 'receives periodic reports regarding cybersecurity risk factors' are generic governance statements any enterprise risk management professional could write, with no cybersecurity domain terminology or specific practices shown. No firm-specific facts (Audit Committee exists at every company, third-party consultants unnamed, periodic reports without specific cadence) and no verifiable claims.


reasoning: The paragraph primarily describes board-level oversight structure (Audit Committee and full Board receiving quarterly/annual reports on cybersecurity), which directly answers the governance question of how the board oversees cybersecurity. The specificity remains Generic Boilerplate because 'network security' and 'data encryption' are generic protective measures any ERM professional could describe, 'quarterly' and 'annual' cadences are standard governance rhythms, and 'Audit Committee' and 'Board of Directors' are universal governance roles — none constitute domain expertise, firm-specific facts, or externally verifiable claims.


fact: June 30, 2024 - specific date the Company detected the cybersecurity incident

reasoning: This paragraph describes an actual cybersecurity incident — unauthorized third-party access to company systems on a specific date — making Incident Disclosure the primary category per Rule 4. The specificity level is driven by the specific date 'June 30, 2024,' which is externally verifiable (an external party could confirm whether the company detected an incident on that date through their own investigation, litigation discovery, or regulatory filings).


reasoning: The paragraph describes the qualifications (degrees, ~20 years of experience) of senior finance and legal officers in managing risks including cybersecurity threats, which addresses how management is organized/qualified to handle cybersecurity → Management Role. The 'approximately 20 years or more' claim is a soft number hedged in both directions and thus not externally verifiable; the officer titles (CFO, General Counsel, CAO) are generic roles found at every public company and provide no firm-specific distinguishing detail; no cybersecurity domain terminology passes the ERM test beyond generic risk language → Generic Boilerplate.


reasoning: The paragraph describes how the audit committee (a board-level committee) receives cybersecurity reports and has access to cybersecurity-related materials — clearly a governance-oversight description (Board Governance). For specificity, 'audit committee' is a generic role at every public company and 'CISO' is a generic title with no named individual. 'Periodic reports' is a vague cadence and 'various reports, summaries or presentations' is non-specific boilerplate. The paragraph contains no domain-specific terminology that passes the ERM test, no firm-specific distinguishing facts, and no verifiable claims — it is entirely generic oversight language.


reasoning: The paragraph focuses on third-party vendor oversight (contractual requirements and cyber review process for onboarding), making TP the appropriate category. However, it contains no domain-specific security terminology, no firm-specific identifiers (no named roles, committees, or specific programs), and no verifiable claims—only generic statements about risk-profile-based vendor requirements that any company could make.


fact: offensive testing

fact: maturity assessments

reasoning: The paragraph describes what the cybersecurity program includes — penetration testing, maturity assessments, third-party due diligence, incident response, security awareness training, and phishing tests. These are activities the program performs, making Risk Management Process the primary category. The specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise through terms like 'penetration testing,' 'offensive testing,' and 'maturity assessments' that an ERM professional would not naturally use in non-cybersecurity contexts. No firm-specific identifiers (named committees, specific headcounts, named roles) or verifiable claims (specific dates, dollar amounts, certifications) are present.


reasoning: This paragraph is a general risk-awareness statement acknowledging cybersecurity threats and that resources are expended on cybersecurity, but it describes no specific governance structure, management role, program activities, or verifiable facts. It functions as a preamble/hedging statement rather than substantive cybersecurity disclosure. No domain-specific practices, firm-specific roles, or externally verifiable claims are present—the only terms used ("risk management," "strategy," "governance") are generic and interchangeable with any enterprise risk domain.


fact: Cybersecurity Steering Committee (named committee)

fact: one director is the President of a major cybersecurity services provider

reasoning: The paragraph primarily describes the board's oversight structure and mechanisms — the CISO reporting to the Board, the Board's education program, Audit Committee member expertise, and director qualifications — making this a Board Governance disclosure. The presence of the named 'Cybersecurity Steering Committee' and the specific qualification that one director is the President of a cybersecurity services provider are firm-specific facts that distinguish this company's governance from generic board oversight language.


fact: vulnerability scans

fact: penetration tests

reasoning: The paragraph primarily describes what the cybersecurity program does — its approach to identifying threats, the tools and methodologies employed, and ongoing monitoring activities — making it a Risk Management Process disclosure. It demonstrates cybersecurity domain expertise through the use of specific security testing practices (vulnerability scans and penetration tests) that an enterprise risk management professional would not naturally use without a cybersecurity qualifier, qualifying it as Domain-Adapted specificity.


fact: security engineering (domain term)

fact: cyber threat detection and response (domain term)

fact: third-party assessments (domain term)

fact: internal and external information technology audits (domain term)

fact: strategic risk assessments (domain term)

reasoning: The paragraph's primary focus is describing organizational structure and leadership roles for cybersecurity (CIO, director of IT, their reporting lines, and experience levels), making Management Role the appropriate category. Specificity is Domain-Adapted because the paragraph contains cybersecurity-specific vocabulary (security engineering, threat detection and response, third-party assessments) that demonstrates domain expertise beyond generic risk management language, while all person-specific facts (role titles, reporting relationships, vague experience claims) fail the Level 3 and Level 4 thresholds.


reasoning: The paragraph describes that Franklin Templeton uses third-party service providers for cybersecurity containment and remediation, which is a component of the cybersecurity program (RMP per Rule 3: third parties hired to serve the company). No firm-specific facts (FBRT's own leadership, named committees, or specific practices), domain expertise beyond generic terms, or externally verifiable claims are present — just a generic statement about having third-party relationships. Specificity is Level 1 (Generic Boilerplate).


reasoning: Paragraph focuses on third-party cybersecurity risk management through due diligence and contractual provisions imposed on vendors (TP). No cybersecurity domain-specific vocabulary (passes ERM test as generic risk language), no firm-specific facts (named roles, committees), and no verifiable claims (named assessors, certifications, specific metrics) — all facts are generic boilerplate.


reasoning: The paragraph's central topic is vendor oversight and third-party cybersecurity risk management—explicitly describing contractual requirements imposed on vendors and audit rights, which is the defining feature of Third-Party Risk under Rule 3. The specificity is Generic Boilerplate because every substantive claim is written in generic risk management language that any company could use; terms like 'perform diligence,' 'continually monitor,' and 'agree by contract' fail the ERM test since they apply equally to non-cybersecurity third-party risk (financial, operational, compliance).


fact: applying vendor-provided software fixes (patches)

fact: vulnerability scanning

fact: intrusion detection tools

reasoning: The paragraph describes specific cybersecurity program activities (patch management, vulnerability scanning, intrusion detection, configuration management) that answer 'What does the cybersecurity program do?' — establishing it as RMP. The specificity is Domain-Adapted because the terminology (vulnerability scanning, intrusion detection tools, patches, security configurations) reflects cybersecurity expertise that a generic ERM professional would not naturally use; these are specific security practices and tool categories, not generic risk management language. No firm-specific roles, named programs, quantified claims, or verifiable external facts are present.


reasoning: This paragraph is a direct materiality assessment—it states that cybersecurity threats have not materially affected, and are not reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition. This is the defining question of Strategy Integration (per Rule 5: statements about whether cybersecurity has/will affect business outcomes = SI). The paragraph contains no domain-specific security terminology, no firm-specific roles or programs, and no verifiable external claims—it is pure boilerplate materiality assertion with a cross-reference to risk factors.


fact: risk assessments (domain term — generic cybersecurity practice)

fact: security documentation reviews (domain term)

fact: security questionnaires (domain term)

fact: security audits of certain vendors (domain term)

reasoning: The paragraph's central topic is vendor/supplier cybersecurity oversight—describing their vendor management standard, assessment processes (risk assessments, documentation reviews, questionnaires, audits), and contractual obligations imposed on providers—which maps directly to Third-Party Risk per Rule 3 (requirements imposed ON vendors → TP). Specificity is Domain-Adapted because all security activities mentioned (risk assessments, security documentation reviews, security questionnaires, security audits) are standard cybersecurity domain vocabulary that any ERM professional would recognize as generic practices, not firm-specific or externally verifiable details. The paragraph describes WHAT they do without revealing HOW they do it differently from any other company.


reasoning: The paragraph is centrally about third-party supplier cybersecurity risk management—specifically how Kyndryl's procurement process includes security assessments, reviews of certifications and audit results, and evaluation of supplier controls—which maps directly to Third-Party Risk. However, the content describes generic supplier risk assessment activities without naming specific frameworks (e.g., SOC 2, NIST), specific certifications reviewed, named programs, or any quantified/verifiable claims, making it indistinguishable from boilerplate vendor oversight language at any large company.


reasoning: The paragraph primarily answers whether cybersecurity threats have or are reasonably likely to materially affect the business — the central question of Strategy Integration — by asserting no material incidents over 5+ years and acknowledging forward-looking risk. No specific facts elevate the specificity: the 5-year timeframe is a negative self-assertion (absence of incidents) that cannot be externally verified, 'penalties and settlements, of which there were none' is vague and self-referential, and all other content consists of generic boilerplate references to risk factors.


reasoning: This paragraph is a pure cross-reference pointing readers to the Risk Factors section. It contains no substantive cybersecurity content, no descriptions of governance, management, processes, incidents, or strategy — only a navigational pointer to another document section.


reasoning: The paragraph is clearly about third-party vendor cybersecurity oversight (monitoring, assessments, contractual requirements), making TP the correct category. However, all content describes generic third-party risk management practices using language any ERM professional could write — no specific security frameworks, named programs, verifiable certifications, or company-specific identifiers are mentioned. The paragraph lacks any fact that would elevate it above Level 1.


reasoning: The paragraph's central question is how third-party cyber risks are managed, describing due diligence assessments, contractual monitoring rights, and IT Security team oversight of vendors—textbook TP content. However, specificity falls to Level 1 because every element uses generic language that any ERM professional could write: 'due diligence security assessments,' 'contractual rights to gather data,' 'monitor compliance with cybersecurity standards,' and 'IT Security team' are all domain-generic descriptions without specific tools, named frameworks, quantified metrics, or firm-distinguishing details.


reasoning: This paragraph is a forward-looking disclaimer expressing uncertainty about whether current internal security measures will prevent breaches — speculative language about potential risks rather than a description of actual governance, processes, or incidents. No substantive cybersecurity disclosure is provided.


reasoning: The paragraph's primary function is a forward-looking disclaimer with materiality language and a cross-reference to Risk Factors. It does not describe specific governance, roles, processes, incidents, or financial assessments — just speculative risk language ('reasonably likely to materially affect') that qualifies as a standard risk disclaimer rather than a substantive Strategy Integration assessment. The specificity is Generic Boilerplate: no domain expertise is demonstrated (generic 'Information Security Program' without specifics), no firm-specific facts, and no externally verifiable claims.


fact: CDO reports to CEO

fact: CDO leads technology and digital capabilities including overall cybersecurity strategy

fact: CDO has over 20 years of experience leading technology, digital growth, and e-commerce

fact: CDO holds master's degree in business administration and management from Ecole Supérieure de Commerce de Chambéry, Rhône-Alpes, France

fact: interim CISO brings nearly 20 years of experience in security and risk programs

fact: interim CISO graduated from Miami University with bachelor's degree in management information systems and marketing

reasoning: This paragraph is about cybersecurity leadership roles, their qualifications, experience, education, and reporting relationships—clearly Management Role content. Applying the person-removal test: removing names/titles leaves only credentials and experience amounts, no cybersecurity program description. For specificity, the quantified experience claims ('over 20 years', 'nearly 20 years') establish verifiable thresholds, and the named degrees from specific universities (Ecole Supérieure de Commerce de Chambéry, Miami University) are independently verifiable credentials, supporting Level 4.


reasoning: The paragraph's central topic is third-party vendor oversight (security addenda in contracts, incident reporting requirements for subcontractors), satisfying Rule 3's TP criteria. However, specificity is Level 1: 'security and privacy addenda' and 'instructed to report' are generic contractual language and policy statements without any domain-specific details (no named frameworks, no specific requirements, no certifications), no firm-specific facts (no named vendors, no specific procedures), and no verifiable claims (no dates, numbers, or named third parties).


fact: March 31, 2023 (restoration date - externally verifiable timestamp)

reasoning: The paragraph describes an actual cybersecurity incident—the operational status of services during the event, a specific system restoration date, and the incident's concluded status—making it Incident Disclosure. The specificity level is Quantified-Verifiable because 'March 31, 2023' is a hard, externally verifiable date that anchors the incident timeline.


reasoning: The paragraph describes board-level oversight of cybersecurity through the Audit Committee, with stated briefing cadences. This directly answers 'How does the board oversee cybersecurity?' making Board Governance the appropriate category. However, the paragraph contains no firm-specific facts: the Board of Directors and Audit Committee are generic roles found at every public company, and the 'at least once each year' cadence is a minimum standard commitment rather than a distinguishing firm fact. The paragraph lacks named individuals, named cybersecurity-specific committees, or any verifiable details that would elevate specificity above Level 1.


reasoning: The paragraph's central topic is third-party vendor/supplier cybersecurity oversight (TP), describing the company's approach to monitoring external users and third-party systems that could impact the business. For specificity, the paragraph uses only generic risk management language ('risk-based approach,' 'material cybersecurity threats') that any ERM professional could write without cybersecurity domain expertise—no named programs, specific tools, verifiable certifications, or firm-specific identifiers are present, placing it at Generic Boilerplate.


reasoning: The paragraph describes board oversight of outsourced IT/cybersecurity services, which answers the board governance question. However, it contains no domain-specific cybersecurity terminology (no mention of specific security tools, practices, or frameworks), no firm-specific cybersecurity facts (generic board oversight structure that applies to any company with outsourced services), and no verifiable claims (no names of specific officers, named committees, specific dates, or quantified metrics). The named entities (NEE Management, NEER) relate to service provider relationships, not cybersecurity-specific distinctions.


reasoning: This paragraph describes the board's oversight structure and information flow regarding cybersecurity — specifically that the board oversees implementation, receives periodic reports from CTO and CISO, and gets prompt notification of incidents meeting thresholds. This directly answers how the board oversees cybersecurity, making Board Governance the appropriate category. The paragraph contains no firm-specific facts (CTO and CISO are generic role titles), no domain expertise beyond generic risk management terminology (would apply equally to any enterprise risk), and no verifiable claims — making it Generic Boilerplate.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for cybersecurity risk factor information. It does not itself provide any substantive cybersecurity disclosure—it merely points elsewhere for information about how cybersecurity may affect business outcomes. Per Rule 6, cross-references fall under None/Other. No specific facts, domain terminology, or verifiable claims are present.


reasoning: Category: The paragraph explicitly states the company's assessment about whether cybersecurity threats have materially affected or are reasonably likely to materially affect the business strategy, results of operations, or financial condition—this is the core SI assessment. The speculative opening about experiencing cyber incidents and the Risk Factors cross-reference are subordinate to this SI conclusion. Specificity: The paragraph contains no specific facts—no dates of actual incidents, no named individuals, no quantified claims, no specific tools or practices. All content is either speculative disclaimers, cross-references to elsewhere in the filing, or a generic negative assertion about absence of material impact.


reasoning: The paragraph's central focus is on managing cybersecurity risks from third-party technology service providers, making Third-Party Risk the appropriate category. However, the paragraph contains no specific facts whatsoever — it uses only generic language ('significant measures,' 'outreach,' 'third-parties') that any company could apply to any third-party risk discussion. No domain-specific terms that demonstrate cybersecurity expertise are present (no mention of SOC 2 attestations, contractual security requirements, or specific vendor oversight practices), no firm-specific identifiers, and no externally verifiable claims. This is purely boilerplate language about being aware of and monitoring third-party cyber risks.


reasoning: The paragraph describes the responsibilities of the Director, IT role in organizing cybersecurity management, which directly answers 'how is management organized to handle cybersecurity?' (Management Role). No specific facts elevate the paragraph above Level 1: the Director, IT title lacks a security-specific qualifier making it a generic organizational role, and the listed responsibilities (hiring, budgeting, approving processes, reviewing assessments) are generic management functions that any company could describe without demonstrating cybersecurity domain expertise or firm-specificity.


reasoning: The paragraph describes how the company manages third-party cybersecurity risks through vendor compliance requirements and due diligence processes, directly answering the TP question of how third-party cyber risks are managed. However, the specificity is Generic Boilerplate because the described practices—vendor compliance requirements, questionnaires, and inquiries—are standard third-party risk management language with no domain-specific terminology (no mention of SOC 2, pen testing, etc.), no named third parties, and no verifiable facts (no specific certifications, dates, or numbers).


reasoning: The paragraph describes the governance chain for cybersecurity reporting (CFO → CEO/senior management → Audit Committee/Board) and the existence of an escalation process, making it fundamentally about board oversight and information flow, which maps to Board Governance. However, all entities mentioned (CFO, CEO, Audit Committee, Board of Directors) are generic governance roles that exist at every public company, and the paragraph contains no firm-specific facts (no named officers, no specific committee structure beyond the universal Audit Committee, no specific cadence or process details), yielding Generic Boilerplate.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for cybersecurity risk disclosures rather than containing any substantive disclosure itself. It contains no information about board oversight, management organization, cybersecurity program activities, third-party risk management, incident details, or materiality assessments—only a pointer to another section. No specific facts, domain terminology, or verifiable claims are present.


fact: Software Approval Board

fact: Cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D

reasoning: The paragraph's central topic is third-party risk management through vendor due diligence and contractual requirements, making TP the correct category. The named Software Approval Board with its specific cross-functional composition (Quality, Internal Audit, Information Security, Business Systems, and R&D) provides firm-specific organizational details that distinguish this company's approach.


reasoning: The paragraph's primary function is to frame cybersecurity risk and make a negative backward-looking assertion about material impact ('we have not identified any risks or incidents... that have materially affected our business strategy'), which is the core question of Strategy Integration. The reference to past threats ('from time to time, experienced threats to, and breaches of') is incidental framing rather than incident disclosure. The specificity is Generic Boilerplate because the paragraph uses only generic ERM vocabulary (cybersecurity risks, breaches, malware, ransomware) that any compliance professional could write, contains no firm-specific facts, and makes no independently verifiable claims—'from time to time' is unquantifiable and the negative assertion is self-reported.


fact: CISO

reasoning: This is a governance-chain paragraph describing oversight structure and information flows from the Information Security group through the CISO to the board-level Audit, Risk and Finance Committee — making 'Board Governance' the primary category. The specificity is Firm-Specific because 'CISO' is a named executive role at a VP-equivalent level whose portfolio includes cybersecurity, which distinguishes this company's cybersecurity posture. The other elements (board committee name, quarterly cadence) are either generic governance structures or soft cadences that do not elevate the specificity level.


reasoning: This paragraph is a forward-looking risk disclaimer using SEC-mandated materiality language ('reasonably likely to materially affect us') but contains no substantive disclosure about actual cybersecurity measures, governance, or business impact. Per Rule 5, 'could have a material adverse effect' type language—even when phrased as 'reasonably likely'—is speculative boilerplate that does not constitute a Strategy Integration assessment. No specific facts are present; the paragraph could appear verbatim in virtually any public company's 10-K.


fact: Vice President and Chief Information Security Officer (CISO) — firm-specific leadership role at VP level with cybersecurity portfolio

reasoning: This paragraph describes board-level cybersecurity oversight structure — how the Board delegates to the Audit Committee, reporting cadences (quarterly from VP/CISO, annual to full Board), and information flow. The key firm-specific fact is the 'Vice President and Chief Information Security Officer (CISO)' title, which distinguishes this company's governance structure by identifying a specific VP-level role responsible for cybersecurity reporting to the board committee. No externally verifiable claims (dates, numbers, named third parties) are present.


fact: Threat actors unlawfully accessed certain computer systems and exfiltrated images of video meetings and computer screens

fact: Threat actors released a portion of this information publicly because the company did not pay the demanded monetary payment

fact: The company took additional cybersecurity measures including closing off the point of unlawful access and bolstering cyber defensive capabilities

reasoning: This paragraph describes an actual cybersecurity incident with specific details about what threat actors accessed, what data was exfiltrated, and what happened after the company refused to pay a ransom demand—meeting the threshold for Incident Disclosure. The specificity is Quantified-Verifiable because it describes concrete, externally verifiable events (unlawful access, data exfiltration, public release of information) that constitute a real incident rather than hypothetical language.


reasoning: The paragraph answers the question 'How are third-party cyber risks managed?' by stating they use a risk-based approach, consider cybersecurity in vendor selection, and perform due diligence on critical third parties. This is textbook Third-Party Risk content. However, specificity is Generic Boilerplate because the entire paragraph consists of generic concepts ('risk-based approach,' 'due diligence,' 'selection and oversight') that any ERM professional could write — no cybersecurity domain terminology, no firm-specific details (named roles, committees, specific practices), and no verifiable claims. It asserts the existence of a third-party risk program without describing any specific mechanisms.


fact: SOC 1 or SOC 2 report requirement for hosted applications

fact: System and Organization Controls (SOC) terminology used correctly

reasoning: The paragraph's central topic is vendor cybersecurity oversight—specifically requiring SOC reports and monitoring service providers—which maps directly to Third-Party Risk. The specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise: requiring SOC 1/SOC 2 attestation as evidence of security adequacy (a specific cybersecurity practice that requires domain knowledge to implement) and referencing the SOC framework terminology correctly. The paragraph does not contain firm-specific facts (no named committees, roles, or hard numbers) or independently verifiable claims.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for additional cybersecurity risk information. It answers no substantive question about the company's cybersecurity governance, management, processes, or strategy — it merely points elsewhere. No specific facts about cybersecurity practices, roles, or programs are present.


fact: security questionnaires

fact: information security addenda

fact: procuring results of audits and compliance reviews

fact: network infrastructure overviews

fact: different levels of assessment based on service nature, data sensitivity, and third-party identity

reasoning: Paragraph is TP because third-party cyber risk management is the central topic, describing a formal program with specific assessment mechanisms. Specificity is Domain-Adapted because the paragraph shows cybersecurity domain expertise in how third-party oversight is conducted (security questionnaires, compliance reviews, information security addenda) rather than generic risk management language, but contains no firm-specific or externally verifiable facts.


reasoning: This paragraph describes the governance chain (senior leadership → Audit Committee → Board) for cybersecurity oversight, which directly answers 'How does the board oversee cybersecurity?' → Board Governance. The specificity is Generic Boilerplate because it contains no domain-specific cybersecurity expertise (the phrase 'overseeing and managing cybersecurity and related risks' is interchangeable with generic ERM language), no firm-specific facts (Audit Committee and Board of Directors exist at every public company), and no verifiable claims. The entire paragraph is undifferentiated boilerplate that could appear in any 10-K.


fact: Chief Security Officer has more than 20 years in information security roles

fact: Served as global CISO/CSO for three different large European financial institutions

fact: Held a partner position at a global strategy and consulting firm

reasoning: The paragraph describes the Chief Security Officer's qualifications, career history (20+ years, three European financial institutions, global consulting firm), and organizational support structure — clearly addressing 'how management is organized' (MR). The specific claim of 'more than 20 years' is a verifiable lower bound, and the detailed career trajectory creates externally checkable facts, elevating this to Level 4.


fact: National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework

reasoning: The paragraph centers on board-level oversight structure, with the Audit Committee responsible for overseeing the risk management program and cybersecurity integrated into that framework. This maps to Board Governance as the primary question answered. The NIST framework reference demonstrates cybersecurity domain expertise beyond generic risk management language, as an ERM professional would not naturally invoke NIST cybersecurity governance requirements—Level 2 specificity.


reasoning: This paragraph describes the Board's oversight delegation structure (Board → Audit Committee), which directly answers how the board oversees cybersecurity, making it Board Governance. The paragraph contains only generic governance language ('Board of Directors,' 'Audit Committee,' 'risk oversight function') that appears in virtually every public company's cybersecurity disclosure — no domain-specific security terminology, no firm-specific roles or programs, and no verifiable claims. The language passes the ERM test: any risk management professional could apply this same structure to any risk category.


fact: February 2023 (specific date tied to real ransomware incident)

fact: Ransomware attack (specific threat type)

fact: Un authorized release of sensitive personal information of current and former employees

fact: Specific remediation activities: scanning leaked files, identifying impacted individuals, notifying affected persons, providing free credit monitoring

reasoning: This paragraph describes a specific cybersecurity incident (February 2023 ransomware attack), including the nature of the breach (unauthorized release of employee personal information), scope (current and former employees), and concrete remediation actions (scanning leaked files, notifying individuals, providing credit monitoring). The February 2023 date tied to an actual event is an externally verifiable claim, making this Level 4 despite no specific dollar amount being stated.


fact: CISO reports to CIO (reporting line)

fact: CISO has over 20 years of experience in IT and information security

fact: CISO holds undergraduate degree in Information Systems from Xavier University

fact: CISO holds MBA from Michigan State

fact: CISO and regional security leaders have combined total of over 25 IT and Cybersecurity certifications

fact: Named certifications: Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified Information Security Manager (CISM)

reasoning: This paragraph is about Management Role — it describes the CISO position, their reporting line, team composition, professional background, and credentials. The specificity is Quantified-Verifiable because the paragraph contains multiple externally verifiable claims: specific years of experience (over 20), named universities (Xavier University, Michigan State), a specific number of certifications (over 25), and named professional certifications (CISSP, CCSP, CISM) that can be independently verified through credential registries.


reasoning: The paragraph describes a third-party risk management program with standard components (assessments, questionnaires, contractual obligations) that constitute generic vendor oversight language applicable to any risk management function, not cybersecurity-specific expertise.


reasoning: This paragraph describes a generic management-to-audit-committee reporting structure for cybersecurity matters. The language ('members of management report to the audit committee') uses generic governance terminology that exists at every public company and fails the ERM test—no cybersecurity domain expertise is demonstrated. There are no firm-specific facts (no named roles above VP level, no named distinguishing committees, no specific team compositions) and no verifiable claims.


reasoning: This paragraph describes the regulatory framework applicable to the company (financial privacy laws, federal banking agency oversight, SEC disclosure rules) rather than answering any of the six substantive questions about board governance, management roles, risk management processes, third-party risk, incidents, or strategy integration. It is regulatory context, not a description of the company's actual cybersecurity practices. No firm-specific facts or verifiable claims about the company's cybersecurity posture are present; the only specific detail is a rule effective date that is externally known and does not describe the company's actions.


fact: December 15, 2020 - specific date of ransomware incident detection

fact: Ransomware Incident - named incident with specific event

reasoning: This paragraph describes an actual cybersecurity incident (the Ransomware Incident on December 15, 2020), including its nature (ransomware), scope (operational and IT systems), and impact (service delays), making it Incident Disclosure. The specificity reaches Level 4 because the paragraph contains externally verifiable facts: the specific date of detection (December 15, 2020) and a named incident that could be confirmed through external sources such as news reports or regulatory filings from that period.


reasoning: The paragraph describes third-party vendor oversight through generic due diligence language with no firm-specific identifiers, no cybersecurity-domain-specific practices beyond standard ERM vocabulary, and no verifiable claims — making it Level 1 boilerplate about third-party risk.


fact: CISO has over 20 years of information security experience

fact: CISO spent over four years as director in the information security management practice of a big four accounting firm

fact: CISO holds multiple information security certifications

fact: CISO has a B.S. in Network Security

fact: ISSC is comprised of key executives and operating personnel from across the company

reasoning: This paragraph primarily answers 'How is management organized to handle cybersecurity?' by detailing the CISO's reporting line, qualifications, and committee leadership—placing it squarely in Management Role. The specificity reaches Level 4 because the CISO's credentials include quantified, externally verifiable facts: 20+ years of experience, 4+ years at a Big Four firm as director, named certifications, and a specific degree (B.S. in Network Security). One Level 4 fact elevates the entire paragraph.


fact: information security

fact: cybersecurity strategy

reasoning: The paragraph is primarily about management organization for cybersecurity, describing the senior leadership team (President/CEO/Chairman, CFO, General Counsel, VP of IT) and their collective qualifications in information security roles—this is Management Role. The specific titles are firm-specific identifiers but lack security-specific qualifiers (e.g., 'VP of IT' not 'VP of Information Security'), so they don't reach Level 3. However, the paragraph demonstrates domain expertise through terms like 'managing information security,' 'developing cybersecurity strategy,' and 'implementing effective information and cybersecurity programs'—vocabulary that an ERM professional wouldn't naturally use when discussing non-cybersecurity risks, elevating this to Domain-Adapted.


reasoning: The paragraph describes business resilience and continuity practices using business continuity frameworks (BCI, DRII, ISO 22301) with no cybersecurity-specific language, controls, or practices, making it outside the scope of substantive cybersecurity disclosure. No cybersecurity domain terms, firm-specific cybersecurity facts, or verifiable cybersecurity claims are present.


fact: SOC reports

fact: vulnerability and penetration testing

fact: incident response processes

fact: access reviews and controls

fact: backups

fact: monitoring

fact: encryption standards

fact: disaster recovery

reasoning: The paragraph's central focus is vendor/service provider oversight—describing what the ISO assesses when evaluating third parties that store or process confidential data. While the opening sentence references engaging third parties for the company's own program, the bulk of the paragraph details the vendor assessment criteria. Domain-Adapted specificity is assigned because the paragraph demonstrates cybersecurity expertise through specific assessment components (SOC reports, vulnerability/pen testing, access reviews, encryption standards, disaster recovery) that a generic ERM professional would not naturally use without cybersecurity domain knowledge.


reasoning: This paragraph describes the board's oversight structure—specifically how the Audit Committee receives briefings from the COO and conducts annual reviews—which directly answers how the board oversees cybersecurity (Board Governance). Despite mentioning specific roles and cadences, all facts are generic: 'Chief Operating Officer' and 'Audit Committee' are universal corporate roles, 'minimum frequency of once per year' is a soft threshold common to compliance disclosures, and the listed briefing topics are standard governance language that any public company could produce. No domain-specific cybersecurity terminology (e.g., no mention of specific tools, frameworks, or practices), no named individuals, no distinguishing organizational details, and no verifiable external claims.


reasoning: The paragraph's primary function is to make a negative materiality assertion (cybersecurity threats have not and are not reasonably likely to materially affect business strategy, results of operations, or financial condition), which per Rule 5 maps to Strategy Integration. The specificity is Generic Boilerplate because 'from time to time' is soft/indefinite language, and the materiality claim is a non-verifiable self-assertion about absence of impact rather than an externally verifiable fact.


reasoning: This paragraph describes the board's cybersecurity oversight structure, specifically identifying the Audit Committee as the delegated body and outlining reporting lines from Management to Audit Committee to the full Board. Per Rule 1, board-level committees default to BG. The paragraph contains no domain-specific cybersecurity terminology (ERM test: 'risk oversight function' and 'Audit Committee' are standard corporate governance terms any business professional would use), no firm-specific roles or programs beyond generic governance structures that exist at every public company, and no verifiable claims. It is entirely boilerplate description of oversight architecture with no distinguishing facts.


fact: CISO reports quarterly to the Risk and Compliance Committee

fact: Chief Legal Officer title named

fact: Risk and Compliance Committee (named committee)

fact: CISO periodically presents to the Board on cybersecurity topics impacting public companies

reasoning: The paragraph describes the cybersecurity oversight structure with information flowing from CISO through the Risk and Compliance Committee to the Board, with named roles and specific cadences (quarterly reporting, periodic briefings). Named roles (CISO, Chief Legal Officer) and named committee (Risk and Compliance Committee) provide firm-specificity anchors, but there are no hard numbers or externally verifiable quantified claims to reach Level 4.


reasoning: This paragraph is a simple cross-reference to Item 1A (Risk Factors) and contains no substantive cybersecurity disclosure, making it None/Other. There are no facts present—domain terms, firm-specific details, or verifiable claims—so specificity is Generic Boilerplate with an empty fact list.


fact: ERMC named as part of management oversight structure

fact: Vice President of Information Technology named as cybersecurity leadership role

fact: Key employee with over 20 years of experience in information technology and cybersecurity

fact: Senior management team members with training in cyber incident response

reasoning: The paragraph describes the management-level organizational structure for cybersecurity oversight (ERMC, VP of Information Technology, legal/compliance function) and individual qualifications, making it primarily about Management Role rather than process activities. The paragraph achieves Level 4 specificity because it contains a quantified-verifiable claim about a key employee's experience ('over 20 years of experience in information technology and cybersecurity'), which is independently verifiable through background checks or credential verification.


reasoning: The primary purpose of this paragraph is a backward-looking materiality assessment — explicitly stating that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition — which maps directly to Strategy Integration under Rule 5. The mention of occasional threats and breaches serves as contextual support for the materiality conclusion, not as an incident description. The paragraph contains no firm-specific facts, named roles, specific dates, quantified claims, or domain-expertise language beyond generic terms like 'malware and computer virus attacks' that any company could use — yielding Generic Boilerplate.


fact: internal and external vulnerability scans

fact: engage independent security professionals to conduct simulated cyberattacks (penetration testing)

fact: subscribe to threat intelligence feeds

fact: risk assessment framework to categorize identified threats based on likelihood and potential impact

fact: third-party vendor risk assessment

reasoning: The paragraph primarily describes what C3 AI's cybersecurity program does—vulnerability scanning, penetration testing, threat intelligence monitoring, and risk assessment frameworks—which directly answers 'what does the program do?' (RMP). The specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology (vulnerability scanning, penetration testing, threat intelligence feeds) that a generic ERM professional would not naturally use—this demonstrates expertise in how cybersecurity risk management operates, not just that it exists. No firm-specific or externally verifiable claims are made; all facts describe standard cybersecurity practices.


fact: NIST Cybersecurity Framework

fact: FFIEC Information Technology Examination Handbooks

fact: FFIEC Cybersecurity Assessment Tool

reasoning: The paragraph describes what the cybersecurity program does — its objectives, framework alignment, and review cadence — making RMP the primary category. The specificity level is Domain-Adapted because the paragraph references specific cybersecurity industry frameworks (NIST CSF, FFIEC IT Examination Handbooks, FFIEC Cybersecurity Assessment Tool) that demonstrate the writer's expertise in the cybersecurity domain; a generic ERM professional would not naturally reference these specific tools. While the paragraph mentions leadership roles, they are unnamed titles without verifiable claims, so the highest specificity signal comes from the domain terminology.


fact: September 14, 2023 — specific date of public announcement of the cybersecurity incident

fact: Social engineering attack on an outsourced IT support vendor — specific attack vector

fact: Loyalty program database — specific data type accessed by unauthorized actor

fact: Engaged legal counsel and third-party incident response and forensic professionals

reasoning: This paragraph describes an actual cybersecurity incident (the unauthorized access to their IT network via social engineering on a vendor) with a specific date (September 14, 2023) and specific response actions, making it an Incident Disclosure. The September 14, 2023 date is a hard, externally verifiable fact tied to a real event (company announcement), combined with specific incident details like the attack vector (social engineering) and data type (loyalty program database), elevating specificity to Level 4.


reasoning: This paragraph contains only a generic, unspecified acknowledgment of past threats/breaches ('from time to time') with no details about nature, scope, timing, or impact that would constitute substantive incident disclosure. Combined with the completely off-topic second sentence about pharmaceutical industry competition, the paragraph provides no substantive cybersecurity content. The negative assertion about material impact is a disclaimer, not a strategy integration assessment.


reasoning: This paragraph is a backward-looking materiality assessment stating that cybersecurity risks have not materially affected the company's business strategy, results of operations, or financial condition, which maps directly to Strategy Integration per Rule 5. The paragraph contains no specific facts—it is a negative self-assertion about the absence of material impact (not independently verifiable), cross-references to Item 1A, and generic forward-looking disclaimers about future risk.


fact: Firewalls

fact: Intrusion detection/prevention systems (IDS/IPS)

fact: Data loss prevention (DLP)

fact: Antivirus, anti-malware

fact: Mobile Device Management (MDM)

fact: Least privilege principle

fact: Encryption at rest and in transit

fact: Security awareness training

fact: Phishing attempts

reasoning: The paragraph describes specific security tools and controls implemented (firewalls, IDS/IPS, DLP, MDM, encryption, least privilege, security training) — this directly answers what the cybersecurity program does, making it Risk Management Process. The specificity is Domain-Adapted because the paragraph uses cybersecurity-specific vocabulary (IDS/IPS, DLP, MDM, least privilege, encryption at rest/in transit, phishing) that a generic enterprise risk management professional would not naturally use — these terms demonstrate technical cybersecurity expertise beyond generic risk language.


reasoning: The paragraph's central topic is third-party vendor/service provider cybersecurity oversight (risk assessments upon selection, annual third-party assessments, contractual compliance), which maps directly to Third-Party Risk. However, the paragraph contains no firm-specific identifiers (no named programs, roles, or committee structures), no domain-expertise vocabulary beyond generic ERM terms (risk assessments, questionnaires), and no verifiable claims. The language 'risk assessments,' 'questionnaires,' and 'annual' are standard enterprise risk management terms that any ERM professional could write without cybersecurity expertise, failing the ERM test for domain expertise.


reasoning: The paragraph describes how cybersecurity is integrated into the enterprise risk management program and mentions the Chief Risk Officer, but uses entirely generic ERM language that any company could use. No domain-specific cybersecurity practices, no firm-specific leadership roles (CRO is a generic C-suite title), no specific methodologies, tools, or processes are named. The vocabulary ('enterprise risk management,' 'governance processes,' 'reporting channels') applies equally to financial, operational, or compliance risk — it does not demonstrate cybersecurity domain expertise.