reasoning: The paragraph states general cybersecurity objectives (business continuity, protecting proprietary technology, safeguarding data) without describing internal processes, named roles/frameworks, or any specific incident details.


content_category: Risk Management Process

category_confidence: medium

specificity_confidence: high

reasoning: The paragraph describes the company’s internal cybersecurity and incident response-related processes (how management is informed), but it uses generic, non-specific language with no named roles, dates, tools, standards, or firm-unique identifiers.

provider: openai


content_category: Board Governance

category_confidence: high

reasoning: The paragraph describes Board of Directors oversight and how cybersecurity is reviewed with enterprise risk management. However, it uses generic terms (Board oversight, quarterly/annual cadence) without any cybersecurity-specific roles, named committees, or firm-unique details.


category_confidence: low

reasoning: The paragraph describes general cybersecurity functions (analyze threats, set policy, implement protections, monitor/respond) but provides no named roles, tools, dates, frameworks, or company-specific details.


reasoning: The paragraph describes the company’s own cybersecurity/IT programs and activities (policies, monitoring, response plans, testing) but contains no named roles, frameworks, tools, dates, or other firm-specific details.


content_category: Strategy Integration

reasoning: The paragraph discusses insurance reimbursement for costs from a previously referenced cyber incident but does not describe the incident itself or any concrete amounts, dates, or affected systems.


reasoning: The paragraph makes a materiality/impact conclusion about cybersecurity threats affecting business strategy, results of operations, or financial condition and provides a cross-reference to Risk Factors, without describing any incident or internal risk management process.


reasoning: The paragraph is limited to a materiality determination about potential financial impact and does not describe any incident facts, systems, scope, or response actions.


content_category: Incident Disclosure

reasoning: The paragraph describes ongoing forensic analysis of a cybersecurity incident and notes the lack of conclusive evidence, which is substantive incident-response disclosure. It contains no firm-specific details (no dates, systems, scope specifics, or named parties/tools), so it is generic.


content_category: Third-Party Risk

reasoning: The paragraph describes a risk management process focused on critical third-party service providers, suppliers, and vendors (due diligence and periodic monitoring). It does not reference any named roles, standards, products, dates, or other firm-specific details.


reasoning: The paragraph describes the company’s own incident response process (an IRP) and how it is tested via tabletop exercises, which is internal risk management. It contains no company-specific, named program, role, date, tool, or other verifiable details, so it is generic boilerplate.


reasoning: The paragraph focuses on the potential material financial impact and ongoing assessment, without describing the incident’s concrete facts (systems/data affected, timelines) or specific controls/process details.


reasoning: The paragraph’s core disclosure is that the company maintains a cybersecurity risk management program (identify, assess, manage, mitigate, respond). It also includes management credentials and roles, but the central topic is the internal risk management process.


reasoning: The paragraph describes ongoing incident response actions (restoring systems, unable to estimate disruption, retaining experts, working with law enforcement, notifying regulators) but provides no concrete incident details (dates, scope, systems, or named experts).


reasoning: The paragraph provides only a materiality conclusion about potential financial impact and does not describe any incident facts, scope, systems, or response actions.


reasoning: The paragraph discusses cybersecurity insurance coverage, incident-response/business interruption/regulatory fines costs, and policy limits/deductibles, with no description of an actual incident or internal risk management process.


reasoning: The paragraph describes an internally established cybersecurity awareness/training initiative and its operating purpose, which is part of the company’s internal risk management and security program activities.


reasoning: The paragraph provides a materiality conclusion about the incident’s financial/operational impact but does not describe what happened or any specific cyber details, dates, systems, or roles.


reasoning: This paragraph describes an actual cybersecurity incident outcome (threat actor accessed and exfiltrated limited data including some PII) and associated response actions (notifications), but it provides no specific verifiable details such as dates, amounts, affected systems, or named organizations.


reasoning: The paragraph provides only materiality/financial impact conclusions about an incident without describing what happened or its technical/operational scope.


reasoning: The paragraph provides a materiality conclusion about the incident’s lack of financial/operational impact, without describing what happened in the incident or any concrete response actions or scope.


reasoning: The paragraph provides only a materiality/financial impact conclusion about an incident without describing what happened, what systems/data were affected, or response actions.


reasoning: This paragraph discusses ongoing financial/strategic impacts from a prior cybersecurity incident (litigation, customer behavior changes, regulatory scrutiny, insurance availability/cost) without describing the incident itself or any internal risk processes or incident details.


content_category: None/Other

reasoning: This paragraph is legal boilerplate about a waiver period under credit/lease agreements and does not provide any cybersecurity-specific governance, risk process, incident, or security-related detail.


reasoning: The paragraph discusses business/financial impacts and potential losses stemming from the incident, but provides no incident narrative, dates, affected systems/data, or response actions. This makes it a material/impact disclosure rather than incident disclosure or a risk management process description.


reasoning: The paragraph references incident-related reporting to law enforcement and regulatory agencies but provides no specific incident facts, dates, systems, scope, or named bodies, making it indistinguishable from boilerplate compliance language.


reasoning: This paragraph provides only a materiality/impact assessment regarding the incident and does not describe any incident details, systems affected, or response actions. It is therefore strategy integration rather than incident disclosure.


reasoning: The paragraph describes the impact of an incident (disrupted networks and transactional services not being accessible) and provides a status link for incident updates, but it contains no extractable firm-specific details beyond generic incident-impact language.


reasoning: The paragraph describes that the company’s cybersecurity risk assessment and management processes are implemented by individuals in management, focusing on internal processes rather than an incident or board oversight. However, it only references generic leadership titles (including CFO) without cybersecurity-specific roles or other firm-verifiable details.


reasoning: The paragraph provides an impact/materiality-style conclusion about disruption and discusses evaluation of legal/financial/reputational impacts and remediation costs, without describing the incident itself (no dates, systems, or event details).


reasoning: The paragraph only provides a materiality/financial impact conclusion about the incident, without describing what happened, affected systems/data, or response actions.


reasoning: The paragraph only provides a materiality assessment about potential financial/operational impact of an incident, without describing what occurred or any cyber-specific governance/process details.


content_category: Management Role

reasoning: The paragraph identifies a named management role (Harold L. Rogers) serving as interim chief executive officer for the subsidiary and includes a specific resignation date.


reasoning: This paragraph discusses reimbursement of costs via cybersecurity insurance recoveries, without describing any incident facts or operational/technical impact.


reasoning: The paragraph refers to notification of law enforcement and regulatory bodies related to “the matter,” but it does not describe a cybersecurity incident or provide any incident-specific scope, dates, systems, or impact details.


reasoning: The paragraph describes a real cybersecurity incident, including notification and confirmation dates and the exposure of customer information, which is incident-level disclosure.


reasoning: The paragraph focuses on material financial impact and continuing investigation/analysis without describing incident details or specific scope, dates, systems, or named parties—so it fits strategy/materiality rather than incident disclosure.


reasoning: The paragraph describes operational disruptions related to online ordering, which resembles incident-style disclosure, but it provides no incident specifics (dates, systems affected beyond general online ordering, scope, or response). Therefore, it does not meet firm-specific or quantified detail requirements and is treated as generic.


reasoning: The paragraph references an incident and ongoing restoration/resumption, but provides no concrete incident details (no dates, systems, scope, or affected data) or other firm-specific facts.


reasoning: The paragraph discusses an ongoing cybersecurity investigation and remediation for potentially affected data, indicating an incident context even though it lacks specific event details or dates.


reasoning: This paragraph discusses materiality/financial impact of an unspecified cybersecurity incident but provides no incident details, dates, or amounts, fitting the strategy/materiality integration category.


reasoning: The paragraph provides only materiality/financial impact conclusions about an unspecified incident, without describing what happened or any operational/scoping details beyond being non-material.


reasoning: The paragraph discusses an ongoing investigation of a real cybersecurity incident and includes assessment of the scope of personal information in exfiltrated data and intent to provide notifications. However, it contains no firm-unique named details or verifiable facts to increase specificity.


reasoning: The paragraph describes an ongoing cybersecurity incident investigation focused on whether PII was taken and sets an expectation for a future determination, which is incident-disclosure content rather than governance, process, or strategy.


reasoning: The paragraph describes actions taken in response to a cybersecurity incident (closing off the point of unlawful access) and indicates affected customers will receive notice, which aligns with incident response/impact disclosure. However, it provides no concrete incident details, dates, or named parties to raise specificity.


reasoning: The paragraph provides a materiality conclusion (no reasonable likelihood of material financial impact) but does not describe the incident’s technical details or affected systems. References to investigation/experts/law enforcement are generic and do not include incident scope, dates, or specific tools/vendors.


reasoning: The paragraph describes a real cybersecurity incident activity (access, data exfiltration, and encryption) even though details are limited and still under investigation. It contains no extractable firm-specific facts such as dates, systems/tools, or named parties.


reasoning: This paragraph discusses assessing whether the incident may have a material impact on financial condition and operations, without describing the incident details or any specific measurable facts.


specificity_confidence: low

reasoning: The paragraph describes a real incident response action (mailing notification letters) and indicates affected personal information, which is characteristic of incident disclosure despite lacking incident specifics.


reasoning: The paragraph narrates a specific cybersecurity incident with an awareness date and unauthorized third-party access to company systems, which fits incident disclosure requirements.


reasoning: The paragraph describes a real cybersecurity event (a system outage) and immediate response actions (activation of an incident response team) tied to a specific date.


reasoning: The paragraph discusses monitoring the timing and materiality of an ongoing incident, but provides no incident details or measurable facts; it therefore fits the materiality/incident-impact monitoring aspect of strategy integration rather than incident disclosure.


reasoning: This paragraph is a general disclosure about website disruption and directing readers to a communications URL, without describing any cybersecurity incident details (e.g., what happened, scope, systems, or response).


specificity_confidence: medium

reasoning: The paragraph describes a real incident (systems outage) caused by a cybersecurity attack, including incident response activation and a specific discovery date, which fits Incident Disclosure. It is Firm-Specific due to the specific date and the described incident response team composition, but lacks two hard external verifiable facts like named vendors/tools or dollar amounts.


reasoning: The paragraph provides a materiality/financial impact conclusion about a cybersecurity incident without describing what happened or affected systems/operations in detail.


reasoning: The paragraph describes the effects of a cybersecurity incident on operations (shipping/receiving, manufacturing, back-office functions) and ongoing restoration/temporary measures, which is incident-related disclosure even though it lacks incident specifics.


reasoning: The paragraph provides only a materiality/financial-impact assessment related to an incident without describing what happened, affected systems/data, or response actions.


reasoning: The paragraph discusses the company’s believed impacts of a cyber incident in terms of costs and rebuilding/hosting and security enhancements, without describing the incident’s factual events, scope, or timeline.


reasoning: The paragraph describes an actual cybersecurity incident involving a threat actor’s access to IT systems containing sensitive personal information and mentions ensuing notification actions. However, it provides no concrete dates, system/tool names, or other firm-verifiable details beyond generic incident-response/legal notification intent.


reasoning: The paragraph discusses expected material financial impact and concludes there will be no material impact on overall financial condition or ongoing results, without describing the incident mechanics or affected systems. No firm-specific cybersecurity roles, tools, dates, or named standards are provided.


reasoning: The paragraph describes an incident-related response action (notifying regulatory authorities and working with law enforcement) tied to unauthorized access to information, but provides no specific facts such as dates, scope, affected systems, or named tools/firms.


reasoning: This paragraph discusses whether the incident will have a material impact on financial condition/results, without describing the incident itself or any specific governance/process details.


reasoning: The paragraph describes the status of a cybersecurity incident (contained) and recovery actions (restoring the core IT environment), but it provides no concrete incident details such as dates, affected systems, or scope.


reasoning: The paragraph describes a real incident and provides a specific detection date and what activity was detected (fraudulent attempts to obtain funds).


reasoning: The paragraph describes a real cybersecurity incident, including when it was first noticed and the nature of the unauthorized activity, along with investigation/containment/remediation steps.


reasoning: This paragraph provides generic risk-factor language about cybersecurity threats and potential impacts, without describing any specific incident, named roles/committees, internal programs with unique identifiers, frameworks, tools, dates, or verifiable facts.


reasoning: This paragraph only references an attached press release and provides no actual cybersecurity incident facts, actions, or outcomes itself.


reasoning: The paragraph describes S&T BANCORP’s internal process for evaluating incident criticality, escalation, and its Incident Response Program and Business Continuity Plan. While it mentions third-party vendors for hosting/management, the central topic is the company’s own risk management and response processes (not vendor security oversight).


reasoning: The paragraph describes an actual cyber incident’s aftermath (restoration of impacted IT systems/data, ongoing minor operational impacts, and investigation closure by authorities), which fits incident disclosure even though it lacks firm-unique technical details.


reasoning: The paragraph describes operational response/mitigation steps (temporary manual processing and alternative distribution channels) while systems are being restored, which is consistent with incident impact and recovery actions. However, it provides no identifiable details (dates, affected systems/data, or named tools/parties), making classification less certain.


reasoning: The paragraph describes Bel’s internal cybersecurity roles and processes (monitoring, training, penetration testing, asset protection) plus how Bel evaluates/controls third-party hosted application risk as part of its own risk management practices, not a standalone vendor-oversight requirement.


reasoning: The paragraph describes what happened in an incident (a fourth-party vendor compromise causing the incident) and states that the company activated its response process. No named roles, dates, tools, or other ✓-listed specifics are provided to extract as firm-specific facts.


reasoning: The paragraph describes the company’s own cybersecurity program components (governance inputs, incident response planning, cross-functional risk controls, and risk-based third-party risk management) rather than a discrete incident. Although it mentions the Audit Committee, CIO, and a specific incident response plan, the dominant topic is internal risk management and program processes.


reasoning: The paragraph focuses on the company’s internal cybersecurity risk management activities (monitoring, exercises/assessments, and briefings) and the internal team responsible for informing oversight, rather than an incident or third-party oversight.


reasoning: The paragraph describes the company’s own cybersecurity risk management approach, including who owns risk assessment/mitigation (CISO reporting to CTO) and how monitoring/escalation is handled, rather than describing an actual incident.


reasoning: The paragraph centers on threats posed by external actors and includes that Oracle and its vendors are regularly subject to attempts to exploit vulnerabilities and gain unauthorized access, which aligns most closely with third-party risk. It contains a fiscal-year-specific assertion but no named standards, tools, or firms beyond the company context.


reasoning: The paragraph describes the company’s own cybersecurity threat assessment, layered security, training, tooling, and ongoing risk-management activities (including third-party security assessments as part of its process). It is not an incident narrative and focuses on internal processes rather than a board/management role or standalone financial/materiality impacts.


reasoning: This paragraph is centered on the Board and specifically the Risk Committee’s oversight activities for cybersecurity risk within the ERM program.


reasoning: The paragraph describes a general cybersecurity risk management program and ongoing efforts to comply with regulatory requirements, but it provides no firm-specific details (no named roles, standards, programs with unique identifiers, products, tools, or dates).


reasoning: This paragraph provides general descriptions of technology dependence and generic cyber-threat susceptibility without describing an incident, internal processes, specific roles/committees, named frameworks/programs, or verifiable firm-specific details.


reasoning: The paragraph centers on a third-party IT/cybersecurity firm that has outsourced primary responsibility for overseeing and managing the company’s cybersecurity risk processes, roles, and controls (with vCISO and other named team positions). It includes firm-unique details such as vCISO and specific certification types.


reasoning: The paragraph describes the company’s own cybersecurity risk processes (risk framework, monitoring by an internal team, testing, and vendor due diligence as part of risk practices), not a specific incident. It also names NIST as the referenced framework.


reasoning: The paragraph is general forward-looking risk language about potential cybersecurity threats and business impacts, without describing an actual incident, a specific governance/management role, or any named framework/tools, dates, or firm-specific program details.


reasoning: The paragraph describes Zymeworks’ internal cybersecurity risk management components (identification/escalation, technical safeguards, incident response/recovery planning, education) rather than a disclosed incident. It also includes third-party risk as part of the company’s own risk management approach, not as a central vendor-oversight program with specific requirements or named entities.


reasoning: The paragraph describes an actual cybersecurity incident and its operational impact, including duration and affected systems (financial and operating reporting systems).


reasoning: The paragraph describes Wendy's internal cybersecurity risk management strategy components (assessment, controls framework, risk assessments, infrastructure, dedicated personnel, training), which is centered on its own processes rather than an incident or third-party oversight.


reasoning: The paragraph describes the company’s own cybersecurity program, including risk assessment and specific processes (Cybersecurity Program and Cyber Incident Response Plan) and how it is administered. It also provides firm-specific governance/roles and quantified experience lengths for named positions, making it more than boilerplate.


reasoning: The paragraph describes the company’s internal risk identification, mitigation, monitoring, and related planning using the NIST Cybersecurity Framework, plus its enterprise risk assessment and ongoing security procedures—this is primarily the risk management process rather than incident disclosure or board-only oversight.


reasoning: The paragraph describes generalized cybersecurity risks and includes a cross-reference to a risk factor, but it does not disclose any specific incident, named roles/programs/tools, dates, or other firm-specific facts.


reasoning: The paragraph describes the company’s own cybersecurity risk management approach (monitoring, assessments, policies, training, and cybersecurity supplier engagement) rather than a specific incident. It includes third-party/supplier considerations as part of internal risk management processes, not as a standalone third-party risk governance requirement.


reasoning: The paragraph primarily describes the company’s own cybersecurity program and processes (controls, monitoring, incident tools, escalation, and supplier risk processes) rather than an actual incident or a board-only governance disclosure.


reasoning: The paragraph describes the Company’s internal cybersecurity program elements (governance, controls, incident response/recovery, third-party risk management) as part of its ERM/risk management approach, not a specific incident or a vendor-centered oversight activity.


reasoning: The paragraph describes the company’s internal cyber risk mitigation approach (controls, monitoring, resiliency, and continuous improvement) integrated into its risk management processes. It is not primarily about board oversight or management roles, and it does not describe a specific incident.


reasoning: The paragraph centers on who is responsible for cybersecurity risk (named executives, CISO, and the dedicated cybersecurity team) and describes their qualifications and oversight responsibilities, making it primarily a Management Role disclosure.


reasoning: The paragraph describes the company’s internal cybersecurity incident response and coordination mechanisms (Agility Plan, CMT escalation, training, and assurance activities). It is not primarily about an actual incident or third-party/vendor oversight as the central topic.


reasoning: The paragraph is general forward-looking language about potential cybersecurity risks and states no material cybersecurity threats occurred during the year, without describing any incident specifics, governance/roles, or defined internal processes beyond generic mitigation language.


reasoning: The paragraph describes Bowman’s own cybersecurity monitoring and internal response processes (including its incident response plan and how monitoring results trigger actions), which is characteristic of a risk management process rather than board/management roles or incident disclosure.


reasoning: The paragraph centers on the designated Chief Information Officer’s responsibilities, qualifications, and certifications in managing cybersecurity risk, with governance interactions mentioned as supporting context.


reasoning: The paragraph describes use of an IRP and general incident types and monitoring, but does not narrate a specific incident or provide firm-unique operational details. It also mainly functions as boilerplate risk/response language rather than board/management roles, third-party vendor oversight, or strategy/materiality with an incident-specific narrative.


reasoning: This paragraph focuses on Cohen & Steers’ internal cybersecurity controls, processes, and policies (e.g., monitoring, encryption, incident detection/response, training, risk assessments, and encryption), which is characteristic of risk management. It also references the company’s own vendor risk management program and vulnerability management policy as part of those internal processes rather than a standalone third-party oversight disclosure.


reasoning: The paragraph centers on specific cybersecurity management roles (CISO, CCO) and describes qualifications/certifications that identify how the organization manages cyber risk, rather than an incident or internal risk process mechanics.


reasoning: The paragraph’s primary substance is board/committee oversight of cybersecurity risk (Board exercises oversight; Audit Committee reviews and reports to the Board). It also contains standard forward-looking materiality language, but no incident details or firm-unique cybersecurity specifics.


reasoning: The paragraph describes the company’s own cybersecurity controls and internal processes (monitoring/detection, encryption, access controls, DR, vulnerability scanning, third-party risk register) rather than an incident or board/management role.


reasoning: The paragraph describes the company’s own cybersecurity risk assessment and management program, including general categories of threats and an assessment of materiality of identified risks. It does not describe a specific incident, name a framework/standard, or provide any firm-unique technical roles/tools/dates.


reasoning: The paragraph describes USCF’s internal information security program, including cybersecurity risk evaluation and mitigation activities, with due diligence on third parties as part of the Trust’s risk management approach.


reasoning: The paragraph describes Kontoor Brands’ internal cybersecurity risk management activities (cross-functional approach, containment/assessment/remediation, incident response plans, technical safeguards, and training). It does not provide named roles, specific frameworks/tools/products, dates, or a vendor-oversight topic that is central enough to be categorized as Third-Party Risk alone.


reasoning: The paragraph describes Northern Trust’s internal cybersecurity/technology risk management program, policies, governance activities, and how risks are integrated with enterprise risk management, with third-party controls mentioned as part of those internal processes.


reasoning: The paragraph focuses on the company’s own cybersecurity risk management approach (policies/processes, securing systems/data, and investment of resources), not an actual incident and not primarily vendor oversight or materiality/strategy impacts.


reasoning: The paragraph describes the company’s information security/cyber risk and states it has implemented processes to identify, assess, and manage material cybersecurity risks. It does not describe a specific incident or name concrete frameworks, roles, systems, or dates.


reasoning: Although the paragraph begins with Board/Risk Committee oversight, the bulk of the disclosure describes Schwab’s integrated enterprise risk management and information security program activities (monitoring, controls, training, and third-party standards) as internal risk management processes.


reasoning: The paragraph describes LEE’s own cybersecurity monitoring and incident-prevention/detection/resolution processes (including SOC monitoring and threat hunting) and how management roles operate within those processes, which is primarily a risk management process disclosure.


reasoning: The paragraph describes Embecta’s own cybersecurity monitoring, controls, penetration testing/assessments, and risk management process, with vendor risk addressed as part of that internal program (not solely vendor oversight). It also includes a named committee (ISRC) and embedded internal risk framework details.


reasoning: The paragraph primarily describes the company’s own cybersecurity risk assessment, monitoring, incident management/response, remediation, and integration into overall risk management. Although it mentions third-party diligence, that is a supporting element rather than the central focus.


reasoning: This paragraph describes the Company’s own cybersecurity program and processes (risk-based approach, controls, SOC monitoring, metrics, and periodic review by CIO/CISO). It also references the NIST Cybersecurity Framework, so the specificity is sector-adapted rather than firm-unique.


reasoning: The paragraph describes the company’s own cybersecurity risk management activities (security operations/governance via an Information Security Program, committee-based assessments, monitoring/controls, and a third-party risk management program). While it includes third-party risk, it is framed as part of the company’s internal processes rather than making vendor oversight the central topic.


reasoning: The paragraph describes the company’s general approach to cybersecurity risk management (policies, processes, investments, and oversight), but it does not describe a specific incident or name any cybersecurity role, framework, program, or verifiable firm-specific detail.


reasoning: The paragraph describes WTW’s own cybersecurity risk management strategy and operating processes (incident response planning, technical safeguards, training, threat intelligence, and third-party risk management as part of its risk program). It is centered on internal risk management rather than an actual incident or board/management role disclosures.


reasoning: The paragraph primarily describes Ardent’s internal approach to managing cyber risk from third parties (IT review/approval, cybersecurity team assessments, vendor risk analysis, and an updated incident response plan with escalation). Although it mentions engaging third parties, vendor oversight is embedded within the company’s own risk management process rather than being solely about third-party management.


reasoning: The paragraph describes Riot’s internal cybersecurity monitoring/response practices (e.g., EDR/SIEM, network protections, Zero Trust, backup/recovery, training, compliance) and employee notification procedures, rather than board oversight, a management role, or a distinct third-party-vendor program.


reasoning: The paragraph describes the company’s own incident response plan and how it is used (escalation, assessment for material impact, and annual testing/tabletop exercises), which is internal risk management rather than an incident or third-party oversight. It contains only generic concepts with no named roles, tools, standards, dates, or firm-unique identifiers.


reasoning: The paragraph describes the company’s internal risk management approach for cybersecurity (risk assessment/management by IT/CTO, governance committee updates, and an adopted Cybersecurity Incident Response Plan), rather than an actual incident or primarily board oversight.


reasoning: The paragraph describes MEG’s own incident response plan and execution responsibilities (IRP aligned to NIST RMF, roles, and escalation/reporting procedures), which is an internal risk management process rather than an incident narrative or vendor-only oversight.


reasoning: The paragraph is centered on how the Audit Committee and the Board conduct and structure cybersecurity oversight, including reporting from the CIO/CISO and use of a NIST scorecard. It contains firm-specific governance details (Kroger’s Audit Committee, quarterly updates, and NIST scorecard).


reasoning: The paragraph centers on oversight of cybersecurity risk arising from third-party service providers and describes the vendor management program, audits, and contractual cybersecurity obligations imposed on providers.


reasoning: The paragraph states there was no material cybersecurity incident in 2023, provides materiality/impact conclusions, and discusses cybersecurity insurance coverage sufficiency—without describing any actual incident details beyond general risk and forward-looking references.


reasoning: The paragraph describes Grindr’s internal cybersecurity risk management measures (policies, audits, access controls, vulnerability management, incident response, and planning), which is the company’s own process. Although it mentions vendor risk management and a managed SOC, these are components of its internal risk mitigation approach rather than vendor oversight as the central topic.


reasoning: The paragraph is a forward-looking statements safe-harbor/disclaimer and cross-references other sections without describing any incident facts, scope, or response actions.


reasoning: The paragraph centers on the Board and specifically the Audit Committee’s oversight, including reviewing the cybersecurity program and receiving reports. It also references a management cybersecurity role (CTO), but the grammatical focus is board/committee governance.


reasoning: The paragraph describes the company’s internal cybersecurity preparedness and response approach (disaster recovery plan, incident response policies, CMT escalation, training, and assurance activities), with no central focus on a specific incident or on vendor/security-contract oversight.


reasoning: The paragraph describes the company’s internal cybersecurity governance and operating procedures (security programs, monitoring, escalation, incident reporting, and how an enterprise-wide IT team oversees incident response). While it references roles like the CISO and CIO, the central topic is the firm’s risk management and information security processes.


reasoning: The paragraph describes a real cybersecurity incident (defaced website), includes incident timeline and actions taken (restore, take down/temporary page), and provides impact (website inoperable, seminar cancellation) and response steps (working with forensic specialists, FBI reporting).


reasoning: The paragraph provides an incident-related update with dates, scope (accounts accessed and customer accounts impacted), attacker/devices handling, and compensation tied to the disclosed incident, including quantified amounts and start date.


reasoning: This paragraph is forward-looking and largely states the absence of formal cybersecurity policies and dedicated personnel, with no incident description, named roles, frameworks, or other firm-specific details.


reasoning: The paragraph is a boilerplate statement about not having identified material cybersecurity incidents, plus a generic note that threats and incidents may occur. It contains no incident narrative, named roles/programs, dates, tools, or vendor/security oversight details beyond generic references, and it primarily serves as a disclaimer/cross-reference to Risk Factors.


reasoning: The paragraph describes a specific cybersecurity incident with an incident date, unauthorized access by a third party, encryption deployment, exfiltration, system shutdown/notifications, and operational impact to financial and operating reporting systems.


reasoning: The paragraph describes an actual cybersecurity incident and its scope (third-party unauthorized access and file exfiltration), response actions (system shutdowns/isolating from the Internet), and operational impact (disruption and limitations affecting reporting systems). It is not solely about financial materiality or process/controls.


reasoning: The paragraph discusses general financial/material risk and potential costs/disruptions from hypothetical cybersecurity events, without describing an actual incident or naming internal processes, roles, frameworks, or specific firm facts.


reasoning: The paragraph describes a real incident narrative (threat-actor email, alleged access via support personnel outside the U.S., and the company’s response including termination, fraud monitoring, and customer warnings). It also concludes the events were part of a single data-theft campaign and states non-payment and law-enforcement cooperation.


reasoning: The paragraph is primarily about how the Board of Directors and Audit Committee oversee the cybersecurity program, including how the CISO provides updates and escalates issues to the Board.


reasoning: The paragraph centers on a specific management executive (the CEO/President, Luca Fabbri) and his coordination with another named senior officer (General Counsel Christine Garrison) to oversee cybersecurity risk and incident reporting.


reasoning: The paragraph describes senior management creating cybersecurity risk appetite metrics for approval by the Board of Directors, but it does not name any cybersecurity-specific roles, committees, frameworks, or provide any firm-specific details beyond generic governance language.


reasoning: The paragraph describes the company’s internal cybersecurity/risk assessment and control-audit process (assessments, remediation, and review flow), with external firms/MSSP involved as part of that process rather than as the central topic. It does not include any qualifying firm-specific cybersecurity-role names, dates, tools, standards, or named third parties from the ✓ IS list, so no specific_facts are extractable.


reasoning: The paragraph describes generic information security training practices without naming any cybersecurity role, program identifier, framework/standard, tools, dates, or other firm-specific facts.


reasoning: The paragraph describes the company’s internal cybersecurity safeguards and its incident response plan testing/evaluation cadence, which are risk management processes. It contains no named roles, dates, tools/products, frameworks/standards, or incident specifics, so it is generic boilerplate.


reasoning: The paragraph describes the company’s own cybersecurity program and how it is integrated into its enterprise risk management framework, including internal assessments, monitoring, training, and incident preparedness. Third-party oversight is mentioned only as part of the internal program’s scope, not as the central focus of vendor risk management.


reasoning: The paragraph describes the company’s internal risk management program (risk assessments and questionnaires, annual third-party risk assessments) rather than focusing centrally on vendor oversight requirements alone.


reasoning: The paragraph primarily describes Alternus’s internal cybersecurity processes (threat assessment, protection/detection/response/recovery, and risk management), including how vendor risks are handled as part of its overall cybersecurity risk management framework rather than making vendor oversight the sole focus.


reasoning: The paragraph discusses who is responsible for cybersecurity and mentions management working with an IT-led function and a Software Engineer, but it provides no cybersecurity-specific titles (e.g., CISO/CTO) or other firm-unique identifiers, dates, tools, or frameworks.


reasoning: The paragraph focuses on using third-party service providers to manage cybersecurity-related risks, which is centrally about third-party involvement. It contains no named firms, roles, standards, dates, or other company-specific verifiable details.


reasoning: The paragraph is primarily about the board-level Risk Committee’s oversight responsibilities and its reporting/engagement with management on risk and cybersecurity, which fits Board Governance.


reasoning: The paragraph is high-level, forward-looking language about cybersecurity and safety priorities, with no named roles, committees, dates, tools, frameworks, or incident details. It does not describe a specific governance process, internal risk management procedure, or any disclosed event.


reasoning: The paragraph is a forward-looking/boilerplate explanation about lacking operations and not adopting cyber risk management programs. It contains no incident, named roles/committees/teams, dates, frameworks, or other cybersecurity-specific specifics.


reasoning: The grammatical subject is cybersecurity leadership (CISO and VP of Information Security) and the paragraph describes their qualifications/experience, aligning with a management role disclosure.


reasoning: The paragraph describes internal investigation and assessment steps (determine incident status, isolate systems) and general use of outside advisors, but it does not disclose a specific incident, board/management roles, or any named framework/tools/dates.


reasoning: The paragraph describes the company’s own cybersecurity risk-evaluation and management procedures (including internal policy and processes for managing risks tied to suppliers/customers), which is central to risk management rather than an incident disclosure or board/management role.


reasoning: This paragraph focuses on board-level oversight by an Audit Committee regarding cybersecurity risk reporting and incident mitigation/disclosure. It contains only generic governance language and does not name any cybersecurity-specific roles, unique programs, tools, dates, or other firm-specific details.


reasoning: The paragraph describes having an incident response plan and the types of actions/oversight it covers, which is internal risk management. However, it contains no firm-specific or cybersecurity-specific named roles/frameworks beyond generic references (e.g., incident response plan, chief executive officer).


reasoning: The paragraph states a lack of established processes in generic terms and does not describe an internal risk management framework, named standards, roles, committees, or any incident or materiality conclusion tied to specific systems or dates.


reasoning: The paragraph focuses on how the company’s internal Information Security/IT teams support governance and oversight through internal office routines (Project Management Office and Vendor Management Office) to onboard products/projects/vendors, which is an internal risk management process rather than an incident or board/management role.


reasoning: The paragraph primarily describes the company’s approach to managing cybersecurity risk (KPIs, risk-based approach, and policies). It does mention board meetings, but the substance is internal risk management and does not include any cybersecurity-specific roles, named committees, frameworks, dates, or other firm-specific details.


reasoning: This paragraph is forward-looking and describes general limitations of cybersecurity controls without naming any company-specific program, roles, dates, standards, tools, or incidents.


reasoning: The paragraph is explicitly about the Board of Directors’ oversight activities (reviewing the cybersecurity program and response plan). It contains no cybersecurity-specific roles, named committees/teams, dates, tools, frameworks, or other firm-specific details beyond generic board oversight language.


reasoning: The paragraph describes the company’s internal cybersecurity risk management objective and improvement initiatives, including review of risk management processes by internal experts under the CTO.


reasoning: This paragraph is generic forward/operational description of security awareness practices and cybersecurity insurance coverage, with no named roles, frameworks, products, dates, or other firm-specific details; it is not an incident narrative or a defined internal risk management process with unique specifics.


reasoning: The paragraph centers on the CISO and names specific management roles (including reporting/partnership roles) that oversee and participate in cybersecurity risk management.


reasoning: This is a generalized statement of unawareness of material cybersecurity impacts, with no incident description, no specific roles, frameworks, systems, or other firm-specific details.


reasoning: The paragraph describes the company’s own cybersecurity risk assessment and mitigation practices (assessment against CIS, monitoring/assessments/testing/exercises, and related policy/training/insurance), not a governance body or an actual incident.


reasoning: The paragraph describes BlackRock’s internal cybersecurity program and processes (governance structure, controls, incident response/recovery planning, and how third-party risks are identified/overseen within its ERM/cybersecurity program). While it mentions third parties, the central topic is the company’s own risk management approach rather than vendor oversight as a standalone theme.


reasoning: The paragraph discusses limitations of security controls and detection/response effectiveness in general terms, describing the company’s security approach at a high level without naming specific roles, programs, tools, standards, or incidents.


reasoning: The paragraph centers on board-level oversight and delegation of cybersecurity oversight to a board committee, describing governance responsibilities rather than a specific incident or detailed internal process specifics. No extractable firm-specific cybersecurity facts (e.g., named CISO/CTO/CIO, non-generic committee names, tools/products, or dated events) are present beyond generic governance language.


reasoning: This paragraph is general forward-looking risk language and a cross-reference to another risk factor, with no incident description, no internal process details, and no cybersecurity-specific roles, dates, standards, or named tools.


reasoning: The paragraph describes the company’s internal incident response and vulnerability management escalation processes and how management and the incident response team become involved. It does not provide any unique, cybersecurity-specific named roles from the ✓ list or other verifiable firm-specific details.


reasoning: The paragraph is centered on named management cybersecurity roles (CIO/CTO/Information Security Officer) and their accountability for the information security program and related responsibilities.


reasoning: The paragraph is a forward-looking statement that no reportable cybersecurity incidents are currently known, plus generic risk/disclaimer language; it does not describe an actual incident or internal cyber processes with identifiable facts.


reasoning: The paragraph centers on cybersecurity due diligence and contractual security requirements imposed on vendors that store the Company’s sensitive information. It also includes a materiality statement, but the vendor encryption/access-control requirements are the core, differentiating disclosure.


reasoning: The paragraph describes the company’s internal cybersecurity program and governance structures (councils/committees) used to manage cybersecurity risk and incident response within its risk management process, rather than an actual incident or primarily third-party controls.


reasoning: The paragraph describes the company’s internal cybersecurity risk mitigation activities (defense approach, vulnerability patching) and its own incident response/disaster recovery planning, which are internal risk management processes rather than an incident or governance/strategy disclosure.


reasoning: The paragraph describes internal use of third-party service providers as part of evaluating the effectiveness of the company’s cybersecurity program, including tabletop exercises. It does not name specific providers, programs, standards, roles, or dates, so it is generic boilerplate.


reasoning: The paragraph explicitly assigns roles in the cybersecurity risk management program to the Board of Directors alongside named cyber-related management roles, making board oversight central. It also names the CIO and Director of IT, which are specific cybersecurity/IT titles.


reasoning: The paragraph describes generic internal processes for risk assessment and mitigation and mentions a third-party security program, but it contains no firm-specific roles, dates, named programs/products/tools, or quantified external verifiable facts.


reasoning: The paragraph describes the company’s general technical safeguards as part of its cybersecurity approach, but it contains no board/role, incident, named program, dates, or firm-specific identifiers.


reasoning: The paragraph describes the company’s cybersecurity program and internal risk management practices (monitoring, patching, access controls, segmentation, and audits) but includes no incident narrative and no firm-specific details. It contains no named roles/teams, dates, tools/products, standards, or other concrete identifiers that would make it more than boilerplate.


reasoning: The paragraph describes the company’s ERM process and how cybersecurity incidents are treated as key risks, including mitigation via organizational structures and response plans—an internal risk management topic. It contains no named cybersecurity roles, committees, dates, tools, or standards, so it is not firm-specific.


reasoning: The paragraph describes Teladoc Health’s own cybersecurity risk assessment and management approach (program, policies/controls, internal/external assessments) rather than an incident. It also references specific certifications/compliance (HITRUST, SOC 2 Type II), making it more than generic, though it does not provide two hard verifiable external facts like dates or named vendors.


reasoning: The paragraph’s primary focus is the responsibilities of the company’s Head of Cybersecurity in monitoring and reporting on cybersecurity incidents, with board/committee notification described as a downstream step.


reasoning: The paragraph describes the company’s own cybersecurity monitoring/testing approach (audits, vulnerability/penetration testing, internal patching) and related operational activities, including use of external support as a supplement to internal controls.


reasoning: This paragraph is forward-looking boilerplate stating the company is not aware of material cyber-attacks and that it cannot eliminate all risks, with a cross-reference to Item 1A. It contains no incident narrative and no cybersecurity-specific roles, programs, dates, standards, or other firm-specific facts.


reasoning: The paragraph centers on management responsibilities and qualifications, specifically describing the Fund’s CCO oversight role and reliance on Fidelity’s CISO and staff expertise, including experience and tenure.


reasoning: The paragraph describes how the company manages vendor procurement/contracting via due diligence and contract provisions. It contains no named committees/roles, specific vendors, standards, products, or dates, so it is generic.


reasoning: The paragraph focuses on Berkshire’s reliance on third-party service providers and monitoring the cyber-attack risk posed by those providers, which is central to the disclosure. No named roles, tools, dates, standards, or other firm-unique verifiable details are provided.


reasoning: The paragraph describes AAON’s cybersecurity testing/measurement activities and ongoing support (penetration testing, incident response experts) as part of its own program, rather than focusing on a central vendor security oversight requirement.


reasoning: The paragraph describes the Board’s Audit Committee’s responsibility and reporting interactions for cybersecurity oversight, including updates tied to a named incident response plan.


reasoning: The paragraph centers on overseeing external/in-scope vendors by reviewing service organizational controls (SOC) reports and using third-party testing to assess security weaknesses, which is best categorized as third-party risk management.


reasoning: The paragraph identifies a management cybersecurity role (CIO) and describes reporting/leadership responsibilities for the company’s information security program.


reasoning: The paragraph describes a named board-level committee (Cyber Security Subcommittee) performing an initial assessment of a potential cybersecurity incident and escalating to executive members, which is classic board/committee oversight.


reasoning: The paragraph mentions a cybersecurity-related management presentation by a named IT leadership role, but it relies on generic board/committee and reporting language without any firm-unique cybersecurity program or additional verifiable specifics. The presence of the Senior Director of Information Technology points toward Management Role, though most details are boilerplate.


reasoning: The paragraph identifies cybersecurity-related management roles (SVP/IT Manager and ISO) and describes the ISO’s qualifications and experience, making it management-focused rather than incident or process focused.


reasoning: The paragraph describes CELESTICA’s internal cyber incident response plan and escalation/governance workflow (roles, reporting, containment, materiality and notification triggers), not a specific past incident. It therefore fits Risk Management Process rather than Incident Disclosure.


reasoning: The paragraph is focused on the company’s own cybersecurity risk management program (risk assessments, controls, program effectiveness) and how it operates, with third-party risk as a component of that internal program rather than the central topic.


reasoning: The paragraph describes the Company’s general cybersecurity risk management activities (policies/programs/controls, monitoring, third-party risk assessment, training) but provides no firm-specific or verifiable details such as named roles, programs, dates, tools, standards, or quantified facts.


reasoning: The paragraph centers on a named management role (“VP of IT and Facilities”) and describes that person’s responsibilities for cybersecurity-related activities.


reasoning: The paragraph describes the company’s intended cybersecurity risk assessment elements (identification, likelihood/damage, sufficiency of safeguards, implementing safeguards) as an internal process. It contains no firm-specific roles, programs, dates, tools, or standards.


reasoning: The paragraph describes the Cybersecurity Council’s oversight role—providing information to senior management and ultimately the Board, including escalation—so it is board governance focused. It also includes firm-specific governance details (Cybersecurity Council, named escalation/incident response practice, and a quantified meeting cadence).


reasoning: The paragraph describes board/committee oversight and reporting/notification cadence for cybersecurity risk, but it uses only generic entities (Audit Committee, Board, management) and no cybersecurity-specific roles, named committees, dates, frameworks, or other firm-specific details.


reasoning: The paragraph is primarily about the CISO’s qualifications, responsibilities, and reporting/oversight structure, with only limited governance context (COO on the Risk Committee).


reasoning: The paragraph describes internal plans and processes (awareness/training, policy updates, and testing security control effectiveness). It contains no cybersecurity-specific roles, named programs with unique identifiers, dates, frameworks, or other firm-verifiable details.


reasoning: The paragraph describes the company’s internal security risk management processes (monitoring, backup/recoverability, physical protection mechanisms, and internal review of third-party/cloud services). It does not include named roles/teams, specific tools, dates, or standards that would make the disclosure firm-specific or quantified-verifiable.


reasoning: The paragraph describes the company’s own cybersecurity activities (monitoring threats, using threat intelligence/tools, mitigating risks) rather than an incident, board oversight, management roles, or third-party/vendor governance.


reasoning: The paragraph’s grammatical subject is the CISO and describes how the CISO delivers updates, interacts with the IOC, and relies on a specific cybersecurity/risk/compliance team for incident-related activities.


reasoning: The paragraph states that executive management is responsible for overseeing cybersecurity strategy, but it does not name any specific cyber role, committee, or internal program. It is therefore treated as management oversight without firm-specific details.


reasoning: The paragraph describes a board committee (Technology Committee) performing oversight responsibilities for technology strategy and security/cyber-related risks, making it board-governance-focused.


reasoning: The paragraph is largely forward-looking boilerplate about potential cybersecurity risks and includes no named incidents, systems, roles, frameworks, dates (aside from a truncated phrase), or other firm-specific details.


reasoning: The paragraph describes the company’s cybersecurity approach (monitor/detect/analyze/mitigate/respond) and related preparedness testing/exercises. It does not provide incident details or any named roles/tools/frameworks, so the content is treated as generic rather than firm-specific.


reasoning: The paragraph describes the company’s internal incident detection and response procedures (policy-driven review/triage and escalation), which is a risk management process. It does not narrate a specific incident occurrence, so it is not incident disclosure.


reasoning: The paragraph centers on the Board's oversight of cybersecurity risks, including presentations, incident reporting, and annual discussions, with the Board as the primary grammatical subject. No specific facts from the ✓ IS list or named standards are present, resulting in Generic Boilerplate specificity.

provider: x-ai


reasoning: The paragraph describes the company's internal processes for assessing, identifying, and managing cybersecurity risks, including integration into enterprise risk management, which aligns with Risk Management Process. Mention of third-party providers is a minor component within these internal processes, not the central topic.


reasoning: The paragraph describes the company's internal multi-stakeholder team composition and processes for identifying, assessing, and managing cybersecurity risks through monitoring and assessments, which fits Risk Management Process. Vendors are mentioned as components of the internal process, not the central topic.


reasoning: The paragraph describes general cybersecurity risks, lack of significant security investments, and a standalone materiality conclusion that threats have not materially affected the company, aligning with Strategy Integration for materiality assessments without incident narrative. No qualifying specific facts from the ✓ IS list or named standards present, resulting in Generic Boilerplate.


reasoning: Paragraph states that cybersecurity risks have not materially affected the company to date and cross-references risk factors, qualifying as a standalone materiality conclusion without incident narrative per tiebreakers. No substantive disclosure on processes, incidents, or governance.


reasoning: The paragraph describes the company's risk assessment processes, including engaging third-party service providers to assist in designing, implementing, monitoring, and testing cybersecurity safeguards, with vendors mentioned as a component of internal processes rather than the central topic. Requirements on vendors are part of this internal oversight, aligning with Risk Management Process per tiebreakers.


reasoning: This paragraph is a cross-reference to the risk factors section (Item 1A) and quotes generic boilerplate language about potential cybersecurity risks and consequences, providing no substantive disclosure on governance, processes, incidents, or strategy.


reasoning: The paragraph describes the company's internal ERM process, including annual risk assessments, quarterly monitoring, and integration of cybersecurity as one of 12 risk categories, which aligns with Risk Management Process as the focus on own internal processes. Board reporting is mentioned briefly but is not the main subject.


reasoning: The paragraph describes the Audit Committee's oversight of cybersecurity risks, including receiving reports from the ERM Committee, CIO, and VP Infrastructure, with the board committee as the grammatical subject, fitting Board Governance. It contains firm-specific elements like named non-generic ERM Committee and cybersecurity-specific roles (CIO, VP Infrastructure), but lacks two or more hard verifiable facts for higher specificity.


reasoning: The paragraph details the company's own internal Information Security programs aligned to recognized frameworks (ISO and NIST) for assessing, identifying, and managing cybersecurity risks, which fits Risk Management Process as the central topic of internal processes and framework adoption.


reasoning: The paragraph focuses on the Information Security Officer (ISO)'s role, qualifications, reporting line to the CRO, and oversight responsibilities, making management roles the grammatical subject and central topic. It contains firm-specific details like the named ISO role and quantified experience years, but only one hard verifiable fact, so Firm-Specific.


reasoning: The paragraph centers on the Audit Committee's oversight of cybersecurity risk management, including reviews and discussions with management like the CIO and CISO, and reporting to the Board, making Board Governance the clear fit as the committee is the grammatical subject. It includes cybersecurity-specific roles (CIO, CISO) as firm-specific facts, but no hard verifiable facts like dates or named firms, resulting in Firm-Specific.


reasoning: The paragraph primarily describes the company's own risk management and ERM processes, including framework adoption (FFIEC), program integration, periodic reviews, and cross-functional approach to cybersecurity, fitting Risk Management Process. CISO and CRO roles with reporting lines are mentioned but as components of the internal processes, not the central focus.


reasoning: The paragraph centers on the Board of Directors' responsibility for cybersecurity risk oversight, assessments, reviews, and interactions with the HSE Director, aligning with Board Governance criteria where the board is the primary grammatical subject. The HSE Director's role and qualifications are mentioned as part of this oversight structure.


reasoning: The paragraph details the company's own internal processes for incident response planning, risk assessments, monitoring, mitigation measures, training, and testing such as vulnerability scanning and penetration testing, which aligns with Risk Management Process. No qualifying specific facts from the ✓ IS list (e.g., named roles, dates, firms, or unique programs) or named standards are present, resulting in Generic Boilerplate.


reasoning: The paragraph focuses on the board and Audit Committee's oversight of cybersecurity risks, including delegation, reporting cadences, and topics covered in reports, aligning directly with Board Governance criteria where board/committee is the grammatical subject.


reasoning: The paragraph primarily details management roles including the VP for IT Data Security reporting to the CTO, their responsibilities, and a management-level Cybersecurity Committee, with board oversight mentioned only briefly at the start. Per tiebreakers, brief board mention with management roles as main focus assigns to Management Role.


reasoning: Paragraph provides standalone materiality conclusions stating no prior incidents have materially affected the company and future threats are reasonably likely to have material impact, without any incident narrative or description. Includes forward-looking disclaimer and cross-reference, but main focus aligns with Strategy Integration per tiebreakers for materiality assessments.


reasoning: The paragraph details the Trustee's own cyber risk management program, including identification, assessment, mitigation, protocols like passwords and training, integration with overall risk management, and annual third-party assessments, which matches Risk Management Process as it focuses on internal processes. No qualifying specific facts from the ✓ IS list (e.g., no named roles, committees, dates, firms, or standards) and no named recognized frameworks, resulting in Generic Boilerplate.


reasoning: The paragraph describes the company's internal risk identification, assessment, monitoring, threat evaluation, and control implementation processes led by the InfoSec team, which aligns with Risk Management Process. Third-party risks are mentioned only as a component of these internal processes, not as the central topic.


reasoning: The paragraph details the company's internal processes for cybersecurity risk management, including NIST framework adoption, dedicated team assessments, monitoring, penetration testing, cross-departmental integration, and policy incorporation, which aligns with Risk Management Process; third-party involvement is a supporting element, not central. It includes a specific cross-functional departmental composition as a firm-unique fact, making it Firm-Specific, with NIST naming alone insufficient for higher levels.


reasoning: The paragraph focuses on the Audit Committee's oversight of cybersecurity risks, receipt of reports from management, and reporting to the Board, with the board/committee as the grammatical subject, fitting Board Governance. No specific facts from the ✓ IS list are present; Audit Committee, Board, quarterly/periodic cadences are all on the ✗ NOT list, confirming Generic Boilerplate.


reasoning: The paragraph focuses on the board of directors and audit committee's oversight of cybersecurity risks, incidents, and compliance, with the board/committee as the primary grammatical subjects; management roles are mentioned secondarily in the context of reporting to oversight bodies.


reasoning: The paragraph details the company's internal escalation and response processes for cybersecurity threats and incidents, including notifications, risk assessments, and reporting requirements, making 'Risk Management Process' the most applicable category. It contains multiple firm-specific facts like named cybersecurity roles, committees, and an internal program, but lacks two or more strictly verifiable hard facts (e.g., dates, dollars, headcounts) for higher specificity.


reasoning: The paragraph describes the company's internal cybersecurity processes, including incident response planning, tabletop exercises, business continuity plans, employee training, and a risk-based approach to security controls, which aligns with Risk Management Process. No specific facts from the ✓ IS list are present, and no named frameworks qualify it for higher specificity.


reasoning: The paragraph describes the company's internal processes for cybersecurity incident identification, response, monitoring tools, and periodic testing, which aligns with Risk Management Process. No board, management roles, incidents, or third-party focus as central topic; third-party experts are a minor component of internal processes.


reasoning: The paragraph describes the company's internal cybersecurity program, including vulnerability management, monitoring via a managed service provider, and an incident response plan aligned with NIST, focusing on their own processes rather than board oversight or third-party risks centrally. NIST is a named framework qualifying for Sector-Adapted, with no firm-specific facts like named roles, dates, or unique programs.


reasoning: The paragraph focuses on the Board, Audit Committee, and Cybersecurity Subcommittee's oversight responsibilities, delegation, meetings, and reporting on cybersecurity risks, making board/committee oversight the central grammatical subject. It qualifies as Firm-Specific due to the named non-generic committee and specific establishment year, with only one hard verifiable fact (date) preventing Quantified-Verifiable.


reasoning: The paragraph focuses on the CDIO/CISO's identification, qualifications, reporting lines, team oversight, and brief committee interactions, making 'Management Role' the primary category as management roles are the grammatical subjects. Specificity reaches Quantified-Verifiable due to multiple hard facts: specific date (2021), named firms (Comerica Bank, etc.), named role (CISO), and named committee (TCRC).


reasoning: The paragraph focuses on the Board of Directors and Audit Committee overseeing cybersecurity risks, receiving quarterly reports on incidents and vulnerabilities, with reporting flowing through CEO and CFO, fitting Board Governance as the board/committee is the grammatical subject. No qualifying specific facts from the ✓ IS list (e.g., cybersecurity-specific roles, named non-generic committees, dates, named firms); all elements like Audit Committee, CEO/CFO, quarterly reports, and unnamed MSP are on the ✗ NOT list, making it Generic Boilerplate.


reasoning: The paragraph describes the Board's primary responsibility for cybersecurity risk oversight, the Audit Committee's review role, and the formation of a specific Cybersecurity Risk Subcommittee with expertise requirements, fitting Board Governance as the board and committees are the grammatical subjects.


reasoning: The paragraph details the company's internal processes for reviewing assessments, tabletop exercises, metrics, and incident response planning, with management (CIO) leading and reporting to committees, making Risk Management Process the best fit over Management Role or Board Governance.


reasoning: The paragraph centrally focuses on assessing third-party providers' security standards, imposing contractual security requirements on vendors (e.g., notification protocols, encryption, data disposal), ensuring insurance coverage, and leveraging third-party consultants for penetration studies, which aligns with Third-Party Risk rather than internal processes. No specific facts from the ✓ IS list are present, confirming Generic Boilerplate specificity.


reasoning: The paragraph describes the company's internal policies, procedures, risk assessments, control development based on frameworks, and risk prioritization processes, which aligns with Risk Management Process as the company's own internal processes are the central topic. Third-party involvement is mentioned only as a component of assessments, not as central vendor oversight.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, including policies, procedures like vulnerability management, penetration testing, and framework adoption, with third-party oversight as one component. It names the NIST Cybersecurity Framework but lacks firm-specific details like roles, dates, or named entities.


reasoning: The paragraph details the company's internal information security program structured around the NIST CSF functions, incident detection/response processes, operational plans, reviews, and exercises, aligning with Risk Management Process for framework adoption and IR planning. It names the NIST CSF framework but lacks any firm-specific facts from the ✓ IS list, qualifying as Sector-Adapted.


reasoning: The paragraph emphasizes the Board of Directors and Audit Committee's active involvement in oversight of the cybersecurity program, making them the grammatical subjects, which aligns with Board Governance. It mentions the NIST Cybersecurity Framework, qualifying it as Sector-Adapted, with no firm-specific facts from the ✓ IS list.


reasoning: The paragraph primarily describes the company's management roles in cybersecurity, including the Director of IT Infrastructure & Security's leadership, qualifications, team expertise, and reporting lines to executives and the Board. While internal processes like the CIRP are mentioned, the grammatical subjects and focus are on specific management positions and structure, fitting Management Role over Risk Management Process.


reasoning: The paragraph describes the company's internal training programs, including security awareness, phishing simulations, tabletop exercises, and incident response tests, which are components of their risk management processes for cybersecurity threats. No specific facts, named standards, or unique details elevate it beyond generic boilerplate.


reasoning: The paragraph centers on the CISO as the grammatical subject, detailing their qualifications, experience, education, and specific responsibilities in cybersecurity, which aligns with Management Role. No board oversight or internal processes are the primary focus.


reasoning: The paragraph provides a standalone materiality assessment stating no material breaches or significant expenses to date and potential adverse impacts on business and finances, with a cross-reference to risk factors, fitting Strategy Integration; incident response practices are mentioned generically without specifics. No qualifying specific facts from the ✓ IS list (CEO/CFO are generic C-suite, MSP is unnamed), resulting in Generic Boilerplate.


reasoning: The paragraph focuses on the Information Security team's leadership by the CISO, their certifications, the CISO's experience and education, and reporting lines to CITO and CEO, centering on management roles and expertise. Multiple hard facts including quantified experience (17 years) and named certifications exceed the threshold for Quantified-Verifiable.


reasoning: This paragraph provides a detailed narrative of a specific cybersecurity incident, including the date (October 2023), scope (unauthorized access and download of user information from 23andMe.com accounts), and response actions (system enhancements, password resets, two-factor verification), directly matching the Incident Disclosure category criteria.


reasoning: The paragraph focuses on the Board's overall responsibility for enterprise risk management, delegation to committees, and the Audit Committee's oversight of cybersecurity risks, including reviews of mitigation plans, reports from management, and incident updates, with the Board and its committees as the primary grammatical subjects.


reasoning: The paragraph describes the company's internal risk management processes through the ERM committee's oversight of policies, assessments, and remediation plans, including cybersecurity inputs from the CISO and CDO. This fits Risk Management Process as the central topic on own internal processes, not board oversight or management roles primarily.


reasoning: The paragraph concludes that no cybersecurity threats in fiscal 2025 materially affected or are anticipated to affect business strategy, results of operations, or financial condition, which is a standalone materiality assessment fitting Strategy Integration per tiebreakers. It includes one firm-specific date reference ('fiscal 2025'), qualifying as Firm-Specific with no named frameworks or additional verifiable facts.


reasoning: The paragraph describes the company's own cybersecurity risk management program, including framework adoption (NIST Cybersecurity Framework and Sarbanes Oxley) for identifying, assessing, and managing risks, which fits Risk Management Process. No board, management roles, incidents, vendors, or strategy integration is mentioned.


reasoning: Paragraph briefly mentions a past cybersecurity incident with a specific date but focuses primarily on its immateriality to business operations and financial condition, plus forward-looking disclaimers, fitting Strategy Integration per tiebreakers for brief incident mention + materiality conclusion as main point.


reasoning: This paragraph details the company's internal cybersecurity program, including framework adoption (NIST), certification (ISO 27001), compliance with regulations (GDPR), and specific controls like monitoring, incident response, and penetration testing, making Risk Management Process the best fit. The ISO 27001 certification claim qualifies as a firm-specific fact, elevating beyond Sector-Adapted.


reasoning: The paragraph centrally describes oversight of third-party providers, including contractual expectations via the Sustainable Purchasing Charter, pre-engagement assessments, and ongoing monitoring by the Information Security Department, which aligns with Third-Party Risk per guidelines (requirements imposed on vendors). Employee training and insurance are minor additions, not shifting the primary focus.


reasoning: The paragraph details the company's internal processes for cybersecurity assessments, vulnerability management, patch management, disaster recovery, business continuity, and threat monitoring by its technology team and operational risk management group, which aligns with Risk Management Process. No qualifying specific facts from the ✓ IS list are present (e.g., no named roles, dates, firms, or frameworks), and mentions of an unnamed external firm do not qualify, making it Generic Boilerplate.


reasoning: The bulk of the paragraph discusses past immaterial cybersecurity incidents, no current material incidents, and management's view that future material impacts are not reasonably likely, aligning with materiality assessments and financial impact focus per tiebreakers for brief incident mentions without narrative. Board oversight is briefly noted at the start but is not the central topic.


reasoning: This paragraph assesses the material impact of cybersecurity risks, stating no material past incidents, immaterial expenses, and no known risks likely to materially affect the business, which aligns with standalone materiality conclusions under Strategy Integration. It includes forward-looking disclaimers and a cross-reference, with no substantive process, incident, or governance details.


reasoning: This paragraph describes the company's own processes for assessing, identifying, and managing cybersecurity risks through IT systems, aligning with the Risk Management Process category as it focuses on internal processes without referencing board oversight, specific management roles, incidents, or third-party risks centrally.


reasoning: The paragraph details the company's internal processes for evaluating and testing information security through external experts, audits, threat assessments, training, and policy refinement by senior management, which aligns with Risk Management Process; external experts are a component of these processes, not the central vendor oversight topic. No qualifying specific facts from the ✓ IS list (no named roles, committees, dates, firms, numbers, or programs), resulting in Generic Boilerplate.


reasoning: This paragraph consists of forward-looking boilerplate disclaimers about general cybersecurity risks, the increasing sophistication of threats, and the potential insufficiency of controls, with a cross-reference to Risk Factors, providing no substantive disclosure on governance, processes, incidents, or strategy.


reasoning: The paragraph focuses on the company's own internal processes for assessing and managing cybersecurity risks, including alignment with the NIST Cybersecurity Framework and integration into the ERM program. Brief mention of management and Board recognition does not make them the grammatical subject; processes are central.


reasoning: The paragraph focuses on the Board of Directors and Audit Committee's oversight of cybersecurity risks, including specific meeting cadences with the CSO, aligning directly with Board Governance criteria where the board or committee is the grammatical subject.


reasoning: This paragraph details a real cybersecurity incident, including the detection date, unauthorized access by a third party, response actions like initiating protocols and containment measures, and business disruption, directly matching Incident Disclosure criteria. It includes one verifiable specific date, qualifying as Firm-Specific with no additional hard facts for higher specificity.


reasoning: The paragraph details the company's intended internal risk management program for cybersecurity, including identification, assessment, monitoring, and integration into overall processes, with board oversight mentioned briefly; third-party consultant is a component of internal processes, not central. No qualifying specific facts from the ✓ IS list (e.g., no named roles, dates, firms, or unique programs) and no named standards.


reasoning: This paragraph details a specific cybersecurity incident, including the date of detection, unauthorized access, response actions (incident procedure activation, external investigation, law enforcement notification), and operational disruptions/scope, directly matching Incident Disclosure criteria.


reasoning: The paragraph details a specific cybersecurity incident including the date, access method, data affected, response actions, and scope, matching Incident Disclosure criteria. It contains a specific date and named system, providing two hard verifiable facts for Quantified-Verifiable specificity.


reasoning: The paragraph centers on the identification, qualifications, responsibilities, reporting lines, and supporting team/committee for the VP of IT (acting as Information Security Officer), fitting Management Role; brief Audit Committee mention does not shift focus to Board Governance.


reasoning: The paragraph describes a specific cybersecurity incident including the date it was determined (March 10, 2024), unauthorized access by a third party, response actions (incident response protocols, containment), scope (portions of information environment), and operational impact (some disruption but operations continued), fitting Incident Disclosure per tiebreakers.


reasoning: The paragraph focuses on the CISO's leadership of the Information Security Council, the CISO's extensive experience, and specific certifications, aligning directly with Management Role criteria for identifying and qualifying cybersecurity management positions. It does not describe board oversight, internal risk processes, or incidents.


reasoning: This paragraph describes a specific cybersecurity incident including timeline (late November 2023), scope (small percentage of employee emails including cybersecurity and legal functions), exfiltration, and ongoing access to source code repositories, directly matching Incident Disclosure criteria with real event details.


reasoning: This paragraph describes a specific cybersecurity incident including the detection date, unauthorized access details, response actions (activating incident response procedure, engaging external experts, notifying law enforcement), and scope/impact on IT systems and business applications, directly matching Incident Disclosure criteria.


reasoning: This paragraph describes a specific cybersecurity incident including dates of detection and access, scope of data exfiltrated (client info, PII, admin/user data, small percentage of user accounts), threat actor identification, and response actions like incident response activation and notifications to law enforcement/regulators, directly matching Incident Disclosure criteria.


reasoning: The paragraph primarily identifies and details the qualifications, experience, reporting lines, and background of the CISO and management team, fitting 'Management Role' as the grammatical subjects are management roles. Board oversight is mentioned briefly but not central.


reasoning: This paragraph details the cybersecurity incident's scope (impacted IT systems, billing and label making functions), data effects (stolen or destroyed), and response actions (removal of third party, restoration via contingency plans and backups), directly matching Incident Disclosure criteria. No qualifying specific facts from the ✓ IS list (no dates, roles, named entities, quantifications, or standards), confirming Generic Boilerplate specificity.


reasoning: This paragraph provides a detailed narrative of a specific cybersecurity incident, including detection and access dates, scope of exfiltration (small percentage of employee emails including senior leadership and functions like cybersecurity and legal), response actions (access removal, investigation, notifications), and initial impact assessment, directly matching Incident Disclosure criteria.


reasoning: Paragraph details the scope of data obtained by a former employee (names, phone numbers, addresses, emails, order histories for up to 33 million accounts), what was not compromised, ongoing investigation, and regulatory involvement, directly describing an actual incident. One specific quantified fact (33 million accounts) qualifies as Firm-Specific, with no second hard verifiable fact or named standards for higher specificity.


reasoning: This paragraph is a forward-looking statement disclaimer with vague references to 'the Incident' but no substantive cybersecurity disclosure, fitting None/Other as specified for forward-looking disclaimers and cross-references.


reasoning: Paragraph describes a real cybersecurity incident with specific dates, the event (website defacement by bad actor), scope (company's web address), and response actions (restored from backups, took site down, reviewed platform), directly matching Incident Disclosure criteria.


reasoning: Paragraph assesses materiality and financial impacts of 'the Incident' (business operations, results of operations, expected costs) without any incident narrative, dates, scope, or response details, aligning with Strategy Integration per tiebreakers. No verifiable facts, named standards, roles, or firm-specific details qualify it as higher than Generic Boilerplate.


reasoning: Paragraph details the scope, content, and nature of data records affected in a cybersecurity incident, including customer interactions and cell site IDs, without financial or materiality focus, aligning with Incident Disclosure for descriptions of affected data/systems in a real event. No facts qualify under the ✓ IS list (no specific dates, named roles/committees/programs/products/firms, quantified metrics, or certifications), resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the incident narrative, including response actions by the third-party provider, scope limited to their environment, types of accessed personal information (name, DOB, SSN/TIN), lack of misuse evidence, customer notifications, and current inability to quantify material impact, making it a clear Incident Disclosure per the criteria for actual event descriptions. No qualifying specific facts from the ✓ IS list (no dates, named roles, firms, numbers, etc.), and no named standards, resulting in Generic Boilerplate specificity.


reasoning: Paragraph details a specific cybersecurity incident including the date it occurred, actions by threat actors (access, encryption, exfiltration), response efforts (remediation, third-party vendors), and operational impacts, matching Incident Disclosure criteria with a real event narrative.


reasoning: The paragraph describes a specific cybersecurity incident, including unauthorized access by a threat actor, temporary operational disruptions, data exfiltration, and response actions like investigation and notifications, matching the Incident Disclosure category per tiebreakers for incident narratives. No specific facts from the ✓ IS list (e.g., dates, named roles, firms, or quantified details) are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes the details of a cybersecurity incident, including the exfiltration of files containing personal information, engagement of experts to evaluate the data, ongoing analysis, client notifications, and confirmation that data has not been publicly released, fitting Incident Disclosure as it references a real event with narrative, scope, and response actions. No specific facts from the ✓ IS list are present, such as named roles, dates, firms, or quantified metrics, resulting in Generic Boilerplate specificity.


reasoning: The paragraph discusses financial impacts, estimated remediation costs, and materiality (no material operational impacts) of 'the Incident' without any narrative description of the event, dates, scope, or response actions, aligning with Strategy Integration per tiebreakers. It contains one verifiable quantified fact (dollar range), qualifying as Firm-Specific but not Quantified-Verifiable due to lacking a second hard fact.


reasoning: Paragraph describes a specific cybersecurity incident including date, detection of unauthorized access, encryption of systems, data theft (personal data), response actions (containment, investigation, incident response plan activation, system shutdowns), and operational impacts (disrupted business operations, e-commerce fulfillment issues). This matches Incident Disclosure as it provides a narrative of what happened, when, scope, and response, rather than just financial/materiality conclusions.


reasoning: Paragraph describes a specific cybersecurity incident including unauthorized access to systems, exfiltration of sensitive information (images of video meetings and screens), extortion threat, response actions (closing access point, bolstering defenses), and operational/financial impacts, directly matching Incident Disclosure criteria. Contains one verifiable specific date reference ('first quarter of fiscal 2026'), qualifying as Firm-Specific with no additional hard facts for higher specificity.


reasoning: This paragraph describes the scope, impact (website offline, delayed communications, no material effect on IP or customer data), and ongoing response to a specific cybersecurity incident involving unauthorized action by a former executive officer, fitting Incident Disclosure. No specific facts from the ✓ IS list or hard verifiable elements are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph details a specific cybersecurity incident including dates of notification and data access, threat actor identification, scope of affected mailboxes, and response actions, directly matching Incident Disclosure criteria with a narrative of what happened.


reasoning: This paragraph details a real cybersecurity incident with a specific date, unauthorized access description, response actions (incident response protocols, containment), and operational impact (temporary interruption), directly matching Incident Disclosure criteria. It includes one verifiable fact (specific date), making it Firm-Specific but not Quantified-Verifiable due to lacking a second hard fact like a named firm or dollar amount.


reasoning: This paragraph details operational disruptions, response actions (system shutdown, resumption of inventory replenishment and order fulfillment), and recovery status from a specific cyber incident, fitting Incident Disclosure as it describes scope and impacts of a real event. No qualifying specific facts from the ✓ IS list (no dates, roles, named entities, numbers, etc.), resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses on the financial and operational impacts and materiality assessment of the Incident on Q2 2024 results without describing the incident event itself, aligning with Strategy Integration per tiebreakers. It includes two specific dates (June 19, 2024, and June 30, 2024) as hard verifiable facts, meeting the Quantified-Verifiable threshold.


reasoning: This paragraph describes a real cybersecurity incident with specific dates, affected systems (website, email, IT), cause (former executive action), and response steps, directly matching Incident Disclosure criteria. Two specific dates qualify it as Quantified-Verifiable.


reasoning: This paragraph describes a specific cybersecurity incident including detection date (December 13, 2023), response actions (investigation, incident response plan activation, system shutdown), scope (portion of IT systems), and ejection date (December 15, 2023), directly matching Incident Disclosure criteria with a real event narrative.


reasoning: The paragraph discusses the materiality assessment of the cybersecurity incident on business operations, financial condition, results of operations, and insurance coverage without any incident narrative or description of the event itself, aligning with Strategy Integration per tiebreakers. No verifiable facts, named standards, roles, or specifics are present, confirming Generic Boilerplate.


reasoning: Paragraph assesses materiality and financial impact of an incident without describing the event, aligning with Strategy Integration per tiebreakers for financial/materiality discussions lacking incident narrative. Contains three specific dates as hard verifiable facts, meeting Quantified-Verifiable threshold.


reasoning: The paragraph discusses remediation costs, insurance recoveries, and materiality assessments related to 'the cybersecurity incident' without describing the event itself, aligning with Strategy Integration per tiebreakers for financial/insurance/materiality focus without incident narrative. No specific facts from the ✓ IS list are present, confirming Generic Boilerplate specificity.


reasoning: The paragraph focuses on the financial and operational impacts, expected costs, insurance coverage, and materiality assessments related to an incident without describing the event itself, fitting Strategy Integration per tiebreakers. No specific facts from the ✓ IS list or hard verifiable elements are present, confirming Generic Boilerplate specificity.


reasoning: The paragraph details the incident's response actions (restored, contained, remediated), operational impacts (communications, shipping, manufacturing), scope of affected functions, and financial costs, fitting Incident Disclosure as it describes the event's scope and response rather than only financial/materiality aspects.


reasoning: Paragraph details operational impacts, response actions (halting operations, remediation, deploying infrastructure, engaging experts), and restoration timeline of a specific cybersecurity incident, fitting Incident Disclosure. Contains one firm-specific fact (mid-June restoration) qualifying as Firm-Specific, with no named standards or two+ hard verifiable facts.


reasoning: This paragraph provides a narrative of a specific ransomware incident, including dates (August 16 and 21, 2025), origin via third-party vulnerability, scope to internal IT systems, and response actions such as engaging experts and improving systems, directly matching Incident Disclosure criteria.


reasoning: This paragraph details a real cybersecurity incident, including the detection date, unauthorized occurrences on IT systems, encryption of data files, response actions like activating the incident response plan and shutting down systems, and specific operational impacts such as halted manufacturing and affected order fulfillment.


reasoning: This paragraph describes a specific cybersecurity incident including dates (June 19 and 21, 2024), scope of affected systems (DMS, CRM, etc.), and response status (partial restoration, ongoing investigation), fitting Incident Disclosure. It references a real event with narrative details rather than just financial or materiality impacts.


reasoning: Paragraph describes a specific cybersecurity incident including the date it occurred at CDK, affected systems (DMS, CRM), restoration status, and operational disruptions, fitting Incident Disclosure per tiebreakers for event narrative with dates, scope, and response.


reasoning: The paragraph details financial arrangements (waiver of interest and lease payments providing $3.7M liquidity) to fund cybersecurity incident remediation and operations, without any incident narrative, scope, or response description, aligning with Strategy Integration for business/financial impact. Multiple hard verifiable facts (specific dates, dollar amount, named third-party firms) exceed the threshold for Quantified-Verifiable.


reasoning: This paragraph describes a specific cybersecurity incident, including the detection date (June 30, 2024), unauthorized access to systems, and response actions like initiating protocols and investigation, directly matching Incident Disclosure criteria with event narrative.


reasoning: Paragraph details financial and business impacts (delayed transactions, revenue shifts from Q4 2023 to Q1 2024, lost revenue, one-time expenses) of 'the incident' without any narrative of the event itself, matching Strategy Integration per tiebreakers. Two specific quarterly dates qualify as hard verifiable facts for Quantified-Verifiable.


reasoning: This paragraph details the detection of a cybersecurity incident on a specific date, response actions including network isolation and business disruption, ongoing investigation, engagement of a firm, and notifications, directly matching Incident Disclosure criteria for describing what happened, when, scope, and response to a real event.


reasoning: The paragraph describes an actual cybersecurity incident including unauthorized access to IT systems, detection, response actions like activating the incident response plan, taking systems offline, engaging external experts, notifying law enforcement, and halting production operations, matching Incident Disclosure criteria. No specific dates, named firms, products, roles, or other firm-unique facts from the ✓ IS list; all details are vague or generic (e.g., 'certain systems', 'leading external cybersecurity experts'), resulting in Generic Boilerplate.