fact: Change Healthcare is a subsidiary of UnitedHealth Group (named entities)

fact: February 21, 2024 notification date (specific date tied to real event)

reasoning: The paragraph describes an actual cybersecurity incident (the Change Healthcare breach) with timeline, response actions, and forensic findings, making Incident Disclosure the primary category. The February 21, 2024 date and the named entities (Change Healthcare, UnitedHealth Group) are externally verifiable facts that anchor the specificity at Level 4.


content_category: Incident Disclosure

fact: Received written notice during 2023 about customer data potentially included in MOVEit Transfer incident

fact: Incident involved Progress Software Corporation's MOVEit Transfer platform

fact: Third-party prominent financial institution vendor utilized MOVEit Transfer

fact: Personal information of online and mobile banking customers may have been copied

fact: Vendor implemented recommended patches from Progress Software Corporation

fact: Bank notified potentially affected customers

fact: Cyber insurance is expected to cover many of the costs

fact: MOVEit Transfer incident is the only cybersecurity incident that materially affected the Corporation during 2023

category_confidence: high

specificity_confidence: high

reasoning: This paragraph describes an actual cybersecurity incident (MOVEit Transfer) including the nature of the breach, scope (affected customers using online/mobile banking), remediation (patches implemented, customers notified), and impact (operations unaffected, cyber insurance covering costs). Category is ID per Rule 4 — the narrative frame is what happened, not business/financial assessment. Specificity is Level 4 because it contains verifiable factual claims: named third parties (Progress Software Corporation, MOVEit Transfer), a specific product name, a specific incident year (2023), documented remediation actions, and a quantified business metric (cyber insurance covering costs). One verifiable claim anywhere in the paragraph sets the floor.

provider: minimax

stage: benchmark


content_category: None/Other

reasoning: This paragraph is a general executive biography for Travis Smith's operational/manufacturing role (Additives & Functional Products, Manufacturing, WWE&C, and HSE). While HSE (Health, Safety and Environment) is mentioned, there is no cybersecurity content whatsoever—no mention of information security, cybersecurity oversight, IT security roles, or any cybersecurity-related responsibilities. This is a standard career progression bio for a business executive, not a cybersecurity disclosure. The specificity is Generic Boilerplate as no cybersecurity facts, domain terms, or verifiable claims are present.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for cybersecurity risk information; it answers no substantive question about cybersecurity governance, management, processes, or outcomes. It contains no facts whatsoever—only a pointer to another section.


content_category: Risk Management Process

category_confidence: medium

reasoning: The paragraph describes general cybersecurity risk management efforts (maintaining network security, implementing policies and procedures, carrying insurance), making RMP the best fit. However, all content consists of generic boilerplate language with no specific practices, tools, frameworks, certifications, or verifiable claims. The threat types listed (ransomware, phishing, etc.) are general cybersecurity topic mentions, not domain expertise. The negative assertion about no material incidents and references to insurance are not externally verifiable facts. No specific facts were identified that would elevate specificity above Level 1.


content_category: Management Role

fact: CIO title (peer to CSO, reports to CFO)

fact: CIO appointed March 2022

fact: nearly 20 years of experience in managing IT functions

reasoning: The paragraph primarily describes a management role (CIO) — its organizational position, responsibilities, and the incumbent's qualifications — fitting the Management Role category. It contains multiple verifiable facts: a named role title, a specific appointment date (March 2022), and a specific experience duration ('nearly 20 years'), all of which are externally confirmable claims about named individuals, triggering Level 4 specificity.


fact: May 14, 2019 — specific date AMCA notified LabCorp of the security incident

reasoning: This paragraph describes a specific cybersecurity incident (the AMCA Incident) with concrete timing (May 14, 2019), the affected entity (Retrieval-Masters Credit Bureau/American Medical Collections Agency), and mentions ongoing litigation and regulatory inquiries — all hallmarks of an Incident Disclosure. The specific date of notification (May 14, 2019) is a hard, externally verifiable fact that anchors this at Level 4.


content_category: Board Governance

reasoning: This paragraph describes the board oversight structure (Board annual review, Audit Committee quarterly updates) and management's responsibility chain, making 'Board Governance' the primary content. For specificity, the paragraph contains only generic governance language: 'CIO' and 'security management team' are standard titles that exist at every company, 'Board of Directors' and 'Audit Committee' are generic board-level roles found at all public companies, and cadences of 'annual' and 'quarterly' are generic without specific dates or numbers. No domain-specific security terminology, firm-specific leadership titles (no CISO or named VP+ security role), or externally verifiable claims are present.


reasoning: The paragraph describes Board and Audit Committee oversight structure for cybersecurity, including what the Audit Committee reviews (at least annually) and the reporting line from the Chief Innovation Officer — all governance-chain content. For specificity, while cybersecurity domain terms appear ('information technology security processes', 'internal controls regarding information technology security'), these phrases would read naturally in any enterprise risk management discussion about IT oversight, failing the ERM test. 'At least annually' is a minimum cadence, not a verifiable number. No firm-specific identifiers, named non-generic committees, specific team compositions, or externally verifiable claims are present. The content reflects standard board governance language applied to cybersecurity, not specialized cybersecurity expertise.


fact: August 2023 - specific timeframe of an actual cybersecurity incident affecting information systems

reasoning: The paragraph primarily describes an actual incident (August 2023), its nature (affected information systems), and its operational impact (temporary disruptions), which fits the Incident Disclosure category. The August 2023 date is a specific, externally verifiable fact about when a real cybersecurity event occurred, elevating specificity to Level 4 despite the paragraph also containing non-verifiable negative assertions about impact.


fact: crisis simulation exercises

fact: shipboard and shoreside employees

specificity_confidence: medium

reasoning: The paragraph describes what the cybersecurity program does—maintains an incident response plan, conducts crisis simulation exercises, and trains an incident response team—which is RMP. The specificity is Domain-Adapted because the paragraph uses cybersecurity-specific terminology ('crisis simulation exercises,' 'incident response team,' 'external cybersecurity experts') that a non-security ERM professional would not naturally use, distinguishing it from generic risk language that could apply to any operational domain.


reasoning: This paragraph is primarily a risk disclosure with a cross-reference to Item 1A Risk Factors. The substantive content ('develop and maintain systems and operate programs that seek to mitigate the impact of cybersecurity incidents') is generic boilerplate that fails the ERM test — any non-security ERM professional could write this language. No domain-specific practices, firm-specific organizational details, or externally verifiable claims are present. The specificity is Generic Boilerplate as there are zero specific facts; the paragraph contains only generic assertions about having cybersecurity measures and a cross-reference to another section.


fact: CISO manages Farmer Mac's cybersecurity program

fact: CISO has more than 20 years of experience in cybersecurity and information technology

fact: CISO holds a Master's degree in Business Administration with a focus on Information Technology

fact: CISO holds Certified Information Security Manager (CISM) certification

fact: CISO reports to Farmer Mac's Senior Vice President – Enterprise Risk Officer

fact: SVP – Enterprise Risk Officer reports to Chief Executive Officer

reasoning: The paragraph's primary focus is the CISO's role, qualifications (CISM certification, MBA in IT, 20+ years experience), and reporting structure within the organization, making it a Management Role disclosure. The specificity reaches Level 4 because the paragraph contains multiple externally verifiable facts: the CISO's specific credential (CISM certification, verifiable through ISACA's registry), the specific degree (MBA with IT focus), and the specific experience threshold ('more than 20 years' — a verifiable lower bound).


fact: October 11, 2023: specific date of cybersecurity incident announcement

fact: approximately three days: specific duration of operational disruption

fact: within one week: specific timeframe for fulfilling backlog of orders

reasoning: This paragraph describes a real cybersecurity incident (October 11, 2023 disruption), including the nature of the breach, timeline, scope of operational impact (three-day disruption), and remediation steps (restoration of operations, law enforcement notification). The specific date and timeframes constitute externally verifiable facts that anchor this as Incident Disclosure. The claim of 'no material financial impact' is a self-assessment not independently verifiable, but the paragraph's value for specificity comes from the hard dates and durations.


reasoning: The paragraph primarily describes what the cybersecurity program does—integrating cybersecurity risk assessment into the ERM process, conducting annual reviews of security domains (incident response, business continuity, privacy)—making it most directly about risk management processes. The specificity is Generic Boilerplate because every sentence uses generic ERM and cybersecurity vocabulary that any company could write; no specific tools, named programs, firm-specific organizational details, or verifiable claims are present, and the ERM test confirms a non-security professional would naturally use this exact language about non-cyber risks.


fact: CSO reports to CFO (reporting line)

fact: CSO has served at Zebra since 2018 (tenure start)

fact: CSO has over 14 years of global executive cybersecurity experience (specific experience quantity)

reasoning: The paragraph centers on the CSO role, its responsibilities, reporting structure, and the current holder's qualifications—making Management Role the primary category. The specific tenure since 2018 and quantified 'over 14 years' experience are externally verifiable facts anchoring this at Level 4.


content_category: Third-Party Risk

fact: penetration testing

fact: information security risk assessments

fact: security posture

reasoning: The paragraph is centrally focused on third-party vendor cybersecurity oversight—vendor assessments, re-assessments, monitoring programs, and contractual protections. Specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain knowledge: penetration testing is a specific security practice (not a general business function), and 'security posture' is security-specific terminology an ERM professional wouldn't naturally use. No firm-specific identifiers or verifiable claims are present—the vendor management group is a generic functional reference, not a named committee with a distinguishing identifier.


content_category: Strategy Integration

reasoning: This paragraph directly answers 'How does cybersecurity affect the business or finances?' through explicit statements about financial condition impact ('have not been materially affected') and business strategy integration ('have materially affected our business strategy and processes'). The specificity is Level 1 because the paragraph contains only generic cybersecurity language ('robust program of information security and controls,' 'detect security incidents and protect sensitive data') that any non-security ERM professional could write — it fails the ERM test for domain expertise and contains no firm-specific roles, quantifiable claims, or externally verifiable facts.


reasoning: This paragraph is a values statement about data protection rather than a substantive disclosure answering any of the six core questions. The mention of 'Board of Directors' is rhetorical (describing a chain of responsibility for data handling) rather than a description of governance structure or oversight practices. No domain-specific cybersecurity terminology, firm-specific organizational facts, or verifiable claims are present.


reasoning: This paragraph makes a negative assertion about the absence of material cybersecurity incident impacts on business outcomes, which maps to Strategy Integration per Rule 5's backward-looking assessment category. The paragraph contains no specific facts, measures, or verifiable claims—it is a standard boilerplate negative assertion that appears identically in thousands of public company filings, warranting Generic Boilerplate specificity.


fact: two years of identity protection services offered

fact: identity protection services include credit monitoring

fact: offered to all current and former customers

reasoning: The paragraph describes response activities to an actual cybersecurity incident (ongoing engagement with law enforcement and regulators, defense of litigation, remediation via credit monitoring). The specific duration of two years for identity protection services is a hard number that could be independently verified, elevating specificity to Level 4.


fact: External risk management software program for third-party risk identification and monitoring

fact: Vendor security assessment process evaluating controls for IT security, privacy, business continuity

fact: Risk prioritization based on potential impact to determine due diligence and compliance monitoring levels

fact: Cross-functional team: end-user, Legal, Privacy, and Information Security teams

reasoning: The paragraph's central topic is third-party cybersecurity risk oversight—specifically how Gilead manages vendor security risks through assessment processes and monitoring—which maps to Third-Party Risk. The cross-functional team composition (end-user, Legal, Privacy, and Information Security) constitutes a firm-specific fact distinguishing this company's third-party risk program from generic boilerplate.


fact: On February 16, 2022, we became aware of a cybersecurity intrusion

reasoning: This paragraph describes a real cybersecurity incident on February 16, 2022, including timing, nature (network disruption, impacted systems), and response (engaged third-party experts). The specific date tied to an actual breach event is independently verifiable, making this Incident Disclosure. The paragraph also covers business impact language but the incident description is the primary content.


reasoning: The paragraph describes cybersecurity program activities (monitoring information systems, deploying security measures, conducting system audits, maintaining an incident response plan) — all of which answer 'what does the cybersecurity program do?' → RMP. It does not demonstrate cybersecurity domain expertise (no specific tools, frameworks, or security architecture concepts), contains no verifiable facts (the incident response plan is described but not named or quantified), and the SVP IT reference is a generic role title without firm-specific distinguishing details. All content describes standard practices any enterprise could claim, resulting in Generic Boilerplate.


reasoning: Paragraph primarily describes third-party cybersecurity risks (card processors, service providers) and briefly mentions conducting security assessments on higher-risk third parties as the oversight mechanism — making TP the central topic. Specificity is Generic Boilerplate as all content uses generic cybersecurity language and business process descriptions that any financial institution could use, with no firm-specific identifiers, named roles, or domain-expert terminology.


reasoning: The paragraph focuses entirely on how Darden manages third-party service provider cybersecurity risk—conducting due diligence, imposing contractual security requirements, and requiring incident notification—which directly answers 'How are third-party cyber risks managed?' (TP). The paragraph contains no specific facts, named vendors, named standards, security tools, numbers, or firm-specific details; all language is generic boilerplate about standard vendor oversight practices that any company could use, failing both the firm-specific test and the domain expertise ERM test.


fact: Cyber ERM (Enterprise Risk Management) Committee

reasoning: The paragraph describes a management-level committee (Cyber ERM Committee) with cross-functional membership and its role in the cybersecurity governance chain. This is MR because the primary focus is on management's organizational structure for handling cybersecurity, specifically a named committee's composition and responsibilities. The specificity is Domain-Adapted because while the committee name has some distinguishing quality, the composition description ('cross-functional representation') is generic boilerplate, and the activities described (rapid response program, reporting to Audit Committee) are standard governance language any company could use without demonstrating cybersecurity domain expertise.


fact: managed services agreement with an external party for incident response

fact: comprehensive cybersecurity assessment, opportunity prioritization, initiative road mapping and cyber project delivery

fact: firewall maintenance and upgrade initiatives

fact: assess all third-party service providers for their qualifications before engaging them

fact: monitor such providers throughout the term of the engagement

reasoning: The paragraph primarily describes cybersecurity program activities—what external parties are engaged and what services they provide—which maps to RMP. The external parties are hired to serve the company (assessors, incident response providers, infrastructure support), fitting Rule 3's RMP classification. The specificity is Domain-Adapted because the paragraph contains specific cybersecurity domain terminology ('comprehensive cybersecurity assessment', 'opportunity prioritization', 'initiative road mapping', 'cyber project delivery', 'firewall maintenance') that passes the ERM test—these are not terms a generic ERM professional would use about non-cyber risks. No firm-specific organizational facts (no named roles, specific team size, or identifiable committee names) and no verifiable claims (no named assessors, specific dollar amounts, or specific dates).


reasoning: This paragraph describes the board's cybersecurity oversight structure, including which committee has oversight (Audit Committee), the reporting cadence (quarterly updates), and the incident notification chain (Cybersecurity Sub-Committee). It answers the BG question of how the board oversees cybersecurity. The specificity is Firm-Specific because the "Cybersecurity Sub-Committee of the Board of Directors" is a named committee structure unique to this company's governance arrangement, distinguishing it from the standard Audit Committee oversight found at all public companies. The quarterly cadence and generic oversight language are not differentiating.


reasoning: The paragraph describes contractual cybersecurity requirements imposed on a third party (the Custodian) and its critical vendors — clearly a Third-Party Risk topic per Rule 3. The content uses entirely generic language ('reasonable and appropriate measures,' 'processes to assess, identify and manage risks') that any company could use. While 'MetLife, Inc.' is named, it appears only as the notification recipient, not as a fact distinguishing this company's cybersecurity posture. No domain expertise, firm-specific practices, or verifiable claims are present.


reasoning: The paragraph describes the Audit Committee's oversight role for cybersecurity risks, clearly establishing board-level governance responsibility (BG). However, it contains no firm-specific facts, no named individuals, no specific cybersecurity domain terminology, and no verifiable claims—the language 'policies, strategies, and initiatives for mitigating risks' is generic enough that any public company's ERM professional could write it, failing the domain expertise test.


fact: incident response

fact: access control

fact: disaster recovery

fact: testing

fact: information sharing

fact: data handling

fact: data management

reasoning: The paragraph primarily describes what the cybersecurity program does—implementing processes to assess and manage risks, along with the scope of policies covering incident response, access control, disaster recovery, and testing. This answers the RMP question about program activities. The specificity is Domain-Adapted because the paragraph employs cybersecurity-specific terminology (incident response, access control, disaster recovery, testing) that passes the ERM test—these are technical security practices distinct from generic enterprise risk management language, though no firm-specific or independently verifiable claims are present.


reasoning: The paragraph describes a three-lines-of-defense cybersecurity governance model mapping to board committees (Risk Committee, Audit Committee), executive officers (CTO, CRO), and internal functions (Controlling Department). The primary question answered is 'how does the board oversee cybersecurity?' — fitting Board Governance. However, the specificity is Generic Boilerplate: the three-lines-of-defense model is a universally used ERM framework, the titles (CTO, CRO, Risk Committee, Audit Committee) are standard governance roles found at all public companies, and no cybersecurity domain terminology or firm-specific distinguishing facts are present. The language would be identical in any company's 10-K cybersecurity governance disclosure.


fact: In July 2018 (specific date of ransomware incident)

reasoning: Paragraph describes a specific historical cybersecurity incident (July 2018 ransomware) with details about nature, scope, and impact findings, clearly fitting Incident Disclosure. The specific date 'July 2018' is a hard, externally verifiable fact, making this Level 4 regardless of the negative assertion about material effect.


reasoning: The paragraph is primarily boilerplate and a cross-reference to Item 1A Risk Factors. While it names FFIEC and NIST frameworks, these are standard industry references that do not demonstrate cybersecurity domain expertise beyond what any 10-K filer would state. The paragraph describes the frameworks at a high, generic level ('guidelines to help financial institutions manage cybersecurity risks') and concludes with forward-looking disclaimers rather than describing any actual firm-specific cybersecurity measures, practices, or organizational structure.


fact: ransomware and denial-of-service — domain-specific threat types (not generic "attacks")

fact: nation state actors — domain-specific threat actor category

fact: defense industrial base — sector-specific terminology

reasoning: This paragraph primarily addresses why cybersecurity matters to the company's business strategy ('critical to advancing our 21st Century Security vision') and acknowledges potential material impact from incidents — establishing cybersecurity as a business imperative rather than describing governance, management structure, or specific program activities. The specificity is Domain-Adapted because the threat actor taxonomy (ransomware, denial-of-service, nation state actors, defense industrial base) demonstrates cybersecurity domain expertise beyond generic ERM language; an enterprise risk management professional would not naturally use this specific threat categorization.


fact: CIO has more than 30 years of experience

fact: CIO's prior roles at Aegon N.V., Citigroup, Inc. and JP Morgan Chase & Company

fact: CISO has more than 20 years of cybersecurity experience

fact: CISO was Senior Vice President, Chief Information Security Officer at Brighthouse Financial

fact: CISO was Technology Vice President & Chief Information Security Officer for GE Healthcare

fact: CISO started career at Allstate Insurance Company

fact: CISO holds Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP) certifications

reasoning: This paragraph is about Management Role because it focuses on the CIO and CISO's qualifications, credentials, and career history — describing who is responsible for cybersecurity and what qualifies them. The specificity level is Quantified-Verifiable because it contains multiple externally verifiable claims: specific years of experience (30+, 20+), named prior employers for both executives, specific job titles at those employers, and named professional certifications (CISA, CISM, CISSP) that could be independently verified through certification registries.


reasoning: This paragraph makes a backward-looking negative assertion ('we are not aware of any cybersecurity incidents that have materially affected the Company') and a forward-looking materiality assessment ('we do not believe it to be reasonably likely in the near term that a cybersecurity threat will materially impact our business strategy, results of operations or financial condition'), both of which map to Strategy Integration under Rule 5. The paragraph contains no domain-specific security terminology, firm-specific organizational facts, or externally verifiable claims — it is purely a management assertion about the lack of material impact.


fact: have not experienced any material adverse events related to a security breach or cyber-attack

reasoning: The paragraph primarily answers 'How does cybersecurity affect the business?' — it explicitly states they have not experienced material cybersecurity incidents and describes potential business impacts (delays, reduced efficiency, reporting interruptions). Per Rule 5, a backward-looking negative assertion about incidents qualifies as Strategy Integration. However, the specificity remains Level 1 (Generic Boilerplate) because the negative assertion ('have not experienced any material adverse events') is a self-reported claim about absence that cannot be independently verified by an external party — there is no external registry, audit finding, or third-party confirmation supporting this claim.


reasoning: The paragraph describes the reporting relationship between the CSO, CIO, and senior management regarding cybersecurity information flow—a management reporting line rather than board-level oversight (no mention of the board or board committee), making Management Role the appropriate category. The paragraph contains only generic role titles (CSO, CIO, senior management team) and generic process language ('continually informed,' 'regularly informs') that provide no verifiable facts, distinguishing details, or domain-specific terminology; all language would be interchangeable across any public company's disclosure.


reasoning: The paragraph describes the board's oversight structure—specifically how the Audit and Risk Committee and Board receive cybersecurity briefings, the cadence of those briefings, and what topics they cover. This directly answers how the board oversees cybersecurity, making it Board Governance. For specificity, the cadences ('quarterly,' 'semi-annual,' 'annual') are generic governance frequencies, and 'external assessments' and 'cybersecurity training programs' are standard practices any ERM professional would describe without cybersecurity domain expertise. The paragraph lacks firm-specific organizational details, named security tools/frameworks, or quantifiable claims.


reasoning: This paragraph is dominated by forward-looking disclaimers ('no guarantee', 'can provide no assurance') and general risk warnings that do not substantively answer any of the six questions. The negative assertion about no recent material incidents is embedded within disclaimer framing rather than functioning as a standalone business impact assessment, making this primarily boilerplate risk language rather than Strategy Integration. No verifiable, firm-specific, or domain-expertise facts are present.


reasoning: This paragraph is purely a cross-reference directing readers to Item 1A Risk Factors for cybersecurity threat disclosures. It does not substantively answer any of the six cybersecurity disclosure questions — it contains no governance structure, management roles, program activities, third-party oversight, incident details, or strategy integration. Per Rule 6, cross-references with no substantive content classify as None/Other, and such paragraphs always receive Generic Boilerplate specificity.


reasoning: This paragraph contains no substantive cybersecurity program description — it states a negative assertion (no material incidents) combined with generic language about using third parties for risk identification/assessment, which any ERM professional could write without cybersecurity domain expertise. The specificity is Level 1 because all terminology ('identifying, assessing, and managing cybersecurity risks') is generic ERM language that fails the domain-expertise test.


fact: System Organization and Control Reports (SOC Reports) for key third-party financial systems

reasoning: The paragraph directly addresses how third-party cyber risks are managed through pre-acquisition diligence, contractual obligations, and performance monitoring—clearly centering on TP oversight. The mention of SOC Reports (a specific audit framework for examining third-party controls) demonstrates cybersecurity domain expertise beyond generic vendor management language, qualifying as Level 2 Domain-Adapted. No firm-specific identifiers (named vendors, named programs, or named individuals) are present to elevate to Level 3.


fact: February 13, 2023 (specific date of security breach)

fact: Third-party vendor providing secure file transfer software platform

fact: Personal information of certain patients of healthcare facilities exposed to attacker

reasoning: This paragraph primarily describes an actual cybersecurity incident—what happened (third-party vendor breach), when it occurred (February 13, 2023), and what was affected (patient personal information)—making it Incident Disclosure. The specificity reaches Level 4 due to the specific date of the breach (February 13, 2023), which is externally verifiable through public records and matches other SEC filings.


reasoning: The paragraph describes a generic vendor management process with standard risk management terms (risk assessments, security questionnaires, review of security programs) that could appear in any company's disclosure. Per the ERM test, these terms are used by general ERM professionals and do not demonstrate cybersecurity domain expertise. There are no firm-specific facts (no named committees, specific headcounts, named individuals, or quantified claims), no externally verifiable claims, and no specific cybersecurity terminology that would differentiate this from boilerplate language.


fact: Chief Information Security Officer (CISO) oversees the Trust, Security and Reliability department

fact: Trust, Security and Reliability department (named internal department)

fact: Cybersecurity Risk Management Team (named internal team)

reasoning: The paragraph primarily describes WHO manages and oversees cybersecurity processes (CISO, Cybersecurity Risk Management Team) and their qualifications — making it Management Role rather than Risk Management Process (which would focus on what the program does). The named internal department 'Trust, Security and Reliability' and 'Cybersecurity Risk Management Team' are firm-specific identifiers that distinguish this company's organizational structure from generic cybersecurity governance language.


reasoning: This paragraph is primarily a forward-looking materiality assessment (SI) combined with a generic risk disclaimer and cross-reference, but it contains no substantive disclosure about the company's actual cybersecurity program, governance, or processes. The negative assertion about not having experienced material incidents and the forward-looking belief statement are self-reported assessments without specific facts. No domain-specific practices, firm-specific roles, or verifiable claims are present — only boilerplate language about threat evolution and a reference to Risk Factors.


reasoning: The paragraph describes Gentherm's vendor management process for managing third-party cybersecurity risks—reviewing provider practices, contractual obligations, security assessments, and periodic reassessments—which directly answers how third-party cyber risks are managed. However, all language is generic boilerplate: 'may include,' 'depending on the nature,' and 'seek to engage' are non-committal qualifiers with no specific vendors named, no specific assessment methodologies described, no named standards referenced, and no firm-specific details that would distinguish this company from any other public filer.


fact: aligned with National Institute on Standards and Technology Cybersecurity Framework (NIST CSF) — named standard reference

fact: third party security operation center provides alerts — domain-specific infrastructure term

fact: multi-factor authentication — domain-specific control

fact: intrusion prevention and detection systems — domain-specific control

fact: partitioning and encryption of information — domain-specific architectural practice

fact: backup and data recovery procedures — domain-specific process

fact: malware defenses — domain-specific threat mitigation

fact: incident plan responses — domain-specific response process

fact: hardware and software updates and patching — domain-specific vulnerability management practice

reasoning: The paragraph describes the cybersecurity program's controls, tools, and practices (what the program does), which maps directly to Risk Management Process. The specificity is Domain-Adapted because the writer demonstrates cybersecurity expertise through specific domain terminology (NIST CSF, SOC, intrusion detection/prevention systems, partitioning, patching, malware defenses) that a generic ERM professional would not naturally use when discussing non-cyber risks — this goes beyond generic 'processes to identify and manage risks' language.


reasoning: The paragraph is centrally about managing cybersecurity risks in vendor relationships, describing vendor risk assessments, contractual cybersecurity obligations, and tiered due diligence processes. However, all described practices use generic vocabulary ('risk assessments,' 'vendor due diligence,' 'cybersecurity obligations') that any business professional could apply to non-cyber vendor risks — the language does not demonstrate cybersecurity domain expertise (ERM test: no). No domain-specific terminology, named tools, quantified claims, or firm-specific identifiers are present.


reasoning: This paragraph describes the Board's oversight structure for cybersecurity — specifically, how the Audit Committee reports to the full Board and how the Board receives briefings from management. This directly answers 'How does the board oversee cybersecurity?' placing it in Board Governance. However, it contains no firm-specific roles beyond the generic 'Audit Committee' (which exists at every public company), no named officers, no specific practices, and no verifiable facts. All content is standard governance language any public company could use, warranting Generic Boilerplate.


reasoning: This paragraph answers 'How does cybersecurity affect the business or finances?' by making a backward-looking negative assertion about incident impact, noting insurance coverage, and speculating about potential costs—each a Strategy Integration question. The paragraph contains no specific facts: 'cyber risk insurance' is mentioned without any quantity, premium amount, or named insurer; all descriptive language ('extensive approach,' 'certain kinds,' 'substantial') consists of vague qualifiers and speculation rather than verifiable claims; and the negative assertion about past incidents is not independently confirmable.


fact: firewalls

fact: intrusion prevention

fact: endpoint detection and response systems

fact: access controls

fact: vulnerability assessments

fact: cybersecurity threat intelligence

reasoning: The paragraph describes what the cybersecurity program does (deploys specific technical safeguards) and how it's evaluated (vulnerability assessments, threat intelligence), which is the core question of Risk Management Process. The specificity level is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise through technical terminology (firewalls, intrusion prevention, EDR, vulnerability assessments, threat intelligence) that a generic ERM professional would not naturally use — these are cybersecurity-specific tools and practices, not generic risk management language that could apply to any risk domain.


reasoning: The paragraph directly addresses third-party cybersecurity risk management, describing a 'risk-based approach' to overseeing vendors and service providers — this is the central topic of Third-Party Risk. However, the specificity is Level 1 because the paragraph contains only generic language ('risk-based approach,' 'identifying and overseeing') that any company's ERM program could use. The ERM test confirms this: a non-security professional would naturally use this exact phrasing for non-cyber third-party risks too. No domain-specific security terminology, firm-specific identifiers, or verifiable claims are present.


reasoning: The paragraph's central topic is third-party risk management — it describes a TPRM program integrated into procurement, cybersecurity due diligence reviews based on vendor risk profiles, and ongoing monitoring through periodic reviews. Per Rule 3, this is TP because vendor oversight is the central topic. The specificity is Generic Boilerplate because the paragraph describes the existence of a TPRM process using language any ERM professional could write about any risk category (due diligence, risk profile, periodic reviews) without any cybersecurity domain-specific terminology that would pass the ERM test, and no firm-specific or verifiable facts are present.


reasoning: This paragraph is primarily a forward-looking risk disclaimer with a cross-reference to Item 1A Risk Factors. While it mentions 'regular testing of our cybersecurity incident response plan,' this is framed as a limitation ('may be insufficient') rather than a program description. The language about AI threats and potential exposures is speculative rather than describing actual incidents or concrete measures. Cross-references pointing to other sections do not constitute substantive cybersecurity disclosure.


reasoning: This paragraph is pure forward-looking disclaimer language and a negative assertion about past incidents, containing no substantive disclosure about board oversight, management organization, cybersecurity program activities, third-party risk management, or actual incident details. Per Rule 5, speculative language ('could adversely affect', 'could subject us to risk') does not constitute a Strategy Integration assessment, and per Rule 6, no actual cybersecurity measures or assessments are described. The paragraph contains zero domain-specific terminology, firm-specific facts, or externally verifiable claims — the negative assertion 'we have not experienced a material incident' is a self-reported claim about absence, not independently verifiable.


fact: IS Steering Committee

fact: chaired by the Chief Information Officer

reasoning: The paragraph's central topic is vendor/third-party risk management — it describes the existence and function of a formal vendor management program that identifies, measures, monitors, and controls outsourcing risks, with oversight by the IS Steering Committee. Per Rule 3, vendor oversight as the central topic → Third-Party Risk. The specificity is firm-specific because the paragraph names the 'IS Steering Committee,' a non-generic internal committee with a specific chair (the CIO), which would help identify this specific company.


fact: CEO oversees incident response procedures

fact: CFO oversees incident response procedures

fact: CEO and CFO receive notification from third-party service providers

fact: CEO and CFO determine need for additional internal/external resources

fact: Board of Managers notified of material cybersecurity incidents prior to public announcement

fact: Board of Managers receives updates on material developments and remediation

reasoning: The paragraph describes the incident response governance chain anchored to specific management roles (CEO and CFO as overseers, Board as recipient of material incident notifications), making the primary question 'How is management organized to handle cybersecurity incidents?' rather than 'What does the incident response program do?' — this is MR per Rule 1 (governance-chain paragraphs default to MR when describing oversight structure). Firm-Specific level is supported by named management roles with cybersecurity-specific responsibilities and a concrete notification/oversight chain specific to this entity.


reasoning: This paragraph describes Board oversight structure for cybersecurity risks using only generic ERM language (oversight of ERM program, board is kept apprised, escalation process, periodic engagement of third-party experts) that any enterprise risk management professional could write — it fails the ERM test for domain expertise. No firm-specific facts are present (no named committees, no named officers, no named third-party assessors, no specific cadences); 'independent third-party technology experts' is generic and unnamed, and 'periodically' is a soft cadence. The paragraph provides no verifiable external claims either.


reasoning: The paragraph centers on vendor/service provider cybersecurity oversight as a central topic, making Third-Party Risk the appropriate category. However, the paragraph uses only generic risk management language ('risk-based approach,' 'identifying and overseeing') that any ERM professional could apply to any risk type — it contains no cybersecurity domain-specific terminology (no tools, frameworks, or specific practices) that would elevate it to Domain-Adapted level. No firm-specific or verifiable facts are present.


fact: Chief Security and Trust Officer role reporting to Executive Vice President, Operations

fact: Over 25 years of experience in information technology and information security

reasoning: The paragraph is primarily about management organization for cybersecurity, describing the Chief Security and Trust Officer role, their reporting line, and their qualifications — all organizational structure content. The specificity level is elevated to Level 4 by the quantifiable 'over 25 years' experience claim, which sets a verifiable lower bound on the individual's career history.


reasoning: The paragraph directly addresses third-party cybersecurity risk management through vendor evaluations, contractual safeguards, and internal control report reviews, making Third-Party Risk the primary category. The paragraph describes oversight activities but uses generic business language ('evaluate,' 'policies, procedures, and practices,' 'contractual safeguards') that any enterprise risk management professional could apply to non-cybersecurity contexts; it does not demonstrate cybersecurity domain expertise or contain firm-specific distinguishing facts, yielding Generic Boilerplate.


reasoning: This paragraph describes the cybersecurity oversight structure, explicitly stating that the Risk Committee of the Board has 'ultimate oversight' and tracing the information flow (Global Security Organization → ERM Steering Committee → Risk Committee → Board). This is a governance-chain paragraph where the board's oversight role is the central topic. All elements are generic: Risk Committee of the Board (exists at every company), Global Security Organization (generic internal function name), CSO (standard title), Disclosure Committee (generic), and ERM Steering Committee (standard). The language would be identical in any company's disclosure—'policies, procedures, and strategies,' 'day-to-day response,' and 'regular reports' are standard ERM vocabulary any non-security professional would use, failing the ERM test for domain expertise.


reasoning: The paragraph primarily describes the Board's oversight role and how cybersecurity integrates into the company's ERM framework—making it Board Governance. While it references NIST and ISO frameworks (domain terminology), these are aspirational 'based on' statements rather than verifiable claims about actual program adoption. No firm-specific facts (named leaders, specific committees, verifiable certifications) or hard numbers appear; the language is generic boilerplate that any company could file.


reasoning: This paragraph is a placeholder statement acknowledging cybersecurity investment without describing any substantive process, role, or activity. The cross-reference to Item 1A Risk Factors confirms it is a navigational redirect rather than a disclosure. No specific facts, domain terminology, or verifiable claims are present — only generic language about investing in cybersecurity and adapting controls that could appear in any company's 10-K.


reasoning: This is a section-introductory framing paragraph that states general principles about cybersecurity importance without describing any substantive cybersecurity governance, processes, or practices. It does not answer any of the six substantive questions. The language ('proactive cybersecurity measures,' 'safeguard information systems,' 'confidentiality, integrity, and availability') is generic enough that any business professional could write it, failing the ERM test for domain expertise, and contains no firm-specific or externally verifiable facts.


reasoning: The paragraph answers 'How does the board oversee cybersecurity?' — describing board oversight structure, quarterly reporting cadence, and threshold-based incident communication. It contains no domain-specific security terminology, no named individuals or committees, no specific tools/frameworks, and no verifiable facts. All content is generic governance language that any public company could use.


reasoning: The paragraph describes a real cybersecurity incident (ransomware attack with potential data exfiltration) and the company's response actions (notifications), making Incident Disclosure the appropriate category. However, the specificity is Generic Boilerplate because the key claim uses speculative language ('may have exfiltrated'), and the response description ('notifications to individuals and to regulators') contains no verifiable facts—no dates, named entities, hard numbers, or other externally confirmable details.


reasoning: This paragraph is a pure cross-reference directing readers to Item 1A Risk Factors for additional cybersecurity risk information. It does not describe any governance, management organization, risk management processes, third-party oversight, incidents, or business strategy—making it categorically None/Other. The paragraph contains no specific facts whatsoever, only boilerplate reference language.


reasoning: This paragraph is a forward-looking disclaimer that speculates about potential future incidents and cross-references Risk Factors. It contains no substantive cybersecurity disclosure—no governance, management organization, risk processes, third-party oversight, incidents, or business integration. It is therefore classified as None/Other, and because it contains no specific facts whatsoever, it receives Generic Boilerplate specificity.


reasoning: This paragraph describes vendor oversight policies — specifically pre-engagement evaluation of vendor internal controls and contractual confidentiality obligations imposed on vendors with network access. Per Rule 3, requirements imposed ON vendors is the hallmark of Third-Party Risk. The specificity is Generic Boilerplate because every sentence uses generic compliance language ('carefully evaluated,' 'appropriate controls,' 'in compliance with applicable legal requirements') that fails the ERM test — no cybersecurity domain-specific terms, no named frameworks or tools, no firm-specific details, and no verifiable claims.


reasoning: The paragraph describes board-level cybersecurity oversight structure — the board's responsibility for risk oversight, the audit and risk committee's specific role, and the information flow (periodic reporting to the full board, updates from CIO and Executive Director of Information Security). This is BG because it answers 'how does the board oversee cybersecurity' by detailing the governance chain. Specificity is Firm-Specific (Level 3) because the Executive Director of Information Security title, with its security qualifier at a senior level, is a firm-specific fact that would help distinguish this company's governance structure. No externally verifiable claims are present.


reasoning: The paragraph describes the organizational structure for cybersecurity — the CISO maintains the program and the CIO oversees it — which answers 'How is management organized?' However, it contains no firm-specific facts (CISO and CIO titles are generic roles found at any large company), no domain-specific security terminology (no specific tools, frameworks, or practices), and no verifiable claims. The paragraph is essentially a header sentence plus generic organizational statement applicable to any public company with a cybersecurity program.


reasoning: The paragraph describes board-level oversight structure for cybersecurity risk — specifically how the Board and its Audit and Compliance Committee interact with senior management. This directly answers 'How does the board oversee cybersecurity?' The 'Director - Information Systems' is mentioned only as a role title (no named individual, no qualifications), making this governance-chain content. The paragraph contains no firm-specific facts (committee names are generic governance structures), no domain terminology demonstrating cybersecurity expertise (no specific tools, frameworks, or practices), and no verifiable claims — only structural description of oversight relationships.


fact: Incident occurred in early April 2023

reasoning: This paragraph describes an actual cybersecurity incident at a specific time (April 2023) and the company's response actions (investigation with experts, law enforcement outreach, security enhancements). The specific date tied to a real event elevates this to Incident Disclosure. The temporal marker 'early April 2023' is an externally verifiable fact—someone could check security logs, news reports, or regulatory filings to confirm this timing.


fact: February 2022 — specific date of the cyber-attack

fact: Approximately three weeks — specific operational disruption duration

fact: Added a Chief Information Security Officer (CISO) — named senior leadership role added to IS leadership

reasoning: This paragraph is Incident Disclosure because it describes an actual cybersecurity incident (February 2022 targeted cyber-attack) with specific timeline, operational scope (global systems shutdown), and business impact (three weeks of limited ability to conduct operations). The paragraph contains multiple externally verifiable facts: a specific month/year for the incident, a specific duration of disruption (three weeks), and a named senior leadership addition (CISO), making this Level 4.


reasoning: The paragraph's central topic is third-party/vendor risk management, describing pre-onboarding assessments, annual re-assessments, and remediation tracking—clearly answering how third-party cyber risks are managed. However, while the paragraph demonstrates awareness of third-party risk management concepts, it lacks any firm-specific identifiers (named committees, specific titles, named individuals), hard numbers, or externally verifiable claims. The practices described (security assessments, annual re-assessments, tracking issues to remediation) represent standard industry practices common to any company's third-party risk program, not company-specific details that would distinguish FASTENAL's program.


reasoning: The paragraph describes the Board's ultimate oversight responsibility for risk management and how risk oversight is divided between the Board and senior management—this is a board governance question. However, all content is generic boilerplate: "Board," "senior management," "standing committees," and "enterprise risk" are terms used by virtually every public company in their governance disclosures. No specific cybersecurity practices, named individuals, named committees, or other differentiating details are present. The paragraph contains no domain-specific cybersecurity terminology, no firm-specific facts, and no verifiable claims—it is purely boilerplate oversight language.


reasoning: This paragraph is a general value statement about the company's approach to information security, describing it as 'comprehensive,' 'trustworthy,' 'fully integrated,' and 'cross-functional.' It contains no substantive details about board oversight, specific management roles, risk assessment methodologies, third-party oversight, actual incidents, or business/financial impact. No domain terminology, firm-specific facts, or verifiable claims are present — the language is purely aspirational boilerplate that could appear in virtually any company's cybersecurity disclosure.


reasoning: The paragraph primarily states that cybersecurity threats 'have not materially affected our business strategy, results of operations, or financial condition' — a backward-looking negative assertion about business impact per Rule 5, making it Strategy Integration. It contains no verifiable facts, firm-specific claims, or domain expertise beyond generic risk acknowledgment; the reference to 'malware and computer virus attacks' is hypothetical/occasional rather than describing specific cybersecurity practices, yielding Level 1 specificity.


fact: identity and access management

fact: cyber defense operations

fact: security engineering

fact: information technology governance, risk and compliance

fact: penetration testing

fact: threat intelligence

fact: managed security services

reasoning: The paragraph's primary focus is on management's organizational structure — describing team composition (professionals in specific cybersecurity specializations), named leadership roles (CISO, CIO), their qualifications (25+ and 27+ years of experience), and reporting lines — which maps to Management Role. The specificity reaches Domain-Adapted because the paragraph employs cybersecurity-specific vocabulary (identity and access management, cyber defense operations, security engineering, penetration testing, threat intelligence, managed security services) that a non-security ERM professional would not naturally use — demonstrating genuine cybersecurity domain expertise rather than generic risk management language.


reasoning: The paragraph describes board oversight structure (board's risk oversight function, delegation to audit committee) — classic Board Governance content. However, it contains only generic governance language: 'board of directors,' 'audit committee,' 'risk management practices' — all terms that exist at every public company with no distinguishing details. No named individuals, no specific committee structure beyond generic Audit Committee, no cybersecurity-specific vocabulary (would read identically if 'cybersecurity' were replaced with 'financial' or 'operational' risk). Specificity is Level 1 — Generic Boilerplate.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for cybersecurity risk discussion — it contains no substantive cybersecurity disclosure of its own (Rule 6, N/O threshold). No domain terminology, firm-specific details, or verifiable claims are present; the paragraph is entirely boilerplate navigation.


fact: Vice President of Internal Audit

fact: General Counsel

reasoning: This paragraph describes how cybersecurity risk flows through the ERM process to the Audit Committee, which approves the annual risk-based audit plan — a governance oversight structure. Per Rule 1, board-level committees (Audit Committee) and oversight-chain descriptions default to Board Governance. The VP of Internal Audit title and General Counsel are named roles that distinguish this company's governance structure from others.


reasoning: The paragraph's primary purpose is establishing the management organizational structure: a VP of IT & Digitization and IT Team oversee the program, with description of their responsibilities and team member qualifications. This describes WHO manages cybersecurity rather than WHAT the program does or HOW the board oversees it. The paragraph contains no domain-specific cybersecurity terminology (no specific tools, practices, or architectural concepts), no named individuals, and no verifiable claims—all language would apply equally to any company's IT risk management function.


reasoning: The paragraph is a forward-looking disclaimer combined with a negative historical assertion and a cross-reference to Item 1A Risk Factors. It contains no description of actual cybersecurity governance, program activities, or risk management processes. The negative assertion about past incidents is a boilerplate statement of absence, not a substantive materiality assessment (per Rule 5's guidance that negative self-assertions about absence are not externally verifiable). No specific facts about the company's cybersecurity posture are disclosed.


reasoning: The paragraph describes the Chief Operating Officer's responsibility for cybersecurity oversight, which answers 'How is management organized to handle cybersecurity?' — making it Management Role. However, it contains no firm-specific facts (the COO title is generic), no domain expertise beyond 'oversees policies and processes', and no verifiable claims — making it Generic Boilerplate. The cross-reference to other sections adds no independent content.


reasoning: The paragraph describes operational elements of an incident response program (prioritization guidelines, evidence handling, law enforcement engagement, severity scaling), which directly answers 'what the cybersecurity program does.' For specificity, all content consists of generic incident response concepts — 'incident response plan,' 'prioritization guidelines,' 'data collection and evidence handling,' and 'scale of severity' are all standard terms any ERM professional could write. No firm-specific identifiers (named programs, VP-level titles, specific team composition), no named tools or technologies, and no verifiable facts (specific dates, numbers, certifications, named external parties) are present. This is standard boilerplate that describes cybersecurity program categories without the domain depth or firm-specific detail needed to elevate specificity.


fact: CISO (Chief Information Security Officer) as named leadership role

fact: CPO (Chief Privacy Officer) as named leadership role

fact: CIO (Chief Information Officer) as named leadership role

fact: VP of Global IT Security as named leadership role

fact: Certified Information Systems Auditor (CISA) certification held by leadership

fact: Certified Information Systems Security Professional (CISSP) certification held by leadership

fact: Fellow of Information Privacy (FIP) certification held by leadership

fact: Certified Information Privacy Professional (CIPP) certification held by leadership

fact: Incident Response team meets weekly

reasoning: The paragraph is primarily about how cybersecurity management is organized—identifying key leadership roles (CISO, CPO, CIO, VP of Global IT Security), their professional certifications, and the composition and meeting cadence of the Incident Response team—making it a Management Role disclosure. Specificity reaches Level 4 because the paragraph names four specific professional certifications (CISSP, CISA, FIP, CIPP) that are independently verifiable through their respective certification bodies (ISC², ISACA, IAPP).


reasoning: The paragraph describes the company's approach to third-party service provider security oversight (assessment of providers' security measures and breach reporting), which maps directly to the Third-Party Risk category. However, the paragraph contains no domain-specific cybersecurity expertise (the language of 'appropriate security measures' and 'reasonable security measures' would be identical in any vendor risk context), no firm-specific facts (no named programs, roles, or organizational details), and no verifiable claims (no hard numbers, specific dates, named assessors, or certification requirements). The language is entirely generic boilerplate that could appear in any company's 10-K.


fact: Paresh Patel, named board member with IT expertise

reasoning: The paragraph describes board-level cybersecurity oversight through periodic reporting and identifies a named board member (Paresh Patel) with information technology expertise. The named individual with a specific expertise area is a firm-specific fact that distinguishes this company's board composition.


reasoning: The paragraph describes Board-level oversight structure for cybersecurity risks (who is responsible, committee assignment, information flow to the Board), making Board Governance the primary category. The paragraph contains no firm-specific cybersecurity facts, no domain terminology that passes the ERM test, and no verifiable claims — all language is generic boilerplate that appears across virtually all 10-K Item 1C disclosures ("oversight of ERM," "cybersecurity threats," "regularly scheduled Board meetings," "management provides updates").


fact: vulnerability scans related to vendors' services

fact: security questionnaires required of vendors

fact: contractual obligations related to cybersecurity imposed on providers

reasoning: The paragraph's central topic is managing cybersecurity risks from third-party service providers (application providers, hosting companies, contract research organizations, and contract manufacturing organizations), making Third-Party Risk the correct category. The specificity is Domain-Adapted because the paragraph demonstrates cybersecurity domain expertise: a general ERM professional would not naturally reference 'vulnerability scans' as a vendor oversight mechanism or articulate a risk-tiered assessment approach based on 'sensitivity of Information Systems and Data' without cybersecurity context. No firm-specific facts (named roles, specific committee structure) or quantified-verifiable claims are present.


reasoning: This paragraph is a generic preamble acknowledging technology reliance and associated security risks—it does not answer any of the six substantive cybersecurity questions (board governance, management role, risk management process, third-party risk, incident disclosure, or strategy integration). The paragraph contains no domain-specific terminology, firm-specific facts, or verifiable claims; it is pure boilerplate introduction to the cybersecurity section.


reasoning: This paragraph is a pure cross-reference pointing readers to the Risk Factors section in Item 1A. It contains no substantive cybersecurity disclosure — no governance structure, management role, processes, third-party details, incident information, or materiality assessment. Per Rule 6, paragraphs with no actual cybersecurity content default to None/Other. Since no facts are present, specificity is Generic Boilerplate.


fact: CISO (Chief Information Security Officer) briefs the Audit Committee annually

fact: Cybersecurity Executive Committee — named committee with distinguishing cybersecurity qualifier

fact: Audit Committee composed of two Board members who are also members of the Cybersecurity Executive Committee

reasoning: This paragraph answers 'How does the board oversee cybersecurity?' by describing the Audit Committee's role in receiving CISO briefings and its composition as a subset of board members who also serve on the Cybersecurity Executive Committee — establishing the governance chain. Specificity is Firm-Specific (Level 3) because the paragraph identifies the CISO role, names the Cybersecurity Executive Committee (a non-generic committee with a distinguishing identifier), and specifies that the Audit Committee has exactly two members — facts that distinguish this company's governance structure from any other public company.


fact: forensic investigations

fact: incident response management

reasoning: The paragraph primarily describes what the cybersecurity program's incident response activities entail (containment, remediation, recovery, third-party assistance, escalation protocols, annual plan review) — making RMP the central question. The specificity is Domain-Adapted because the paragraph uses cybersecurity domain terminology ('forensic investigations', 'incident response management') that demonstrates expertise beyond generic ERM language. No firm-specific facts (named roles above VP, specific team composition, named committees) or verifiable claims (specific numbers, named third-party firms, certifications) are present.


reasoning: The paragraph describes the existence of cybersecurity processes and a cybersecurity program but provides no specific details about what those processes entail (no tools, frameworks, practices, or methodologies). It is RMP because it addresses the question 'what does the cybersecurity program do,' but the content is entirely generic boilerplate with no domain expertise, firm-specific facts, or externally verifiable claims.


fact: CRO has more than 30 years of experience

fact: CRO, CIO, and CISO each have over 15 years of experience in managing cybersecurity

fact: CISO is responsible for implementing the Company's cybersecurity risk management strategy

fact: CISO oversees the Company's global security and privacy teams

reasoning: This paragraph primarily describes the qualifications, experience, and organizational responsibilities of named cybersecurity leadership (CRO, CIO, CISO), making Management Role the appropriate category. The paragraph contains verifiable experience claims ('more than 30 years,' 'over 15 years') that an external party could check against resumes or background records, establishing Level 4 specificity.


reasoning: This paragraph is a negative materiality assessment—asserting that cybersecurity threats have not had and are not reasonably likely to have a material effect—which maps to Strategy Integration under Rule 5 (SI materiality rule). However, the paragraph contains no specific facts whatsoever: no named individuals, no named programs, no incidents, no certifications, no quantifiable claims. It is a standard SEC Item 106(b)(2) forward-looking statement that appears verbatim in virtually every 10-K filing, making it Generic Boilerplate on specificity.


reasoning: The paragraph's central thrust is a backward-looking assessment that cybersecurity has not materially affected business strategy, results of operations, or financial condition—directly mapping to SI per Rule 5. The paragraph contains no domain-specific terminology (ERM test: 'assess risks,' 'invest in capabilities' are generic enough any enterprise risk professional could write them), no firm-specific facts (no named roles, committees, or programs), and no externally verifiable claims (the negative assertion about no material adverse effect is not independently confirmable).


fact: Fourth quarter of fiscal year 2019 ransomware incident

fact: Systems encrypted, disrupting customer and employee access

fact: Retained third-party consultants and forensic experts with law enforcement assistance

fact: Incident resulted in increased IT infrastructure expenditures

fact: Fourth quarter 2019 revenue was adversely affected

reasoning: This paragraph describes a specific historical cybersecurity incident (Q4 2019 ransomware attack) with concrete details about nature, timing, and business impact, making Incident Disclosure the appropriate category. The specificity level is Quantified-Verifiable due to the hard timeframe (Q4 fiscal year 2019), specific response actions (third-party consultants, forensic experts, law enforcement), and verifiable business impact claim (affected fourth quarter 2019 revenue), any of which an external party could cross-reference against financial statements, law enforcement records, or forensic firm engagements.


reasoning: This paragraph is a cross-reference directing readers to the Risk Factors section for cybersecurity threat descriptions. It does not itself answer any of the six substantive disclosure questions—it merely points elsewhere for the information. Since N/O paragraphs always receive Generic Boilerplate, and this paragraph contains no domain terms, firm-specific facts, or verifiable claims, specificity is Level 1.


reasoning: This paragraph contains only generic acknowledgments about being a 'potential target for cyberattacks' and the general importance of keeping systems secure, without describing any substantive cybersecurity measures, governance structure, or specific processes. The speculative language ('may be,' 'may depend') does not constitute an incident disclosure or strategy integration assessment per the filing rules. No specific facts about cybersecurity practices, roles, tools, or frameworks are present.


reasoning: This paragraph is a cross-reference pointing to the Risk Factors section (Item 1A). It does not itself describe any cybersecurity oversight, program, incident, or assessment—it merely redirects readers elsewhere. Per Rule 6, cross-references and forward-looking disclaimers that point to other sections are None/Other. No specific facts are present; the paragraph contains only navigation language that could appear in any public company's 10-K.


reasoning: This paragraph is purely a cross-reference to risk factors in Item 1A, providing no substantive cybersecurity disclosure about board governance, management structure, risk management processes, third-party oversight, actual incidents, or business impact. It answers none of the six substantive questions and functions as a redirect to another section. No domain expertise, firm-specific facts, or externally verifiable claims are present—the paragraph merely restates risk factor titles without revealing any details about the company's cybersecurity posture.


reasoning: The paragraph opens with a reference to the 2017 incident as factual context, but the substantive content is forward-looking risk-factor language ('If we experience additional significant compromises...could subject us to significant litigation...could have a material adverse effect') — the classic 'we may experience' speculation structure. This is standard SEC risk factor boilerplate that happens to reference a past event; it does not primarily describe what happened in an incident. No domain-specific cybersecurity terminology, no firm-specific operational details, no verifiable claims.


fact: Corporate information security organization led by CISO

fact: CISO has extensive information technology and program management experience

fact: CISO has served many years in corporate information security organization

fact: CISO holds certificate in Cybersecurity Oversight from Carnegie Mellon University Software Engineering Institute

reasoning: The paragraph primarily describes the cybersecurity organizational structure (CISO role, corporate information security organization) and leadership qualifications, making it a Management Role disclosure. The CISO's named credential (Cybersecurity Oversight certificate from Carnegie Mellon University Software Engineering Institute) is an externally verifiable claim through (ISC)² and the university registry, elevating specificity to Level 4.


reasoning: The paragraph primarily describes the oversight chain from Global Director of IT → CEO/CFO → audit committee → board of directors, which is the defining structure of Board Governance. While the paragraph mentions specific roles and a 'weekly' cadence, all elements are generic governance structures and cadences (CEO, CFO, audit committee, board of directors) that appear in virtually every public company's cybersecurity disclosure. No cybersecurity-specific domain terminology is present, and the organizational description lacks any firm-specific distinguishing details beyond being about this company's governance.


reasoning: The paragraph describes how the Audit Committee and Board oversee cybersecurity—ad hoc engagement with management, consideration during Board meetings, and annual comprehensive updates. This is Board Governance. For specificity: the Audit Committee is a generic governance role at every public company, and the cadences described ('ad hoc', 'at least annually', 'more frequently as relevant') are soft policy commitments without hard numbers or firm-specific distinguishing details. All terms (ad hoc conversations, risk management, business continuity planning) are vocabulary any ERM professional would use, failing the ERM test for domain expertise. No specific facts → Generic Boilerplate.


reasoning: The paragraph is centrally about third-party cybersecurity risk management—explicitly naming a 'Third-Party Risk Management program,' describing requirements imposed on service providers, and noting compliance assessments. This is textbook TP. However, specificity remains Level 1 because no domain-specific security terms (ERM test: any ERM professional could write this), named programs with distinguishing identifiers, or externally verifiable claims appear—the paragraph uses only generic descriptors ('multiple organizations,' 'certain security controls').


fact: Vendor Management team leads third-party due diligence process

fact: Self-attestation questionnaires developed using SOC reports

fact: Dedicated information security resources participate in vendor review

fact: Vendor management office conducts ongoing monitoring of critical providers post-contract

reasoning: This paragraph directly addresses third-party cyber risk management through pre-engagement due diligence, contractual requirements, and ongoing monitoring of critical vendors — all hallmarks of the Third-Party Risk category. Specificity is elevated to Firm-Specific (Level 3) by the explicit naming of internal organizational units (Vendor Management team, vendor management office) and dedicated information security resources with defined roles in the process. The reference to SOC reports and self-attestation questionnaires demonstrates domain knowledge, but the firm-specific organizational structure — who specifically performs these functions — is the primary specificity driver.


reasoning: The paragraph directly addresses third-party cybersecurity risk management through a vendor oversight program, making Third-Party Risk the appropriate category. However, it contains no specific facts — 'periodic reviews' and 'generally based on' are soft/indefinite, no named vendors or specific tools are mentioned, and the language ('vendor management program,' 'cybersecurity controls') is generic enough that any ERM professional could write it about non-cyber vendor risk, failing the ERM test for domain expertise.


reasoning: The paragraph describes management organization for cybersecurity (CTO and IT Director roles and their relationship), which maps to Management Role. However, the specificity is Generic Boilerplate because 'IT Director' lacks a security qualifier (e.g., 'Director of Cybersecurity'), and 'Chief Technology Officer' is a generic C-suite title; the expertise description ('wealth of IT and Information Security expertise from various roles in the technology industry') is entirely non-specific boilerplate with no verifiable claims, named credentials, specific team composition, or named programs.


reasoning: This paragraph is primarily a forward-looking disclaimer with a negative assertion about past incidents and a cross-reference to Risk Factors. It contains no substantive cybersecurity disclosure—no description of governance, management structure, risk management processes, or any verifiable facts about the company's cybersecurity posture. Per Rule 5, negative assertions ('have not identified...material effects') and speculation ('reasonably likely to materially affect') do not qualify as Strategy Integration assessments. This is standard SEC boilerplate with no informative content.


fact: CISO

fact: Cybersecurity Executive Steering Body

reasoning: The paragraph describes a governance chain—CISO → Cybersecurity Executive Steering Body → Audit Committee of the Board—answering how the board oversees cybersecurity, making Board Governance the appropriate category. The presence of the CISO (a VP-level cybersecurity role) and the named Cybersecurity Executive Steering Body committee distinguish this from generic oversight language, though the Audit Committee reference is standard boilerplate.


reasoning: The paragraph describes how third-party service providers assess the company's cybersecurity program, representing TP as the central topic. However, all language is generic boilerplate—'proactively assess,' 'industry view of the cyberthreat landscape,' 'monitoring and supporting our control environment'—that any company could use without revealing specific providers, named programs, or distinct practices. No domain-specific terminology, firm-specific roles, or externally verifiable facts are present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes risk assessment methodology (identifying threats, evaluating likelihood and damage, assessing sufficiency of controls), which directly answers what the cybersecurity program does → RMP. The language uses standard ERM terminology ('reasonably foreseeable internal and external risks,' 'likelihood and potential damage,' 'policies, procedures, systems, and safeguards') that any enterprise risk management professional would recognize — it fails the ERM test for cybersecurity domain expertise. No firm-specific facts, no named programs, no verifiable claims — the paragraph contains only generic process description applicable to any risk management function.


reasoning: The paragraph describes the organizational composition of incident response teams (who may be included from senior executives to various departments). This answers 'what the cybersecurity program does' through describing incident response team structure, making it RMP. The specificity is Generic Boilerplate because while it references specific titles (CFO, CEO) and departments, none of these are cybersecurity-specific facts, named programs, verifiable claims, or firm-specific cybersecurity roles — it describes generic incident response team composition applicable to any company.


fact: On February 16, 2022, the company became aware of a cybersecurity intrusion that caused a network disruption and impacted certain systems

reasoning: This paragraph is Incident Disclosure because it describes an actual cybersecurity event with a specific date (February 16, 2022), what happened (network disruption, impacted certain systems), and response actions (engaged internal resources and third-party experts). The remaining language about potential material adverse effects is subordinate to the incident description. The specificity reaches Level 4 because the paragraph contains a hard verifiable fact: the exact date of the intrusion, which an external party could independently verify (e.g., through the company's SEC filings, incident reports, or media coverage).


reasoning: The paragraph is primarily about managing cybersecurity risk from third parties (hotel manager Our Town, franchisors), making Third-Party Risk the appropriate category. However, it contains no domain-specific security terminology, no firm-specific verifiable facts, and no quantified claims—only general statements about relying on third parties and insurance coverage that any company with third-party relationships could write. The absence of any specific cybersecurity practices, tools, named frameworks, or quantifiable details results in Generic Boilerplate.


reasoning: This paragraph is a cross-reference pointing to Item 1A (Risk Factors) and contains no substantive cybersecurity disclosure—it merely directs readers elsewhere for information. Per Rule 6 (N/O threshold), a paragraph with no actual description of cybersecurity measures, processes, or assessments qualifies as None/Other. No specificity-elevating facts are present; the paragraph consists entirely of boilerplate cross-reference language with no domain terminology, firm-specific details, or verifiable claims.


reasoning: The paragraph's primary purpose is describing the board oversight structure—specifically how the Audit Committee receives cybersecurity briefings from the CFO and reports upward—making Board Governance the correct category. The paragraph contains no firm-specific titles (CFO is generic; Audit Committee exists at every public company), no named third parties (only 'outside consultants'), no specific cybersecurity domain terminology (ERM test fails—the language would work identically for any enterprise risk), and no hard numbers or verifiable claims.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for cybersecurity risk information, not a substantive disclosure of any cybersecurity program element. It answers 'Where can I find the information?' rather than describing any actual governance, management, processes, or assessments — making it None/Other. The quoted risk factor language is generic boilerplate without any specific facts, domain expertise, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion about whether cybersecurity has materially affected the company's business strategy, results of operations, or financial condition (the 'have not materially affected' assertion in the negative) — triggering the SI materiality rule. No specific facts, domain expertise, or verifiable claims are present; the paragraph is a forward-looking disclaimer with a cross-reference to risk factors.


reasoning: The paragraph focuses on managing cybersecurity risks from third-party vendors through control reviews — the central question is how third-party cyber risks are managed, making this TP. However, the specificity is Generic Boilerplate: the language uses standard vendor risk management terminology ('reviewing internal controls,' 'assess procedures') that any ERM professional would use regardless of cybersecurity expertise; the word 'cybersecurity' is simply appended to generic oversight practices without demonstrating domain-specific knowledge, verifiable claims, or firm-specific details.


reasoning: The paragraph is primarily about the management team's organizational responsibility for cybersecurity and the CIO's qualifications and experience — this directly answers 'how is management organized to handle cybersecurity?' (Management Role). While the CIO title and experience breadth are mentioned, no specific verifiable facts (hard numbers, named individuals, named programs, named tools, or specific security frameworks) are present; all descriptors are qualitative and generic ('many years,' 'broad extensive experience'), making this Generic Boilerplate.


reasoning: This paragraph primarily answers 'has cybersecurity affected or will it affect our business?' through a negative assertion about material impact and a mention of insurance coverage — both framing cybersecurity in business/financial terms (Rule 5 SI). It contains no domain-specific security terminology, firm-specific organizational details, or externally verifiable claims; the reference to 'cyber insurance coverage' lacks any quantification or named provider, making the entire paragraph Generic Boilerplate.


reasoning: This paragraph contains only negative assertions and forward-looking disclaimers ('have not been any breaches,' 'not every cybersecurity incident can be prevented,' 'risks that are reasonably likely to have a material effect') with no description of actual cybersecurity measures, roles, or processes. It does not answer any of the six substantive questions about governance, management organization, program activities, third-party oversight, incidents, or strategy. The reference to 'reasonable cybersecurity efforts' is generic boilerplate that any company could use.


fact: HITRUST framework

fact: SOC2 framework

fact: penetration testing

fact: threat modeling

fact: network firewalls

fact: access controls

fact: vulnerability scanners

fact: intrusion prevention and detection systems

fact: identity and access management systems

fact: vulnerability assessments

fact: cybersecurity threat intelligence

fact: phishing email simulations

fact: tabletop exercises

fact: NIST framework

fact: Incident Response Plan

reasoning: This paragraph describes the cybersecurity program's operational activities: documented policies, risk assessments, technical security tools, employee training, phishing simulations, tabletop exercises, incident response planning, and third-party reviews. These are activities the program performs, making it RMP rather than MR (roles/structure) or BG (oversight). The paragraph demonstrates cybersecurity domain expertise through specific tool categories (intrusion prevention/detection, EDR, vulnerability scanners), specific security practices (threat modeling, phishing simulations), and named frameworks (NIST, HITRUST, SOC2) — language a non-security ERM professional would not naturally use. While cadences (quarterly, annual) are mentioned, they are generic program elements without firm-specific identifiers.


reasoning: The paragraph's primary function is a negative materiality assessment—stating that no cybersecurity risks have been identified that have materially affected or are reasonably likely to materially affect the company—which maps to Strategy Integration (per Rule 5 SI materiality rule). However, it contains no substantive facts about the company's cybersecurity program; it is essentially a negative assertion plus a cross-reference to Item 1A, yielding Generic Boilerplate specificity. The reference to Item 1A is navigational, not a specific fact about the cybersecurity program.


reasoning: This paragraph is a definitional cross-reference that explains how terms are used for disclosure purposes. It does not answer any of the six substantive questions about board governance, management roles, risk management processes, third-party risk, incident disclosure, or strategy integration. It contains no specific facts, domain terminology, or firm-specific information—it is purely legal/regulatory language.


reasoning: The paragraph describes the board's oversight structure for cybersecurity—specifically the Board's ultimate responsibility and the Audit Committee's delegated oversight of cybersecurity strategies, risks, and information security. This directly answers 'How does the board oversee cybersecurity?' making it Board Governance. For specificity, the paragraph uses only generic governance terminology ('risk assessment,' 'risk management,' 'policies and procedures,' 'Board,' 'Audit Committee') that any business professional could write. No domain-specific cybersecurity terms appear, no named cybersecurity leadership roles, no specific security frameworks or tools, and no quantifiable or externally verifiable claims are present.


reasoning: The paragraph describes the cybersecurity oversight chain from management roles (Chief Information Consultant, CFO) to the board-level Audit Committee, making Board Governance the primary content. The specificity is Generic Boilerplate because all content describes standard enterprise risk management concepts (risk assessment, risk management integration, board reporting) that any public company could use—none demonstrate cybersecurity domain expertise or contain firm-specific or verifiable facts.


reasoning: The paragraph describes the Audit Committee's oversight role in reviewing internal controls and cybersecurity/data privacy risks, and how management reports to the board — all board governance functions. However, it contains no firm-specific facts (Audit Committee is a generic governance structure at every public company), no named leadership roles, no specific programs or processes, and no externally verifiable claims. All language describes standard board oversight practices without any distinguishing details about this company's specific cybersecurity governance.


reasoning: The paragraph primarily describes what the cybersecurity risk management program does (assessing, identifying, managing, reporting risks; regular evaluations; security infrastructure enhancements) rather than who does it or how the governance chain is structured, making RMP the appropriate category. The paragraph uses only generic ERM and cybersecurity language ('processes to assess, identify, manage and report,' 'regular evaluations of our systems,' 'enterprise risk management program') that any non-security ERM professional could write, contains no firm-specific organizational facts (Board, CISO, senior management, IT security teams are all standard roles), and no externally verifiable claims — failing the ERM test at every level and resulting in Generic Boilerplate.


fact: CDO (Chief Digital Officer) and CISO (Chief Information Security Officer)

fact: Over 25 years of collective prior work experience in information security roles

fact: Required to hold ISACA Certified Information Security Manager (CISM) certification

fact: Required to hold ISC2 Certified Information Systems Security Professional (CISSP) certification

reasoning: The paragraph primarily describes leadership roles (CDO, CISO), their qualifications, and experience requirements—making it Management Role. Specificity reaches Level 4 because the named certifications (CISM, CISSP) are externally verifiable through ISACA and ISC2 certification registries, and the 'over 25 years' is a verifiable lower bound on experience that could be checked against resumes.


reasoning: The paragraph describes the oversight structure for cybersecurity, mentioning the Board of Directors and Audit Committee's role in supporting the program, which maps to Board Governance. However, it contains no specific facts—all elements are generic boilerplate: 'industry best practices' is a domain-generic phrase (not cybersecurity-specific), 'Board of Directors' and 'Audit Committee' are governance roles universal to all public companies, and there are no named individuals, specific programs, or verifiable claims.


reasoning: The paragraph is entirely focused on third-party vendor cybersecurity oversight — assessment processes prior to onboarding, contractual protections, audit rights, and digital controls for vendor access. This squarely answers the TP question. However, the paragraph contains no firm-specific facts (no named programs, specific headcounts, or identifiable roles), no verifiable claims (no named assessors, specific tools, or quantified metrics), and while it mentions cybersecurity activities, the vocabulary used ('assess,' 'monitor,' 'audit,' 'digital controls') is generic enough that any enterprise risk management professional could use it — it fails the ERM test for Domain-Adapted specificity. The only differentiating detail is that the process is conducted by Onex Corp. for externally managed companies, but this is organizational context, not a cybersecurity-specific fact.


reasoning: The paragraph describes management's responsibility for cybersecurity programs and the general qualifications of those individuals (education and prior work experience), making it about organizational structure and roles rather than specific oversight structures (BG) or program activities (RMP). However, it contains no named individuals, specific titles (no CISO, VP-level titles), specific certifications, named committees, or any verifiable facts—it relies entirely on generic language that any company could use.


reasoning: This paragraph is a risk overview that describes potential cybersecurity threats and cross-references the Risk Factors section. It does not describe any cybersecurity program activities (RMP), governance structure (BG), management organization (MR), specific incidents (ID), or business/financial impact assessments (SI). The paragraph's primary function is setting up forward-looking risk disclaimers with cross-references elsewhere. No firm-specific, domain-adapted, or externally verifiable facts about cybersecurity posture are present.


reasoning: The paragraph's primary focus is on establishing the Board's active oversight role in cybersecurity through ERM integration, making it a Board Governance (BG) classification. The specificity is Level 1 (Generic Boilerplate) because all language is generic boilerplate that any company could use: 'comprehensive, cross-functional approach,' 'preserving the confidentiality, security and availability,' and 'identifying, preventing and mitigating cybersecurity threats' — none of this demonstrates cybersecurity domain expertise (fails ERM test) and contains no firm-specific facts or verifiable claims.


reasoning: The paragraph describes board-level cybersecurity oversight structure (Audit Committee responsibilities, Director reporting to the Audit Committee, Board receiving periodic updates and annual report from an independent advisor) — this directly answers 'how does the board oversee cybersecurity?' However, it contains no firm-specific facts (no named roles at VP+ level with security qualifiers, no named committees beyond generic Audit Committee), no externally verifiable claims (negative assertions about incidents, generic audit references), and uses only Level 1 domain language ('enterprise risk oversight,' 'information security programs') that any ERM professional could write. The Director of Global Information Systems is an IT role without a security qualifier, and the described governance chain is standard boilerplate for public companies.


reasoning: The paragraph's primary purpose is a negative assertion about whether cybersecurity incidents have materially affected the company (per Rule 5's SI materiality rule — 'have not experienced any material cybersecurity incidents' qualifies as an assessment). The statement acknowledging they 'have from time-to-time experienced threats' is too vague to constitute incident disclosure (no dates, no specifics). The cross-reference to Risk Factors is ancillary. Specificity is Level 1: the paragraph contains no domain-specific cybersecurity terminology (no tools, frameworks, or security practices), no firm-specific facts (no named roles or unique programs), and no verifiable claims (the 'from time-to-time' qualifier makes the incident acknowledgment soft and non-quantifiable).


reasoning: The paragraph primarily describes the company's incident response process (four interrelated steps) — what the cybersecurity program does — making RMP the correct category despite the brief governance-chain mention at the end. The specificity is Generic Boilerplate because the process description uses entirely generic terminology ('preparing for,' 'detecting and analyzing,' 'containing, eliminating and recovering') that any enterprise risk management professional could write; no domain-specific security tools, architectural concepts, or named practices are present to demonstrate cybersecurity expertise.


reasoning: The paragraph's primary content is a negative assessment conclusion about whether cybersecurity has or is reasonably anticipated to materially affect business strategy, results of operations, or financial condition — this is the core question of Strategy Integration (per Rule 5 SI materiality rule). The paragraph contains no domain-specific technical terms (the language 'identify and evaluate risks' is generic ERM language any professional could use), no firm-specific facts (no named roles, committees, or programs), and no verifiable claims (the negative assertion about not identifying threats is not independently verifiable). All content is boilerplate legal language and forward-looking aspiration.


reasoning: The paragraph describes board-level oversight responsibilities (Board of Directors oversight of cyber risk management, Audit Committee reviewing cybersecurity risks per SEC rules), which is squarely about Board Governance. However, it contains no specific facts whatsoever — only generic governance language ('oversight,' 'risk identification,' 'mitigation strategy,' 'industry standards') that any public company could use. No domain-specific security terms, no named roles above VP level, no specific programs, tools, certifications, or quantified claims.


reasoning: This paragraph is a cross-reference pointing readers to Item 1A Risk Factors for cybersecurity threat information. It contains no substantive cybersecurity disclosure—no description of governance, management roles, risk management activities, third-party oversight, incidents, or business impact assessments. As a redirect to another section, it answers none of the six substantive questions and is standard boilerplate found in virtually every 10-K filing.


reasoning: The paragraph describes a third-party vendor risk management process (pre-engagement assessments, contractual audit rights, post-engagement certification validation) but uses only generic business terminology (security risk assessment, audit rights, regular audits) that any ERM professional would use for non-cyber vendor oversight, failing the ERM domain-expertise test.


fact: Completed a merger with SomaLogic Operating Co, Inc. in early 2024

fact: ISO 27001 compliance certification

reasoning: The paragraph primarily describes cybersecurity integration activities (reviewing policies, procedures, and tools) following a merger, which constitutes a Risk Management Process. The specificity is Firm-Specific due to the named merger partner (SomaLogic Operating Co, Inc.) and ISO 27001 certification — the merger reference is a verifiable firm-specific fact that distinguishes this disclosure from any other company's filing.