fact: IT consultant assists with risk assessment processes

fact: IT consultant helps design and implement cybersecurity policies and procedures

fact: IT consultant monitors and tests safeguards

reasoning: The paragraph describes the cybersecurity program activities (risk assessment, policy design/implementation, monitoring and testing) with the IT consultant as an integrated component of those activities, making this primarily about what the program does (RMP). While oversight of the consultant is mentioned, the framing is about how the consultant serves the company rather than managing cyber risks posed by the consultant. The paragraph uses domain-typical language (risk assessment, cybersecurity policies and procedures, safeguards) but lacks firm-specific facts or verifiable claims—it describes the general function of cybersecurity consulting rather than this company's specific practices.


content_category: Strategy Integration

category_confidence: high

specificity_confidence: high

reasoning: The paragraph directly answers whether cybersecurity threats have materially affected business strategy, results of operations, or financial condition—a Strategy Integration question—with a backward-looking negative assertion. For specificity: 'have not been materially affected' is a negative self-assertion about absence of impact, which is not independently verifiable (per Rule 5 guidance that negative assertions cannot be externally confirmed). The 'last three fiscal years' timeframe is soft and unspecific (no actual fiscal years named). No verifiable facts, firm-specific details, or domain expertise terms are present.

provider: minimax

stage: benchmark


category_confidence: medium

reasoning: The paragraph's primary content is a backward-looking negative assertion about business impact ('To date, we have not experienced any significant impacts from cybersecurity threats') combined with forward-looking speculation ('could have a material impact'), placing it in Strategy Integration. The specificity is Generic Boilerplate because there are no domain-specific terms (ERM test fails — 'safeguards' and 'cyber-attack' are generic), no firm-specific roles or committees, and the negative assertion is a self-reported claim about absence rather than an externally verifiable fact.


content_category: Risk Management Process

reasoning: The paragraph describes the components of the cybersecurity risk management program (risk assessments, security team, external providers, training, incident response plan, third-party risk management, controls framework review for emerging technologies) — all activities rather than governance structure or organizational roles. This is RMP, not BG or MR. The paragraph contains only generic program elements that any company could state; there are no firm-specific facts (named leaders, specific team sizes, named committees, or firm-specific commitments), no domain-specific terminology beyond what any ERM professional would use, and no verifiable quantified claims. The specificity level is Generic Boilerplate.


content_category: Incident Disclosure

fact: Cybersecurity Incident costs net of expected insurance receivable totaled $1.0 million in 2023

fact: System remediation efforts concluded as of December 30, 2023

fact: Insurance proceeds received in Q4 2024 exceeded the recorded receivable by $0.6 million

reasoning: This paragraph describes a real cybersecurity incident at Hillman Solutions, detailing the nature of the attack (IT systems affected, containment actions), timeline (systems restored over one week, remediation concluded December 30, 2023), and financial impacts ($1.0 million in costs, $0.6 million in excess insurance proceeds). The presence of specific dollar amounts ($1.0M, $0.6M) and a precise date (December 30, 2023) makes this Quantified-Verifiable.


fact: Pension Benefit Information, LLC (PBI) identified as the third-party vendor whose systems were breached

fact: Progress Software Corporation's MOVEit Transfer software named as the exploited vulnerability

fact: Approximately 850,000 of Jackson's customers had personally identifiable information obtained

fact: PBI rectified the MOVEit vulnerability (remediation action)

reasoning: This paragraph describes a specific, real cybersecurity incident including the nature of the breach (MOVEit exploitation), scope (850,000 affected customers), and remediation (vulnerability patched by PBI), making it clear Incident Disclosure. The specificity level is Quantified-Verifiable (Level 4) because it contains a hard number (850,000 customers), named vendors and software products, and a named vulnerability — all of which are externally verifiable claims that could be independently confirmed.


content_category: Board Governance

reasoning: The paragraph describes how the Audit Committee (a board-level committee) receives regular reports from management on cybersecurity risks and incident updates. This is about board oversight structure, making it Board Governance. It contains no domain-specific cybersecurity terms (the ERM test would yield identical language for any risk category), no firm-specific facts (Audit Committee is generic; 'management' is generic), and no verifiable claims—making it pure boilerplate applicable to virtually any public company.


fact: February 26, 2024 — date the company received SEC document preservation and production request

reasoning: The paragraph describes an actual cybersecurity incident (the Progress software breach) and its aftermath — specifically the SEC investigation triggered by the breach. While the SEC investigation is the substantive focus, it is a direct consequence of the incident, making Incident Disclosure the primary category. The specificity is driven by the hard date (February 26, 2024) tied to the SEC document request, which is an externally verifiable claim.


content_category: Third-Party Risk

reasoning: The paragraph focuses on the company's ongoing collaboration with third-party vendors for cybersecurity coordination, making third-party risk the central topic. However, all content is generic boilerplate — no specific vendors, named programs, security practices, or verifiable details are provided.


content_category: None/Other

reasoning: This paragraph is a forward-looking disclaimer stating the company cannot guarantee complete success in identifying/preventing cybersecurity risks, followed by a cross-reference to Risk Factors. It contains no substantive cybersecurity disclosure about any of the six categories—it's purely a risk caveat and navigation aid. The paragraph contains no domain-specific cybersecurity terminology (ERM test fails—swap 'cybersecurity risks' for 'operational risks' and it still reads normally), no firm-specific facts (no named roles, committees, or organizational claims), and no verifiable claims (no numbers, dates, or named third parties).


reasoning: The paragraph describes the Incident Response Plan's function (framework, coordination, annual evaluation), making it fundamentally about the cybersecurity program's activities rather than a specific person's role—the Chief Operations Officer is mentioned as the coordination point, not as a role being profiled. For specificity, none of the content demonstrates cybersecurity domain expertise beyond generic risk management language (the ERM test would yield near-identical phrasing), no firm-specific identifiers exist (Incident Response Plan lacks distinguishing features, Chief Operations Officer and management committees are generic roles), and no externally verifiable claims are present—the 'at least annually' cadence is a soft lower bound, not a hard number.


reasoning: The paragraph describes board-level oversight structure—ultimate board responsibility, Audit Committee delegation, and regular reporting cadence—which directly answers how the board oversees cybersecurity. It contains no specific dates, named individuals, quantified metrics, or verifiable claims; the mention of 'Cybersecurity Leadership Team' identifies a reporting body but without any firm-distinguishing detail beyond generic governance structure. All content describes standard public company board governance practices applicable to any SEC filer.


fact: Director of IT Security and Compliance (role title with security qualifier)

fact: IT Steering Committee (named management-level committee)

fact: internal assessment tools

fact: third-party control tests

fact: vulnerability assessments

fact: defensive and continuous monitoring techniques

reasoning: The paragraph primarily describes cybersecurity program activities — assessments, vulnerability testing, audits, and monitoring — which directly answers 'what does the cybersecurity program do?' (RMP). While it mentions Director-level roles and an IT Steering Committee, the paragraph's focus is on processes and tools rather than organizational structure or individual qualifications, so Management Role is secondary. Specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise: it references vulnerability assessments, third-party control tests, defensive monitoring techniques, and industry frameworks — specific security practices that a general ERM professional would not naturally describe. No verifiable external claims or quantified facts are present.


reasoning: The paragraph describes the board's oversight structure—specifically how the Audit Committee supports board oversight of cybersecurity and how it interfaces with the Director of Information Technology. This describes governance structure (BG). For specificity, the 'Audit Committee' is a generic governance role found at every public company and fails the firm-specific test, and 'Director of Information Technology' lacks a security qualifier (not VP+ level with cybersecurity portfolio). No domain-specific security terms, firm-specific distinguishing facts, or verifiable claims are present—pure boilerplate governance language.


reasoning: The paragraph describes third-party vendor review processes, due diligence procedures, and contractual requirements imposed on vendors—central TP content. However, it contains no domain-specific security terminology (SOC 2, penetration testing, specific controls), no firm-specific roles or named programs, and no verifiable quantified facts. The language ('multiple levels of due diligence,' 'stakeholders throughout the company') is generic vendor management language that any ERM professional could write, failing the ERM test for domain expertise.


reasoning: This paragraph describes what the cybersecurity program does — incident response plans, detection procedures, vulnerability management, disaster recovery, and encryption — making Risk Management Process the primary category. The specificity is Generic Boilerplate because the paragraph lists only generic security terms and measures ('incident response plans,' 'vulnerability management policy,' 'disaster recovery plans,' 'encryption') that any company could use without any firm-specific details, domain-expertise terminology, or verifiable claims. The ERM test confirms these terms could apply to any enterprise risk management program without demonstrating cybersecurity-specific expertise.


fact: Named industry standards: NIST, ISO, HIPAA, Payment Card Industry

fact: Assessment types: security questionnaires, security capabilities and maturity assessments, controls evidence reviews, application vulnerability assessments, public internet presence monitoring

reasoning: The paragraph directly addresses how The Cigna Group manages cybersecurity risks from suppliers and vendors through contractual requirements, periodic audits, and risk assessments—answering 'How are third-party cyber risks managed?' The specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise (application vulnerability assessments, public internet presence monitoring, controls evidence reviews) that an ERM professional would not use without specific cybersecurity knowledge, and references named standards (NIST, ISO, HIPAA, PCI) which are domain-level terminology. No firm-specific facts (e.g., named internal programs, specific team compositions, VP-level titles with security qualifiers) are present.


reasoning: This paragraph is a negative assertion (no material cybersecurity incidents) framed around business/financial impact, which qualifies as Strategy Integration per Rule 5. However, it contains no domain-specific terminology, no firm-specific details, and no externally verifiable claims — it is purely boilerplate language common to virtually all SEC 10-K filings. The specificity is Level 1 (Generic Boilerplate) as there are no specific facts anywhere in the paragraph.


content_category: Management Role

fact: CISO position with primary responsibility for cybersecurity risk management

fact: Steering committee on information security

fact: Over 20 years of information security experience

fact: CIO Executive Education Certificate from Stanford University

reasoning: The paragraph is primarily about organizational roles and responsibilities for cybersecurity risk management, featuring the CISO and a steering committee, their responsibilities, and the CISO's qualifications. The 'over 20 years of experience' is a specific lower-bound number, and the Stanford University CIO Executive Education Certificate is an externally verifiable credential, both qualifying as Level 4 facts.


reasoning: The paragraph directly addresses how the company manages third-party cyber risks through its TPRM program, making Third-Party Risk the appropriate category. It contains no firm-specific facts, named programs with distinguishing identifiers, verifiable claims, or domain-specific terminology beyond the generic acronym TPRM — the process described ('gathering information from relevant third parties to assess potential risks associated with their security controls') is standard vendor oversight language that any ERM professional could write, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers 'How has cybersecurity affected the business?' through a backward-looking assessment that cybersecurity risks have not materially affected operations, strategy, or financial condition — a Strategy Integration assessment per Rule 5. The paragraph contains no specific facts; the central content is a negative self-assertion about absence of material impact (not independently verifiable) plus generic disclaimers and a cross-reference to Risk Factors.


fact: CISO and his team

reasoning: This paragraph describes the cybersecurity oversight structure — specifically how information flows from the CISO/team upward to the Audit Committee and Board on a quarterly basis. This is governance-chain content focused on board oversight, making it Board Governance. The mention of 'CISO and his team' is a firm-specific fact that distinguishes this company's cybersecurity leadership from any generic company, elevating specificity to Level 3.


fact: Vice President, IT Security and Compliance

fact: IT Security Director

fact: Chief Information Officer

reasoning: The paragraph describes cybersecurity management organization — specific roles (VP, IT Security Director), their reporting lines (VP reports to CIO), and team qualifications — making it Management Role. Two firm-specific roles with security qualifiers (VP, IT Security Director) plus the CIO as the reporting target set the specificity floor at Level 3.


fact: Late May 2023 - specific timeframe of ransomware attack

fact: Ransomware attack on certain systems on company network

fact: Engaged cybersecurity experts and outside advisors

fact: Worked with appropriate law enforcement authorities

fact: Incident response included containment, assessment, and remediation

reasoning: This paragraph describes an actual cybersecurity incident—the May 2023 ransomware attack—detailing what happened (ransomware), when it occurred (late May 2023), scope (certain network systems), and response actions (investigation, experts, law enforcement, containment/remediation). The specific date anchor 'late May 2023' tied to a real event is externally verifiable through public records, breach notifications, or other sources, making this Level 4 specificity.


reasoning: The paragraph describes the Board's oversight structure for cybersecurity through delegation to the Audit Committee, making Board Governance the appropriate category. The paragraph contains only generic governance language (Board of Directors, Audit Committee, ERM program) that appears identically in virtually every public company's 10-K — no firm-specific facts, domain expertise, or verifiable claims are present, placing it at Generic Boilerplate.


reasoning: The paragraph is explicitly about third-party service provider oversight — describing processes to identify, monitor, and address third-party cybersecurity risks, requiring vendors to manage risks in unspecified ways, and conducting audits as appropriate. Per Rule 3, vendor oversight as the central topic maps to Third-Party Risk. The paragraph contains no domain-specific cybersecurity terminology (ERM test: any risk professional could write this about non-cyber vendor risk), no firm-specific identifiers (no named committees, titles, or organizational specifics), and no verifiable claims (no named auditors, specific audit scope, or quantified metrics) — entirely boilerplate description of third-party oversight intent.


reasoning: The paragraph describes the CISO's organizational position (reporting to CRO), executive team composition, and the existence of an Information Security Program — all structural/role descriptions that place it in Management Role. However, the specificity is Level 1: the language ('Information Security Program,' 'incident response and recovery plans,' 'protect information systems from cybersecurity threats') fails the ERM test — any non-security ERM professional would use the same phrasing. The executive titles (CEO, CFO, CTO, CLO, CISO, CRO) are generic organizational roles present at every public company, not firm-specific differentiators. No domain expertise, no named internal committees, no verifiable claims, no specific practices — just boilerplate governance structure.


fact: Director of ITD with over 7 years of experience leading cybersecurity teams and programs

fact: Director of ITD reports to CFO

fact: Director of ITD is responsible for identifying, considering, and assessing material cybersecurity risks; establishing monitoring processes; implementing mitigation measures; and maintaining cybersecurity programs and systems

specificity_confidence: medium

reasoning: This paragraph describes the organizational structure of cybersecurity leadership — the Director of ITD role, their qualifications (7+ years experience), and reporting line to the CFO — making Management Role the primary category. The specificity reaches Firm-Specific level because the Director of ITD title with explicit cybersecurity responsibility and experience qualification distinguishes this company's organizational structure, even though Director-level IT roles without security qualifiers would not qualify.


fact: Cybersecurity questionnaire for key third parties

fact: Contractual requirement for security controls where applicable

fact: Pre-established standards for vendor cybersecurity posture

fact: Contractual right to discontinue engagement with non-compliant vendors

reasoning: The paragraph's primary focus is third-party cybersecurity oversight—describing how the company assesses vendors (questionnaires), imposes contractual security requirements, and retains the right to discontinue relationships with vendors failing to meet pre-established standards. While it opens with a description of the company's own security tools (cloud-based scanning), the bulk of the content addresses vendor management practices, which is the central topic. The paragraph contains firm-specific facts about the company's vendor oversight methodology that distinguish it from generic descriptions (cybersecurity questionnaires, contractual security controls, pre-established standards, discontinuation rights).


fact: Three named Directors: Ann Bordelon (Chair of the Audit Committee), Paulette Dodson, and Noah Glass

fact: Three Directors have cybersecurity risk management experience

reasoning: This paragraph describes board oversight structure and information flow (Audit Committee receives periodic updates on risk profile and mitigation strategies, shares updates with the broader Board), making Board Governance the primary category. Specificity is Firm-Specific because it names three individual directors (Ann Bordelon, Paulette Dodson, and Noah Glass) with a specific cybersecurity qualification, allowing this disclosure to be uniquely attributed to Portillo's Inc.


reasoning: The paragraph describes cybersecurity program activities — a Security Incident Response Plan, collaborative partnerships during incidents, data protection controls (encryption, MFA, DLP), and business continuity/disaster recovery testing. These answer 'what does the program do' → RMP. Specificity is Level 1 because every term is generic: 'Security Incident Response Plan' is a standard framework name, the partnerships listed (insurance providers, regulatory agencies, law enforcement) are unnamed categories, and the controls mentioned (encryption, MFA, DLP) are standard domain vocabulary any company could claim. No firm-specific roles, named committees, hard numbers, or externally verifiable claims are present.


fact: in 2019, the company was victim of a wire fraud scheme

fact: fraudulent party compromised the email account of one of our employees

fact: sent a fraudulent wire transfer request to our bank

fact: implemented multi-factor authentication (MFA) across all our systems and email accounts

reasoning: The paragraph describes an actual cybersecurity incident (2019 wire fraud scheme involving a compromised employee email account and unauthorized wire transfer) with specific details about the attack method, timeline, and remediation, making it Incident Disclosure per Rule 4. The 2019 date tied to a real incident and the specific mention of MFA implementation across all systems are externally verifiable facts establishing Level 4 specificity.


fact: identification and testing of vulnerabilities

fact: phishing simulations

fact: internal security reviews of its information systems and related controls

fact: external reviews of the cybersecurity program and practices

fact: assessments of relevant data protection practices

fact: targeted attack simulations

reasoning: The paragraph describes cybersecurity program activities—vulnerability testing, phishing simulations, internal/external security reviews, and targeted attack simulations—making 'Risk Management Process' the appropriate category as it answers 'what does the program do?' Specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise with terms like 'vulnerability testing,' 'phishing simulations,' and 'targeted attack simulations' that a generic ERM professional would not naturally use; these are specific security practices rather than general risk management language. No firm-specific organizational facts or externally verifiable claims are present.


reasoning: This paragraph is a forward-looking disclaimer asserting that the company's cybersecurity program cannot be guaranteed to be fully effective, paired with a cross-reference to risk factors. It does not answer any of the six substantive questions — it contains no governance description, management role details, program activities, vendor oversight, incident disclosure, or business impact assessment. It is pure cautionary language. No domain-specific technical terms, firm-specific organizational facts, or verifiable claims are present; all assertions are hedged and speculative ('can be no assurance,' 'will be fully effective'), making this Generic Boilerplate.


fact: CTO has over 26 years of extensive information technology experience

fact: CTO's experience includes roles as Director of Technology, Information Technology Manager, Technical Manager, and Systems Analyst

fact: cybersecurity team comprises certified and experienced information security professionals

reasoning: The paragraph's primary focus is describing management's organizational role in cybersecurity — specifically the CTO's responsibilities, qualifications, and team composition — making it Management Role. The specificity is elevated to Level 4 by two verifiable claims: the CTO's over-26-years of IT experience (a specific number with lower bound that could be checked against a resume) and the named prior roles (Director of Technology, IT Manager, Technical Manager, Systems Analyst) which provide a verifiable career trajectory.


reasoning: This paragraph describes how cybersecurity information flows to the board — quarterly updates on material events and an annual program overview — making it fundamentally about board oversight structure (Board Governance). However, it contains no firm-specific facts, domain terminology, or verifiable claims; the cadence terms ('quarterly,' 'annual') and governance references ('risk assessment,' 'governance') are generic corporate language that any public company could use, failing the ERM test for domain expertise and offering nothing to distinguish this company's cybersecurity posture.


reasoning: The paragraph describes management's reporting function to the audit committee (quarterly briefings covering policies, threat landscape, incidents, investments, and compliance), which falls under how management is organized to handle cybersecurity information flow—consistent with MR rather than BG, as the subject is management's role rather than the board's committee structure. All content uses generic cybersecurity terminology that any ERM professional could produce ("incident response plans," "threat landscape," "cybersecurity policies") without demonstrating domain-specific knowledge; there are no named roles, specific technologies, named programs, or quantified metrics that would elevate specificity.


reasoning: This paragraph is standard forward-looking disclaimer language with a negative assertion about past incidents. Per Rule 5, negative assertions ('have not experienced') are SI, but the parenthetical exception states that 'have not experienced any material cybersecurity incidents' is NOT SI—it is a negative self-assertion. Combined with the speculative 'could have a material adverse effect' which the rules explicitly mark as NOT SI, the paragraph contains no substantive cybersecurity content. The paragraph contains no domain-specific terminology, no firm-specific facts, and no verifiable claims—only boilerplate that appears in virtually every public company's filings.


reasoning: This paragraph is a generic disclaimer about cybersecurity risk exposure and commitment to improvement without substantive disclosure of any governance structure, management role, risk management process, or incident. It contains no domain-specific terminology (ERM test passes — any risk manager could write this), no firm-specific facts (no named roles, committees, or programs), and no verifiable claims (no numbers, dates, or named certifications). It is pure boilerplate.


fact: extended detection and response

fact: vulnerability scanning

fact: penetration tests

reasoning: This paragraph describes specific components of Clover Health's cybersecurity program (monitoring, XDR, vulnerability scanning, training, phishing simulations, incident response team, penetration tests), making it clearly about what the program does rather than governance structure or management roles—qualifying as Risk Management Process. The use of domain-specific terms like 'extended detection and response' (XDR), 'vulnerability scanning,' and 'phishing simulations' demonstrates cybersecurity expertise beyond generic ERM language, earning Domain-Adapted specificity.


reasoning: This paragraph describes the procedural steps the IT team follows when a cybersecurity incident occurs—initial assessment, cross-functional review meetings, and the types of information discussed. This is clearly about incident response procedures (RMP), not about an actual incident (ID) since it uses 'in the event of' language indicating hypothetical/procedural content. The specificity is Generic Boilerplate because the paragraph describes incident response in purely generic operational terms ('initial assessment,' 'cross-functional team,' 'nature and scope of the attack') that any company could write—none of the terminology demonstrates cybersecurity domain expertise (ERM test: a non-security ERM professional would use the same language), nor does it contain any firm-specific facts or externally verifiable claims.


reasoning: This paragraph describes board-level oversight structure for cybersecurity—specifically that the Audit Committee and technology committee oversee cybersecurity risk management and that management provides regular reports to the board. This directly answers 'How does the board oversee cybersecurity?' making it Board Governance. However, the paragraph contains only generic governance language ('general oversight function,' 'risk management processes,' 'appropriate mitigation measures,' 'policies and procedures') that any public company could use. There are no named individuals, specific tools or practices, quantified claims, or other facts that would elevate specificity above Level 1. The technology committee reference is a committee structure, not a firm-specific program detail, and the generic cadences and roles do not constitute specific facts.


reasoning: This paragraph is a forward-looking disclaimer that speculates about potential cybersecurity failures and cross-references risk factors. Per SI Rule 5, "could have a material adverse effect" language is explicitly categorized as NOT Strategy Integration — it is generic speculation found in every 10-K. The paragraph contains no substantive description of actual cybersecurity processes, assessments, or program activities. It functions as a disclaimer rather than disclosure.


fact: security assessments of all third-party providers before engagement

fact: ongoing monitoring for compliance with cybersecurity standards

fact: quarterly assessments by Cybersecurity Manager

fact: monitoring by security engineers on an ongoing basis

reasoning: The paragraph's primary focus is third-party cybersecurity oversight through pre-engagement assessments and ongoing monitoring, making Third-Party Risk the central category. The specificity is Domain-Adapted because the paragraph describes specific security practices (security assessments, ongoing monitoring, compliance frameworks) that demonstrate cybersecurity domain expertise rather than generic business processes any ERM professional could describe. The 'Cybersecurity Manager' reference does not qualify as firm-specific under Level 3 because it is a Manager-level role, not VP/Director-level; similarly, 'security engineers' is a generic role descriptor. The final sentence asserting no material incidents is a self-reported negative assertion, not externally verifiable.


reasoning: The paragraph is primarily a cross-reference to Item 1A Risk Factors plus a generic description of assessment activities and a negative assertion about material incidents. The assessment activities described use only generic ERM language ('policies, standards, processes, and practices') that any non-security professional could write, failing the ERM test for domain expertise. The materiality assertions are negative self-claims (not externally verifiable per Rule 5). No firm-specific or quantified-verifiable facts are present.


reasoning: The paragraph describes how members of management (legal, finance, internal audit) oversee cybersecurity through briefings, threat intelligence, external consultants, and security tools—this answers 'how management is organized' to handle cybersecurity, fitting Management Role. The language is entirely boilerplate: 'various means,' 'governmental, public or private sources,' 'external consultants we engage,' 'security tools deployed in the IT environment' — none of these terms are specific enough to pass the ERM test or identify this company. No named committees, no specific tools, no named roles, no quantified measures.


reasoning: This paragraph primarily answers 'Has cybersecurity affected or will it affect our business?' through a backward-looking assessment (past incidents have not had a material impact on business strategy, results of operations, or financial condition) and a forward-looking disclaimer about future risk. Per SI Rule 5, statements stating conclusions about business outcomes map to Strategy Integration. The paragraph contains no specific facts—'we have in the past experienced threats' is a generic assertion with no details (no dates, scope, or nature of incidents), the materiality assessment is a self-reported conclusion, and the cross-reference to Risk Factors is not a cybersecurity disclosure. One verifiable fact anywhere would be required to elevate specificity beyond Level 1.


fact: CIA triad (data security, availability, and confidentiality) as framework for vendor assessment

reasoning: The paragraph directly describes vendor cybersecurity oversight—specifically assessments performed ON third-party vendors to evaluate their security commitments—which is the central topic of Third-Party Risk (Rule 3: requirements imposed ON vendors). The CIA triad (data security, availability, confidentiality) is a foundational cybersecurity domain concept that an ERM professional would not naturally use outside a cybersecurity context, passing the ERM test and elevating this to Level 2. No firm-specific details (named vendors, specific team composition, named committee) or verifiable claims (certifications, named third-party assessors, specific dates) are present, keeping specificity at Domain-Adapted rather than higher.


fact: patching and vulnerability management

fact: cybersecurity tabletop exercise

fact: supplier management

fact: security awareness training

fact: cybersecurity threat assessment

reasoning: The paragraph describes the board's oversight structure for cybersecurity, including the frequency of briefings (at least annually, semiannual) and what topics flow to the Board of Directors—making this Board Governance. Specificity is Domain-Adapted because the paragraph demonstrates cybersecurity expertise through domain-specific terms like 'patching and vulnerability management,' 'cybersecurity tabletop exercise,' and 'supplier management' that a non-security ERM professional would not naturally use; it goes beyond generic risk management language.


fact: identity management and access control safeguards

fact: system and network security and monitoring

fact: information protection and governance

fact: ongoing systems and equipment maintenance

reasoning: The paragraph describes what the cybersecurity program does—specifically protective and preventative security measures—making RMP the appropriate category. The specificity is Domain-Adapted because it uses cybersecurity domain terminology (encryption of data in transit and at rest, identity management and access control, network security and monitoring) that demonstrates specialized security knowledge beyond generic risk management language; an ERM professional would not naturally use this vocabulary.


fact: Senior Vice President of Engineering and Chief Information Security Officer (CISO) (reporting to CEO)

fact: General Counsel and Head of Global Affairs (reporting to CEO)

fact: Chief Privacy Officer (reporting to General Counsel)

fact: Privacy and Security Council

reasoning: The paragraph's primary purpose is describing how management is organized to handle cybersecurity — detailing roles (CISO, Chief Privacy Officer, SVP of Engineering), their reporting lines, and a named management-level committee. This directly answers 'How is management organized?' → Management Role. The paragraph contains several firm-specific facts: VP-level security-titled roles (CISO, Chief Privacy Officer), a named committee (Privacy and Security Council), and specific reporting relationships to the CEO. It does not demonstrate cybersecurity domain expertise beyond generic ERM language (understanding threats, establishing priorities, integrating into risk management), and contains no externally verifiable claims.


reasoning: The paragraph primarily describes a Director's role responsibilities (development, operation, maintenance of information security program) and qualifications (extensive IT experience, cybersecurity knowledge), with the Director and CFO conducting regular risk reviews — all organizational/structural content about management's cybersecurity role. However, no firm-specific identifiers (full title, name, committee name) are provided, no domain-specific security terminology beyond generic 'information security program and controls' is used, and no verifiable facts (certifications, specific credentials, named tools, team size) are present — leaving only boilerplate governance language with no elevatable facts.


fact: March 2020 ransomware attack in which cybercriminals accessed company IT systems

fact: Confidential information was stolen during the attack

fact: Company isolated the source and restored normal operations

fact: Attack has not resulted in material day-to-day impact to operations or data access

reasoning: This paragraph is primarily about a specific past cybersecurity incident (the March 2020 ransomware attack), describing what happened, the scope (systems accessed, information stolen), and the response (isolated, restored) — making it Incident Disclosure per Rule 4. The March 2020 date is a specific externally verifiable fact tied to a real event, and the description of what occurred (ransomware, systems accessed, information stolen) constitutes hard, confirmable claims about a historical incident. The materiality disclaimers are subordinate to the incident description rather than the dominant frame.


fact: incident response plan processes (containment, review, escalation, recovery, remediation)

reasoning: The paragraph primarily describes what the incident response program does — the specific processes of containment, review, escalation, recovery, and remediation — which defines the RMP category. While committee structures (IRT, DPT) and governance chains (DPT → Audit Committee) are mentioned, they are described in service of explaining the IRP process, not as standalone governance or organizational descriptions. The Chief Information Officer is mentioned as a committee member but without individual identification or specific qualifications that would elevate to firm-specific. The IRP process terminology and security-specific concepts (containment, remediation) demonstrate domain expertise consistent with Level 2.


reasoning: The paragraph's central topic is third-party vendor oversight — contractual requirements, pre-engagement reviews, annual re-evaluation, and data deletion at termination — placing it in Third-Party Risk per Rule 3. The paragraph is dominated by generic risk management language (industry best practices, cybersecurity objectives, sensitive data) without named frameworks, specific security tools, or VP-level cybersecurity titles. The timing details ('at least annually,' 'at termination') are embedded in generic boilerplate rather than functioning as firm-specific identifiers.


fact: Chief Information Officer (CIO) oversees Chief Information Security Officer (CISO)

fact: Cyber Incident Response Teams under CISO

fact: Monitoring and analyzing cybersecurity posture in partnership with Risk and Legal

reasoning: The paragraph describes the organizational structure for cybersecurity leadership (CIO → CISO hierarchy, CISO's team responsibilities, Cyber Incident Response Teams) which is the primary content of Management Role. The CISO and CIO titles are generic roles found across many companies; the paragraph uses cybersecurity domain-specific terminology (information security strategy, cybersecurity posture, Cyber Incident Response Teams) that demonstrates expertise beyond generic ERM language, qualifying as Domain-Adapted specificity.


fact: ISO 27001:2022 information security standard

fact: Security Operations Center (SOC) with enterprise event visibility

reasoning: The paragraph primarily describes what the cybersecurity program does—technical defenses, compliance processes, SOC operations, and framework adoption—making RMP the appropriate category. The references to ISO 27001:2022 (a named security standard) and SOC (a specific cybersecurity infrastructure concept) both demonstrate cybersecurity domain expertise that goes beyond generic ERM language; an enterprise risk management professional would not naturally use these terms without cybersecurity domain knowledge. No firm-specific claims (named leaders, specific team sizes, quantified metrics) are present.


fact: CIO has over two decades of experience in technology development, management, and security

fact: CIO holds a technical undergraduate degree and a graduate business degree with strong technical focus

fact: CEO, CFO, and GC each have over 15 years of experience managing enterprise risks, including cybersecurity threats

reasoning: The paragraph describes management-level cybersecurity leadership qualifications (CIO, CEO, CFO, GC), their experience levels, and educational backgrounds — all centered on WHO is responsible for cybersecurity governance and their credentials, making it Management Role. The specific experience thresholds ('over two decades' and 'over 15 years') are hard numbers with lower bounds that are externally verifiable, placing this at Level 4.


reasoning: The paragraph describes a procedural activity (employee communication on cybersecurity provisions at onboarding and annually) aimed at mitigating internal threats. This is a description of a program activity within the cybersecurity function. No firm-specific identifiers, named roles above VP level, or externally verifiable claims are present. The cadence (onboarding + annual) is standard boilerplate common to virtually any formal cybersecurity program, and the language does not demonstrate cybersecurity domain expertise beyond what any compliance professional would use.


reasoning: The paragraph is primarily a cross-reference to Item 1A with a single generic statement that 'senior leadership evaluates cybersecurity risks.' This language is interchangeable with any public company's disclosure and provides no detail on governance structure, processes, or practices. No substantive cybersecurity governance content is present beyond the cross-reference.


fact: US-CERT alerts (US Computer Emergency Readiness Team) as a source of threat intelligence

fact: Preventative maintenance tools as a category of security controls

fact: CFO as executive overseeing information security program

fact: VP of IT as senior role responsible for information security program

fact: Information Security Manager as role with reporting responsibilities

fact: Weekly reporting cadence from Information Security Manager to VP of IT

fact: Quarterly reporting cadence from VP of IT to CFO

fact: Quarterly board briefings on cybersecurity incidents

fact: Annual board overview of information security program

fact: Cybersecurity testing as a specific program component mentioned to board

reasoning: This is a governance-chain paragraph describing the reporting structure from Information Security Manager up through VP of IT and CFO to the board of directors, with specific cadences for each level—Board Governance category per Rule 1. The paragraph contains multiple firm-specific facts including named senior roles (CFO, VP of IT, Information Security Manager), specific reporting cadences (weekly, quarterly, annual), and a named threat intelligence source (US-CERT). While no externally verifiable hard numbers are present, the organizational structure and role assignments distinguish this company's cybersecurity governance from any other public company.


reasoning: The paragraph describes what the cybersecurity program does—policies, risk assessment, protective measures, monitoring, and incident response—which maps directly to the Risk Management Process question. However, all language is generic boilerplate: 'comprehensive set of policies,' 'robust protective measures,' 'user awareness and education,' 'continuously monitoring'—none of this would distinguish Perimeter Solutions from any other public company. No domain-specific terminology (NIST, SIEM, EDR), no named frameworks, no firm-specific organizational facts, and no verifiable claims. This is standard 10-K language that could appear in any company's disclosure.


reasoning: This paragraph states a negative assertion about cybersecurity's impact on the business (has not materially affected business strategy, results of operations, or financial condition), which is a Strategy Integration assessment per Rule 5. The paragraph contains no specific facts—no named incidents, dates, numbers, domain-specific security terminology, or any verifiable claims that would elevate specificity above Level 1. References to 'threats from cybersecurity' and 'third party vendors' data and information systems' are generic phrases any public company could use. The cross-reference to Risk Factors is also non-substantive (N/O).


reasoning: The paragraph's primary function is describing the board oversight structure — the Risk Management Committee's oversight role and the quarterly reporting flow from management (EVP ERM) to the board. This is a classic governance-chain description. While 'EVP ERM' appears, it functions as a relay point in the reporting chain rather than as the subject of a leadership/qualification discussion. No domain expertise beyond generic ERM terms (risk management framework, risk management policies, monitoring), no quantifiable or externally verifiable facts, and no firm-specific distinguishing details beyond what any public company could claim.


fact: encryption

fact: data loss prevention technology

fact: authentication technology

fact: entitlement management

fact: access control

fact: anti-virus and anti-malware software

fact: transmission of data over private networks

fact: National Institute of Standards and Technology Cybersecurity Framework

reasoning: The paragraph describes what Fortress's cybersecurity program does—specific security tools and controls (encryption, DLP, authentication, anti-virus/malware, access control) and risk categories addressed—making it primarily about the cybersecurity program rather than governance oversight or organizational structure. The specificity level is Domain-Adapted because the paragraph contains cybersecurity domain terminology (security tools, architectural concepts, NIST CSF reference) that an enterprise risk management professional without cybersecurity expertise would not naturally use; however, no firm-specific identifiers or externally verifiable claims are present.


reasoning: The paragraph's primary content is a backward-looking assessment that cybersecurity has not materially affected business outcomes (SI), followed by generic boilerplate about ongoing risk assessment and investment. No domain expertise, firm-specific identifiers, or verifiable facts are present.


fact: Security Committee oversees management of risks from cybersecurity threats

fact: Chief Security Officer (CSO) responsible for developing, implementing, and maintaining cybersecurity risk management policies and procedures

fact: CSO provides regular cybersecurity updates to Chairman of the Board

fact: Cyber Risk Advisory Committee oversees matters regarding Company's Information Technology strategy, priorities, and governance, including cybersecurity threats and risk assessments

reasoning: The paragraph describes board-level oversight structure, with the Security Committee (a board committee) overseeing cybersecurity threats and the full board reviewing major risk exposures, making this primarily a Board Governance disclosure. The specificity is Firm-Specific because the two named committees (Security Committee and Cyber Risk Advisory Committee) are company-specific governance bodies with defined cybersecurity responsibilities that distinguish this company's oversight structure from generic descriptions. The CSO role and reporting relationship to the Chairman of the Board further anchor this as company-specific organizational structure rather than boilerplate.


fact: January 2023 – specific date when a security incident occurred

fact: Reported incident to federal law enforcement – named external authority

reasoning: This paragraph describes an actual cybersecurity incident — its timing (January 2023), nature (impacted computer systems operability), and response (reported to federal law enforcement, systems restored) — making it an Incident Disclosure per Rule 4. The January 2023 date is a hard, externally verifiable fact (an external party could confirm an incident occurred at that time through law enforcement records or other sources), supporting Level 4 specificity.


fact: Audit committee specifically assisting the board in risk oversight

fact: CTO responsible for developing and implementing information security program

fact: Quarterly basis for cybersecurity reporting to audit committee

fact: In 2023, management hosted an expert during the annual board of directors' retreat to discuss cybersecurity threat landscape

reasoning: The paragraph primarily describes board oversight structure (board ultimate oversight, audit committee role, reporting cadence, board education practices), making Board Governance the dominant category. The 2023 date tied to a specific board education event (expert presentation at annual retreat) provides an externally verifiable temporal anchor, though the expert is not named, making this a borderline Level 3/L4 determination.


reasoning: The paragraph primarily describes the organizational structure for cybersecurity management — the CISO's coordination role, multidisciplinary teams, and reporting lines to the Audit Committee — making Management Role the best fit. However, specificity is Generic Boilerplate because all elements are standard corporate governance language: 'CISO' is a generic role title, 'Audit Committee' exists at every public company, 'incident response and recovery plans' are universal boilerplate, and 'real time' is common terminology. No firm-specific facts (no named individuals, no specific team composition, no named programs), no domain expertise beyond generic cybersecurity topic language, and no verifiable claims (no numbers, named vendors, certifications, or specific dates).


reasoning: The paragraph describes the company's cybersecurity risk management approach (processes, controls, technologies to assess/identify/manage risks) with threat vector enumeration, making RMP the primary category despite some governance mentions. The content contains no Level 2+ domain terminology (ERM-test-passing security-specific concepts), no firm-specific roles (VP of IT lacks security qualifier), and no externally verifiable claims — the generic threat list and governance references are boilerplate applicable to any company, setting specificity at Level 1.


reasoning: The paragraph describes the Board's oversight structure—specifically how the Audit Committee receives quarterly reports from management, conducts annual cybersecurity risk assessments, and how information flows to the full Board. This answers 'How does the board oversee cybersecurity?' → Board Governance. The paragraph contains only generic governance language (quarterly reviews, annual assessment, Audit Committee, Internal Audit Group) with no firm-specific titles at VP-level or above, no named individuals, no specific security tools, and no verifiable claims. One could swap company names and the statement would fit any public company—this is Generic Boilerplate at Level 1.


fact: vulnerability scans related to vendors

fact: security questionnaires

reasoning: The paragraph directly addresses how Lionsgate manages cybersecurity risks associated with its third-party service providers through a structured vendor management program. While it describes generic components (risk assessments, auditing, contractual obligations), it includes 'vulnerability scans related to vendors' and 'security questionnaires' which demonstrate cybersecurity domain expertise beyond generic ERM language—vulnerability scanning is a security-specific practice not naturally used by enterprise risk management professionals describing non-cyber vendor oversight. The paragraph does not contain firm-specific facts (no named vendors, no specific tools, no quantifying details) and remains a description of a standard vendor risk management program.


fact: Vice President of Information Technology

reasoning: The paragraph describes board oversight structure (audit committee responsibility, quarterly meetings, annual VP-level review) making Board Governance the primary category. Specificity is elevated to Level 3 by the mention of a VP of Information Technology role, which is a VP-level title with an IT qualifier.


fact: TPG's CISO previously held various leadership roles within the Technology Risk department of one of the world's largest banking institutions over a 17-year period

fact: TPG's CISO holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington

fact: TPG's CISO is a Certified Information Systems Security Professional (CISSP)

fact: Enterprise Risk Committee (ERC) is led by TPG's Chief Executive Officer

fact: Operational Risk Committee (ORC) is responsible for applying policy decisions of the ERC

fact: CISO periodically reports potentially material cybersecurity incidents to the ORC

fact: CISO reports to the ERC at least annually

reasoning: The paragraph primarily describes the organizational structure for cybersecurity management at TPG—the CISO's role, reporting lines, and committee structure—making it Management Role. The specificity is elevated to Level 4 by the CISO's verifiable credentials (CISSP certification, specific degree from University of Texas at Arlington) and the externally verifiable 17-year tenure at a major bank's Technology Risk department. The named committees (ERC, ORC) and specific reporting cadences (periodically, at least annually) further reinforce firm-specific organizational details.


reasoning: The paragraph describes a standard governance chain (Board → Audit Committee → Management/CFO) for cybersecurity oversight, which is the defining structure of Board Governance. However, it contains no specific cybersecurity domain expertise, no firm-specific roles beyond generic titles (Board, Audit Committee, CFO), and no verifiable claims — making it generic boilerplate that could appear in any public company's 10-K.


fact: CSO reports directly to Executive Vice President and Chief Operations Officer

fact: CSO has over 20 years of security experience

fact: Audit Committee receives quarterly reports

fact: certifications including Certified Information Systems Security Professional (CISSP)

fact: Certified Information Security Manager (CISM)

reasoning: The paragraph primarily describes the management organization of the cybersecurity function (CSO role, reporting line to EVP/COO, team qualifications and credentials, ongoing training investments) rather than focusing on the board oversight structure itself, making Management Role the central category. The specificity is driven by verifiable facts: the CSO's reporting line (Level 3), over 20 years of security experience (Level 4), quarterly reporting cadence to the Audit Committee (Level 4), and named certifications CISSP and CISM (Level 4), with the highest level determining overall specificity.


fact: CISSP, CCNP, CISA, and CySA+ certifications held by management team members

reasoning: The paragraph focuses on management's qualifications (collective experience and certifications) for overseeing cybersecurity risks, making this clearly a Management Role disclosure. The named certifications (CISSP, CCNP, CISA, CySA+) are individually verifiable through their respective certification bodies (ISC², Cisco, ISACA, CompTIA), satisfying the quantified-verifiable threshold — one verifiable fact anywhere in a paragraph sets the specificity floor.


fact: Incident occurred in 2024

fact: Unauthorized access involved an employee's email account

fact: Threat actor fraudulently diverted Company funds to its bank account

reasoning: The paragraph describes an actual cybersecurity incident (2024, unauthorized email access, fund diversion) with nature, scope, timing, and impact — the textbook definition of Incident Disclosure. The specific year '2024,' the specific mechanism (employee email account compromise leading to fraudulently diverted funds), and the specific consequence (funds diverted to threat actor's bank account) are all concrete claims that could be independently verified through forensic investigation or financial records.


reasoning: The paragraph describes how the Audit & Finance Committee (a board-level committee) oversees cybersecurity strategy, reviews policies, and receives briefings multiple times per year — all questions about board oversight structure. No specific facts are present: 'Audit & Finance Committee' is a generic committee identifier found at every public company, 'multiple times a year' is a soft cadence with no hard number, and 'CISO' and 'CIO' are role titles mentioned only as briefing participants, not as the paragraph's focus. All language ('regularly assess,' 'periodic basis,' 'as needed') is generic governance boilerplate that provides no verifiable, firm-specific, or domain-expert detail.


fact: VP of IT has served in information technology and information security for over 24 years

fact: VP of IT previously served as Chief Information Security Officer of a healthcare company

fact: VP of IT was a member of the cyber emergency response team at several companies

fact: VP of IT holds undergraduate and graduate degrees in computer science

fact: VP of IT has attained various professional certifications in cybersecurity

fact: NVP of Finance holds undergraduate and graduate degrees

fact: Cybersecurity Response Committee members hold undergraduate and graduate degrees in respective fields

fact: NVP of Finance and Cybersecurity Response Committee have over 50 years of collective experience

fact: Collective experience includes managing enterprise risks at the Company and at similar companies, including cybersecurity threats

reasoning: This paragraph describes the qualifications, experience, and educational background of named roles (VP of IT, NVP of Finance) and a specific committee (Cybersecurity Response Committee), making it primarily about Management Role. The specificity is elevated to Quantified-Verifiable by multiple hard numbers: 'over 24 years' of VP of IT experience, 'over 50 years of collective experience,' and specific named roles (CISO, cyber emergency response team member) that are externally verifiable through employment history.


reasoning: This paragraph describes board oversight structure and information flow (who reports to the board and what topics are covered), which directly answers how the board oversees cybersecurity → Board Governance. The paragraph contains only generic governance language ('Board,' 'CCO,' 'CIO,' 'CISO,' 'periodic updates,' 'threat landscape') that any public company could use; the reference to 'Morgan Stanley's Cybersecurity Program' is a named external entity (service provider) but does not constitute firm-specific detail about the registrant's own cybersecurity posture. No domain-specific security practices, firm-specific organizational facts, or verifiable claims are present.


reasoning: The paragraph describes third-party vendors and experts engaged to perform assessments, conduct audits, and evaluate the cybersecurity program—activities that are part of the program's operational toolkit rather than third-party risk oversight. Applying Rule 3, these third parties are 'hired to serve the company' (perform assessments), making this RMP. For specificity, the language ('engages third-party experts to perform assessments,' 'evaluate efficacy') describes cybersecurity program activities in generic terms that any non-specialist could write; no domain-specific security practices, tools, or architectural concepts are present that would pass the ERM test. The CISO and Audit Committee references are generic governance roles found at every public company.


reasoning: The paragraph describes board oversight structure for cybersecurity — the Audit Committee's designated role, cadence of updates, and information flow from the CISO and CIO to the board. This directly answers 'How does the board oversee cybersecurity?' making Board Governance the appropriate category. For specificity: the CISO and CIO are role titles without named individuals or VP-level qualifiers that would distinguish this company; 'quarterly or as needed updates' is a soft cadence; 'protocols for escalation' is generic without firm-specific detail. The paragraph contains no domain-specific cybersecurity terminology (ERM language applies equally to financial, operational, or strategic risk), no named individuals, no specific dates, no hard numbers, and no externally verifiable claims. It is entirely boilerplate governance language adapted for the cybersecurity context.


fact: Morgan Stanley's Non-Financial Risk Committee

fact: Firm Risk Committee

fact: BOTC

fact: MS Board

fact: CIO

fact: Head of Operational Risk

reasoning: The paragraph describes a governance-chain structure showing how cybersecurity risks flow from management-level committees to board-level committees (Firm Risk Committee, BOTC, MS Board) — this directly answers how the board oversees cybersecurity. The paragraph contains firm-specific facts: named named committees (Non-Financial Risk Committee, Firm Risk Committee, BOTC) and specific roles (CIO, Head of Operational Risk) that distinguish this company's governance structure from generic boilerplate.


fact: Randy Jepsen, Vice President of IT

fact: over 25 years of experience in the IT industry

fact: 19 years at Smith Douglas and The SMART Builder Solutions

fact: Russell Devendorf, Chief Financial Officer

fact: previously oversaw IT and risk management at a publicly traded homebuilder from 2008 to 2017

fact: implemented an incident response plan and cybersecurity insurance

fact: previous combined experience of almost 50 years managing IT and internal audit functions at public companies

reasoning: The paragraph focuses on management's organizational structure for cybersecurity — describing named individuals, their specific roles (VP of IT, CFO), their qualifications, career history, and reporting responsibilities — which directly answers 'How is management organized to handle cybersecurity?' (Management Role). Specificity reaches Level 4 because the paragraph contains multiple externally verifiable claims: specific tenures (25 years IT experience, 19 years at SDHC, 2008–2017 tenure), named individuals (Randy Jepsen, Russell Devendorf), and concrete policy implementations (incident response plan, cybersecurity insurance) that could be confirmed against public records or resumes.


fact: vulnerability assessments

fact: threat environment

fact: information security considerations

reasoning: The paragraph describes board oversight structure (Board → Audit Committee), reporting cadences, and information flows to the board — all hallmarks of Board Governance. Specificity is Domain-Adapted because the writer demonstrates cybersecurity expertise by referencing specific topics in board reports (vulnerability assessments, threat environment, information security considerations) that a general ERM professional would not naturally use — these require cybersecurity domain knowledge.


fact: CISO (Chief Information Security Officer)

reasoning: The paragraph describes board oversight structure through briefing frequency and information sources, making it a Board Governance paragraph. The presence of a named CISO role at this company constitutes a firm-specific fact (cybersecurity leadership at executive level), elevating specificity to Level 3. The reference to 'external experts' is too generic to qualify.


fact: Director of Information Security has over 30 years of experience in IT and information security

fact: Director of Information Security is a Certified Information Systems Security Professional (CISSP)

fact: OD Technology Department implements programs to protect information systems

fact: Multidisciplinary teams deployed throughout the Company address cybersecurity threats

fact: Director of Information Security monitors threats and incidents in real time

fact: Director of Information Security reports to the Risk Committee

reasoning: The paragraph's primary focus is the Director of Information Security's qualifications, organizational role, and reporting structure—clearly Management Role content. The Director's grammatical centrality and the emphasis on role definition (rather than governance oversight structure) confirms MR over BG. Specificity reaches Level 4 due to two independently verifiable claims: the named CISSP certification (verifiable through (ISC)² registry) and the specific claim of 'over 30 years' of experience (a hard lower bound on tenure).


fact: Chief Information Security Officer (CISO) at Corebridge Financial

fact: CISO coordinates with other corporate functions and business segments

fact: CISO addresses all aspects of the Program including technology changes, internal/external threats, business processes, and regulatory/statutory requirements

fact: CISO communicates information security risk posture to internal individuals, committees, and departments

reasoning: The paragraph describes the CISO's organizational responsibilities and scope of authority within Corebridge's cybersecurity structure, including coordination across corporate functions and business segments, which constitutes Management Role content. Specificity is Firm-Specific because the CISO role and its described coordination scope (across all business segments, addressing technology/threats/processes/regulatory requirements) distinguishes Corebridge's management structure from generic cybersecurity governance language.


fact: ISC includes CIO

fact: Combined 20 years of risk management experience

fact: Experience includes threat assessments, risk management, cybersecurity insurance, incident response, end user awareness, vulnerability management

reasoning: The paragraph describes management organization by naming specific leadership roles (CIO, Director of IT Security, Risk and Compliance) and their collective qualifications, which answers how management is organized to handle cybersecurity. The 'combined 20 years' claim is a hard number (not hedged), making this Level 4, and the Director title with security qualifier adds a firm-specific element.


reasoning: The paragraph primarily describes the company's risk assessment and management activities (assess, identify, and manage material risks; annual SOC1 report reviews) making RMP the best fit. The governance chain (ERM Committee to Audit Committee) is mentioned but as context for how the program operates, not as the primary focus. All content uses generic terms that appear in any company's cybersecurity disclosure—'Enterprise Risk Management Committee,' 'executives appointed by the Board,' 'annual reviews of third-party SOC1 reports'—none of which are firm-specific or externally verifiable. One could not identify Rayonier from this paragraph alone.


fact: security threat intelligence system

fact: internal vulnerability management tools

fact: patch management standard

fact: Security Operations Center

fact: real-time awareness, event correlation, and incident response capabilities

reasoning: The paragraph describes cybersecurity program tools and practices (threat intelligence system, vulnerability management, patch management, SOC) — clearly answering 'what does the program do?' → RMP. The specificity is Domain-Adapted because the paragraph uses security-specific terminology (threat intelligence system, Security Operations Center, event correlation, vulnerability management tools) that would not appear in a general ERM document, demonstrating cybersecurity domain expertise rather than generic risk management language.


fact: CISO meets at least quarterly with the Board of Directors

fact: CISO meets at least quarterly with EXCO

fact: CISO meets at least quarterly with the Senior Leadership Team (SLT)

fact: Tabletop exercises are performed at least annually with the Board, EXCO, and SLT

reasoning: The paragraph describes a governance chain (CISO → Board/EXCO/SLT) showing how cybersecurity oversight flows to the board level, with specific cadences (quarterly briefings, annual tabletop exercises) — this is Board Governance content. Specificity is Firm-Specific because the minimum meeting frequencies (at least quarterly, at least annually) with named governing bodies (Board, EXCO, SLT) are firm-distinguishing cadences rather than generic boilerplate.


reasoning: The paragraph describes the board-level oversight structure (Board delegating to Audit Committee, VP of IT reporting at least annually) and what those reports cover—standard governance language that appears across most public company cybersecurity disclosures. No firm-specific titles (e.g., named CISO, specific committee names beyond generic Audit Committee), no verifiable external claims, and no domain-expertise vocabulary beyond generic 'cyber risks and threats' language that any ERM professional could write. The specificity is Generic Boilerplate.


reasoning: The paragraph describes engaging third-party consultants for cybersecurity activities (audits, threat assessments, consultation), which constitutes Risk Management Process content per Rule 3: third parties hired to serve the company are components of the internal program. Specificity is Generic Boilerplate because all language passes the ERM test — 'audits,' 'threat assessments,' and 'consultation on security enhancements' are generic practices any enterprise risk manager could describe; no domain-specific security terminology (SIEM, EDR, pen testing), no firm-specific claims, and no verifiable facts are present.


reasoning: The paragraph focuses on a Vendor Management Program describing requirements imposed on vendors (due diligence, cybersecurity requirements, ongoing monitoring), making third-party risk the central topic. The language demonstrates cybersecurity domain expertise (risk-based due diligence tied to data/system access thresholds, ongoing monitoring cadence) that passes the ERM test, supporting Level 2 specificity. No firm-specific identifiers or externally verifiable facts are present.


fact: Chief Technology and Digital Officer leads cybersecurity efforts operationally

fact: Senior Vice President, Technology leads cybersecurity efforts operationally

fact: Chief Technology and Digital Officer has over 10 years of networking and information technology management or executive experience

fact: Senior Vice President, Technology has 25 years of networking and information technology management or executive experience

fact: Cybersecurity Committee includes representatives from accounting, finance, legal, internal audit, and information technology

fact: Cybersecurity Committee meets monthly

reasoning: The paragraph primarily answers 'How is management organized to handle cybersecurity?' describing named leadership roles with specific qualifications, committee composition by department, and reporting structure—making Management Role the dominant category. Specificity is Firm-Specific because it contains firm-distinguishing facts: two named VP-level officers with specific tenure (10+ and 25 years), Cybersecurity Committee with specific departmental membership (accounting, finance, legal, internal audit, IT), and a specific meeting cadence (monthly). These details would not appear in every public company's disclosure and help narrow down the specific organization.


fact: CISO (Chief Information Security Officer) provides periodic updates

fact: CIO provides periodic updates

fact: Security & Resiliency global practice leader provides updates

fact: Audit Committee conducts semi-annual reviews

reasoning: The paragraph describes board-level oversight structure (Board of Directors → Audit Committee → CISO/CIO/Senior Leaders), which is the core of Board Governance. The presence of named leadership roles (CISO, CIO, Security & Resiliency global practice leader) elevates this above generic governance language found in all public companies. While 'CISO' is itself a standard title, the specific combination of roles cited and the reference to a 'Security & Resiliency global practice leader' with a Kyndryl-specific practice area, along with the semi-annual cadence detail, creates a firm-specific governance picture. This passes the firm-specificity test: if you removed the company name, these role combinations and reporting relationships would narrow down which company wrote this.


fact: layered technical protective capabilities and detective surveillance controls

fact: phishing, social engineering and other cybersecurity training

fact: targeted training for specific roles based on responsibilities and risk level

fact: operational technology

fact: table top exercises involving senior leaders

reasoning: The paragraph describes the components and activities of the cybersecurity program (technical controls, third-party assessments, employee training, policies, incident response procedures), which directly answers 'What does the cybersecurity program do?' — fitting RMP. The specificity reaches Domain-Adapted because the language includes cybersecurity-specific terminology (layered protective capabilities, detective surveillance controls, phishing/social engineering training, operational technology) that would not be used by a generic ERM professional discussing non-cybersecurity risks.


fact: CTO (Chief Technology Officer) included in cybersecurity management team

reasoning: The paragraph describes management-level cybersecurity leadership (CTO, IT Manager) and their responsibilities for assessing risks and overseeing the cybersecurity program, which answers how management is organized to handle cybersecurity rather than what the program does or how the board oversees it. Specificity is Firm-Specific (Level 3) because the CTO reference is a VP-level role that distinguishes this company's cybersecurity leadership structure, while the remaining language is generic governance boilerplate.


fact: SVP of IT Security

fact: reports quarterly to the Audit Committee

reasoning: The paragraph primarily answers 'How does the board oversee cybersecurity?' by describing the Audit Committee's briefing cadence and reporting structure — classic Board Governance content. The specificity is driven by the SVP of IT Security (a named VP-level role) and the specific quarterly reporting cadence to the Audit Committee.


fact: vice president of information technology services

reasoning: The paragraph describes board-level oversight structure for cybersecurity, including audit committee oversight, senior leadership reporting to the board, and the board's role in risk oversight—clearly answering 'How does the board oversee cybersecurity?' The only firm-specific fact is the VP of Information Technology Services, a VP-level role with IT qualifier that distinguishes this company's leadership structure. No domain-specific cybersecurity terminology is present, and no externally verifiable claims are made.


reasoning: The paragraph's central question is about third-party incident notification protocols (how Deutsche Bank Group/DWS notifies the company when its data is at risk), making Third-Party Risk the primary category. No firm-specific facts qualify under the commonly-confused filter—named entities (Deutsche Bank Group, DWS) describe third parties, not the company's own cybersecurity organization, and the 'communication protocol' is generic language that doesn't pass as a named internal program. The paragraph describes a third-party notification framework but lacks any firm-specific facts about RREEF's own cybersecurity posture.


fact: Security Governance Committee (named committee)

fact: CISO role (Chief Information Security Officer)

fact: CISO has over 20 years of cybersecurity and technology management experience (specific lower-bound quantity)

reasoning: The paragraph describes the CISO's role and committee membership (Security Governance Committee) along with their qualifications — the CISO's experience level of over 20 years. This is Management Role: leadership roles, committee structure, and qualifications/credentials. The specificity reaches Level 4 because 'over 20 years' is a verifiable lower-bound quantity (specific number checkable against a resume or background check), and the named Security Governance Committee and CISO role add firm-specific context.


fact: September 2022 timing of Rockstar Games network intrusion

fact: Rockstar Games named as affected subsidiary

fact: Early development footage for next Grand Theft Auto was accessed

fact: 2K Games named as affected subsidiary

fact: Vendor platform credentials for 2K Games help desk support were compromised

fact: Malicious link sent to certain players via help desk system

fact: Affected users were notified

fact: Advanced persistent threats referenced as threat type

fact: Immaterial incremental one-time costs for consultants, experts, and data recovery

reasoning: The paragraph describes specific real-world cybersecurity incidents (September 2022 Rockstar Games intrusion with Grand Theft Auto footage theft, 2K Games vendor platform breach with malicious link to players), making it an Incident Disclosure. Specificity is Level 4 due to verifiable claims including specific dates (September 2022), named entities (Rockstar Games, 2K Games, Grand Theft Auto), named threat type (advanced persistent threats), and description of incident response actions that could be independently confirmed.


fact: Head of Global IT (specific role title)

fact: IT Security Team (named internal team)

fact: Head of Global IT previously managed network, infrastructure security, and cybersecurity team of a global consumer products company with heavy online presence and U.S. government sales

fact: IT Security Team members hold security certifications from CompTIA

fact: Over 20 years of combined infrastructure architecture experience on the IT Security Team

fact: PCI, SOC1, and SOC2 compliance expertise mentioned in team experience

reasoning: This paragraph is primarily about Management Role because it focuses on organizational structure (Head of Global IT and IT Security Team), leadership responsibilities, career qualifications of the Head of Global IT, and team composition including certifications and experience. The specificity reaches Level 4 because the Head of Global IT's career history (prior role at a specific type of company with specific characteristics), CompTIA certifications, and 'over 20 years of combined infrastructure architecture experience' are externally verifiable claims that anchor the paragraph well above generic boilerplate.


fact: Senior Director, Information Technology is the primary person responsible for assessing and managing cybersecurity risks

fact: Incident Response Team membership includes Senior Vice President, Finance and General Counsel

fact: Senior Director, Information Technology has over twenty years of experience in information technology, security and cybersecurity space

fact: Managed service provider and incident response provider support the Incident Response Team

reasoning: The paragraph primarily describes WHO is organized to handle cybersecurity (the Senior Director, IT role and the composition of the Incident Response Team including named titles), making it Management Role. The specificity reaches Level 4 due to the externally verifiable claim of 'over twenty years of experience' — a specific quantity with a lower bound that someone could verify against a resume — alongside firm-specific details about committee membership.


fact: Bimini (the external manager) is identified by name

fact: All of the Company's executive officers are executive officers, directors, and employees of Bimini

reasoning: The paragraph primarily answers 'How is management organized to handle cybersecurity?' by explaining the externally managed structure and reliance on Bimini's processes, with all executive officers being Bimini personnel. Specificity is Firm-Specific because Bimini is named as the external manager — a firm-identifying fact that distinguishes this company's management structure from others.


fact: CDIO chairs a security council (firm-specific: unique leadership title and named committee)

fact: Security council is cross-functional, including Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting, Risk and IT Infrastructure (firm-specific: composition details)

fact: April 2024 cyber-attack (verifiable: named event with specific date, publicly reported)

fact: Audit Committee was actively involved in review, disclosure and mitigation of April 2024 incident (verifiable: named committee, documented governance action)

reasoning: The paragraph primarily answers 'How is management organized to handle cybersecurity?' through its description of the CDIO-led security council structure, cross-functional membership, and escalation procedures — fitting Management Role. Specificity reaches Level 4 due to the named April 2024 cyber-attack as a verifiable external event, combined with Audit Committee involvement in that incident (specific date and documented governance action), both of which are independently confirmable through SEC filings and public reporting.


fact: Domain term: track and log security incidents

fact: Domain term: third-party risk assessments

fact: Domain term: information security policies, controls, and procedures

reasoning: The paragraph's primary purpose is describing board oversight structure (Board → Audit Committee delegation, reporting flows to full Board), making Board Governance the correct category. The use of domain-specific terms like 'track and log security incidents' and 'third-party risk assessments' demonstrates cybersecurity expertise beyond generic risk management language, supporting Level 2 specificity.


reasoning: The paragraph describes board-level oversight structure—Board delegation to Audit Committee, reporting lines, and briefing cadences—which is the core of Board Governance. For specificity: 'Board' and 'Audit Committee' are universal governance roles at every public company; 'Interim Chief Financial Officer' and 'Chief Legal Officer' are standard executive titles (not cybersecurity-specific roles like CISO); 'February 2024' is a reporting-anchored date, not a hard number tied to a verifiable cybersecurity claim. The paragraph contains no domain-specific cybersecurity terminology (no SIEM, SOC, EDR, vulnerability management, etc.), no named cybersecurity programs, no quantified claims, and no external verifiability—making it generic boilerplate.


fact: National Institute of Standards & Technology Cybersecurity Framework (NIST CSF)

fact: endpoint detection

fact: security incident response and event management and recovery

fact: privileged access management

reasoning: The paragraph primarily describes what the cybersecurity program does—its policies, architecture program, and layered security measures—rather than governance structure or management qualifications. While the CISO is mentioned, the grammatical focus is on programmatic activities (policies, endpoint detection, incident response, privileged access management), making this RMP. The specificity is Domain-Adapted because the paragraph uses specific cybersecurity terminology (endpoint detection, security incident response, privileged access management) and references NIST CSF—concepts a general ERM professional would not naturally use, demonstrating cybersecurity domain expertise beyond generic risk management language.


fact: One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023

reasoning: The paragraph primarily describes board oversight structure and information flow regarding cybersecurity (audit committee review, quarterly CISO updates, three-times-yearly board updates), which directly answers 'How does the board oversee cybersecurity?' — making this Board Governance. The specificity is elevated to Level 4 by the externally verifiable fact that a named board committee member holds the NACD CERT Certificate in Cybersecurity Oversight, earned in 2023 — a credential independently verifiable through NACD's certification registry.


fact: Vice President of Cybersecurity

reasoning: The paragraph describes board-level oversight structure including the Audit Committee's role in cybersecurity oversight, reporting cadences (quarterly, semi-annual, annual), and escalation processes — all core Board Governance content. The specificity is Firm-Specific because the 'Vice President of Cybersecurity' is a named senior leadership role whose portfolio is explicitly cybersecurity, distinguishing this company's governance structure. This VP-level title with a cybersecurity portfolio qualifies as firm-specific per the classification rules, elevating the paragraph beyond generic boilerplate governance language.


reasoning: The paragraph's central topic is vendor/third-party cybersecurity oversight through their TPRM program, describing due diligence, contractual reviews, and ongoing monitoring of third parties — this directly answers how third-party cyber risks are managed (Rule 3: vendor oversight as central topic → TP). The specificity is Level 1 because every specific claim is generic boilerplate that any company could say: 'cybersecurity due diligence,' 'review of contractual terms,' 'appropriate review,' and 'ongoing monitoring' are all standard risk management language that any ERM professional would use regardless of cybersecurity domain expertise. No domain-adapted terminology (e.g., SOC 2 attestations, encryption standards), no firm-specific identifiers (named committees, named roles), and no verifiable claims (certifications, named vendors, headcounts) are present.


fact: Senior Director and Head of Information Technology (role title)

fact: management committee on cybersecurity (named committee)

reasoning: The paragraph primarily answers 'How is management organized to handle cybersecurity?' by describing specific roles (Senior Director and Head of Information Technology), a named management-level committee, and the reporting relationship between them. While cybersecurity activities (prevention, detection, mitigation, remediation) are mentioned, the grammatical subjects are the roles and their oversight responsibilities rather than program activities—making this Management Role. Specificity is elevated to Level 3 by the firm-specific role title and named committee, both of which distinguish this company's governance structure.


reasoning: The paragraph describes the governance chain for cybersecurity incident oversight (Critical Threat Committee evaluating materiality, briefing the Board), which answers how the board oversees cybersecurity. No cybersecurity domain expertise is demonstrated—'evaluate materiality' and 'disclosure obligations' are generic governance terms any ERM professional would use—and no firm-specific or verifiable facts are present.


fact: Prudential's CISO, CIO and/or Operational Risk Management provide updates to the Board

fact: At least annually, the Board receives cybersecurity updates

fact: Updates address cybersecurity matters including risks facing the Company, the Manager and the Subadviser

reasoning: The paragraph describes the Board's oversight structure for cybersecurity, including the sources of information (Prudential's CISO, CIO, and Operational Risk Management) and the cadence of briefings. This is Board Governance. The paragraph contains firm-specific facts about the company's unique governance arrangement—specifically that Prudential's information security leadership (CISO, CIO, Operational Risk Management) serves as the primary briefing source for the board—which distinguishes this company's cybersecurity governance from others and maps to Level 3.


reasoning: The paragraph describes management-level governance committees (ERC led by CEO, ORC) and the CISO's reporting responsibilities — organizational structure rather than board-level oversight. This is MR: how management is organized to handle cybersecurity. The specificity is Level 1 because the paragraph uses only generic role titles (CEO, CISO), common committee structures (risk committee, operational risk committee), and standard cadences (periodically, at least annually) that appear across virtually all public companies without any firm-specific identifiers, domain expertise, or externally verifiable claims.


reasoning: The paragraph primarily describes the organizational structure for cybersecurity management—specifically the IT Security Director's reporting line, responsibilities, and team qualifications. These are standard MR elements. For specificity: there are no domain terms that pass the ERM test (generic phrases like 'cyber risk management program' and 'threat intelligence' are not cybersecurity-specific), no firm-specific facts (IT Security Director reporting to CIO is standard org structure; 'decades of experience' and 'various certifications' are soft/vague language), and no quantified-verifiable claims. The entire paragraph could appear in virtually any company's 10-K.


fact: endpoints

fact: triggers to isolate and mitigate suspicious cyber activity

fact: 24/7 monitoring

reasoning: The paragraph's primary purpose is describing the cybersecurity program's tools and third-party providers (monitoring, endpoint protection, backup, training) — what the program does rather than who manages it or how governance flows. The CFO reference is subordinate context about coordination, not the paragraph's focus. Specificity is Domain-Adapted because the language demonstrates cybersecurity domain expertise that a generic ERM professional would not use: 'endpoints,' 'triggers to isolate and mitigate,' and 'Return to Operations objectives of less than 24 hours' (RTO) are concepts specific to cybersecurity operations, not generic risk management vocabulary. The named vendors (Marco Technologies, Red Canary, High Point Networks) are external service providers, not firm-specific organizational facts under the classification rules.


fact: Two board committees (Audit Committee and Aerospace Safety Committee) share cybersecurity oversight duties

fact: CIO is titled 'Chief Information Officer and Senior Vice President, Information Technology & Data Analytics'

fact: Briefings to Audit Committee occur bimonthly

fact: One Audit Committee member has been designated with expertise in cyber risk management

fact: Aerospace Safety Committee receives briefings from Chief Engineer, Chief Aerospace Safety Officer, and Chief Product Security Engineer

fact: CIO provides annual briefings to the full Board

reasoning: The paragraph describes Boeing's board-level cybersecurity oversight structure, detailing how two board committees (Audit Committee and Aerospace Safety Committee) divide cybersecurity oversight responsibilities and how information flows to the full board—this is governance-chain content answering 'how does the board oversee cybersecurity.' The specificity is firm-specific because Boeing uniquely assigns cybersecurity oversight to both an Audit Committee AND an Aerospace Safety Committee (reflecting aerospace product safety concerns), includes a board-designated member with cybersecurity expertise, and specifies bimonthly briefing cadence and named senior roles (Chief Aerospace Safety Officer, Chief Product Security Engineer) that are distinctive to Boeing's structure.


fact: CIO also serves as Chief Information Technology Architect & CISO (dual-hatted role with specific combined title)

reasoning: The paragraph describes the Board's oversight structure—quarterly reports, annual briefings, escalation protocols, and reporting chains—making Board Governance the primary category. The specificity is elevated by the unique dual-hatted CIO/CISO/Chief Information Technology Architect role, which is a firm-specific organizational detail that would help distinguish this company. Generic elements (quarterly reports, written escalation protocols, board reporting) are standard across public companies and do not elevate specificity.


fact: InfoSec Director (role title with security qualifier, Director-level)

fact: eRISC committee (company-specific named committee)

reasoning: The paragraph describes the governance reporting chain for cybersecurity oversight (InfoSec Director → eRISC committee → Board), which is Board Governance per Rule 1. The named InfoSec Director role and the proprietary 'eRISC committee' identifier distinguish this company's oversight structure from generic boilerplate, elevating specificity to Firm-Specific (Level 3); the executive titles (CEO, CFO, CTO, GC) are generic and not firm-specific.


fact: Mr. Dennis has served as Director of Information Technology since June 2019

fact: Mr. Dennis has over 20 years of experience in the data management space

fact: Mr. Dennis is founder of a data privacy consulting company

fact: Daily, weekly, and monthly status reports provided to Dennis and his team

fact: Real-time dashboards monitor and assess company systems

fact: Dennis and team report cybersecurity risk information to the Audit Committee

reasoning: The paragraph primarily describes the organizational structure around cybersecurity leadership—the Director of IT's qualifications, his team's role, and the reporting chain to the Audit Committee—making this Management Role. The specificity reaches Level 4 due to the quantified fact of 'over 20 years of experience' (verifiable via resume) and the specific start date 'June 2019' (externally verifiable), along with named consulting company founder status.


fact: Chief Information Officer (CIO) leads the information technology team

fact: Cybersecurity governance committee comprised of Chief Financial Officer (CFO), Chief Legal Officer (CLO), CIO, Head of Internal Audit, and senior IT team members

fact: Cybersecurity governance committee develops and maintains cybersecurity policies and standards

fact: Cybersecurity governance committee monitors ongoing compliance and program updates

fact: Cybersecurity governance committee ensures information security is aligned with business objectives

reasoning: The paragraph primarily describes management-level organizational structure for cybersecurity: the CIO-led IT team and the Cybersecurity Governance Committee with named executive roles (CFO, CLO, CIO, Head of Internal Audit) and their specific responsibilities. This is Management Role (MR) rather than Board Governance because the focus is on management's committee structure and composition rather than the Board's oversight activities. Specificity is Firm-Specific (Level 3) based on named executive roles (CFO, CLO, CIO, Head of Internal Audit) and the specifically named Cybersecurity Governance Committee, which distinguish this company's structure from generic organizational descriptions.


fact: Chief Information Security Officer (CISO) — VP-level title with security qualifier

fact: CISO tenure since 2015

fact: Domain expertise in: application security, intrusion detection, penetration testing, complex threat modeling, unconventional cyber-attack vectors

fact: RCOC (firm-specific named committee)

reasoning: Paragraph describes the CISO's role, tenure, domain experience, team structure, and reporting activity — all organizational questions about management. Contains firm-specific facts: named CISO role, tenure since 2015, and RCOC committee. Domain terminology (intrusion detection, threat modeling) elevates from pure governance language to Level 2+, but the named executive role anchors specificity at Level 3.


fact: cybersecurity threat landscape (domain term)

reasoning: This paragraph describes board-level cybersecurity oversight: the RCSC committee holds cybersecurity discussions throughout the year, and the CISO provides quarterly updates to the board. This is governance structure, making Board Governance the primary category. Specificity is Domain-Adapted (Level 2) because the paragraph uses cybersecurity domain terminology ('cybersecurity threat landscape') that demonstrates expertise beyond generic ERM language, while the governance mechanics (quarterly reporting, oversight structure) are standard board practices applicable to any risk domain.


fact: Cybersecurity and Technology Subcommittee (named committee with cybersecurity qualifier)

fact: CISO (firm-specific cybersecurity leadership role at VP-equivalent)

fact: quarterly reports on cybersecurity

fact: annual joint meeting of Risk Management Committee and Audit Committee

fact: annual executive-level crisis exercise with cybersecurity component

reasoning: This paragraph answers 'How does the board oversee cybersecurity?' by describing the committee structure, reporting cadence, and oversight mechanisms — clearly Board Governance. Specificity is Firm-Specific (Level 3) primarily due to the named Cybersecurity and Technology Subcommittee (a committee that specifically includes 'Cybersecurity' in its title, distinguishing it from generic board committees) and the reference to the CISO role, along with verifiable facts about reporting cadences and the annual crisis exercise. While the Risk Management Committee and Audit Committee are generic governance bodies, the cybersecurity-specific subcommittee and CISO elevate this beyond generic boilerplate.