reasoning: The paragraph's grammatical subject is the Audit Committee of the Board of Directors, which is overseeing cybersecurity risk management — squarely fitting Board Governance. The paragraph contains no specific facts: the Audit Committee is a generic committee found at all public companies, 'management team' and 'vCIO' are generic references, and phrases like 'reports' and 'cybersecurity risk management tools' are boilerplate language with no dates, dollar amounts, named third-party firms, or unique identifiers.


content_category: Incident Disclosure

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes an actual cybersecurity incident with specific details about what happened (unauthorized access by a threat actor), when it occurred (August 5-8, 2025), and the scope (may have acquired certain data). While the paragraph also touches on materiality status and cross-references risk factors, the primary content is an incident narrative describing the event itself, not merely its financial impact or the company's processes for managing cyber risk.

provider: minimax

stage: benchmark


content_category: Risk Management Process

reasoning: The paragraph describes the company's own internal policies and processes for protecting IT assets, with cybersecurity providers mentioned as components supporting the internal program rather than as the central topic of vendor oversight. All listed services (vulnerability testing, endpoint protection, incident response, etc.) are generic industry practices that could appear in any company's disclosure, and no named frameworks, tools, or specific identifiers are present.


content_category: Management Role

category_confidence: medium

reasoning: The paragraph describes the general responsibilities of 'management' in cybersecurity oversight (setting objectives, resource allocation, policy development, risk management, incident response, compliance), which aligns with the Management Role category as management is the grammatical subject describing its oversight function. However, it uses only generic 'management' terminology without naming a specific cybersecurity role (CISO, CTO, CIO) or any person-specific details like qualifications, credentials, or tenure.


reasoning: The paragraph describes the company's own internal cybersecurity measures and processes (EDR, SIEM, password vault, MFA), which is the core of Risk Management Process. None of the listed items qualify as specific facts—no named products (only generic categories like 'EDR' and 'SIEM'), no named frameworks, no dates, no headcounts, no dollar amounts, and no named third-party firms. The security controls described (physical security, VPN, MFA, antivirus, password policies, encryption) are standard practices found in virtually any company's disclosure.


reasoning: The paragraph describes the Adviser's internal incident response plan and escalation procedures, which is the company's own risk management process. While it mentions the CISO and board/audit committee as recipients of notifications, the grammatical subject is the Adviser's incident response plan (internal process), not the board's oversight role or the CISO's personal qualifications.


reasoning: The paragraph focuses on the Chief Technology Officer as a person — detailing his qualifications, credentials, career history, tenure, and educational background — making Management Role the appropriate category per the person-vs-function test. It contains multiple hard verifiable facts (specific duration of 30+ years, number of public companies served, named degree field) that an outsider could independently verify.


reasoning: The paragraph describes the company's internal risk management process—specifically how the Risk Management Steering Committee monitors, detects, mitigates, and remediates cybersecurity threats in real time, with reporting to the Audit Committee. The named internal committee (Risk Management Steering Committee) distinguishes this from generic boilerplate.


reasoning: The paragraph describes a phishing scam incident in 2024, the resulting loss, and specific response actions (new procedures and checking accounts), making incident disclosure the primary category. However, it contains no specific verifiable details—no dates beyond the year, no named third parties, no dollar amounts, no quantified scope—placing it at generic boilerplate specificity.


reasoning: The paragraph describes an actual cybersecurity incident in detail—March 2020 ransomware attack, what happened (cybercriminals accessed systems), scope (confidential information stolen), and response actions (isolated, restored operations). While the paragraph concludes with materiality language, the primary content is the incident narrative itself, making Incident Disclosure the correct category. The specific date (March 2020) and incident details provide firm-specific facts, but no named third-party investigators, specific tools, or dollar amounts would allow independent verification by an outsider.


reasoning: The paragraph primarily identifies specific named management roles (CTO, Head of Technology Infrastructure) and their personal qualifications and experience levels, making Management Role the appropriate category per the PERSON-VS-FUNCTION test. The paragraph contains firm-specific identifying facts: named cybersecurity-specific titles (CTO, Head of Technology Infrastructure), specific years of experience (25 years, 20 years), and specific expertise domains (IT risk governance, incident response capabilities) that are unique to this company's disclosure.


content_category: None/Other

reasoning: This paragraph is a general risk acknowledgment explaining WHY the company faces cybersecurity risks (scope of operations, complexity, threat actor attractiveness, third-party usage) rather than describing any actual processes, governance, or incidents. It contains no specific facts—'state-sponsored organizations' is generic, not named entities; 'third-party products, services and components' is an undifferentiated reference—and could appear verbatim in virtually any company's cybersecurity risk disclosure.


reasoning: The paragraph describes ADT's internal risk management processes, including the CISO's responsibilities for risk assessment and the company's specific security tools and procedures. While SecurityScorecard and NIST are named, the primary focus is on the company's own cybersecurity processes rather than vendor oversight requirements or actual incidents. The CISO's presence is functional (what the role does) rather than personal (the person's background), making this Risk Management Process rather than Management Role.


specificity_confidence: medium

reasoning: The paragraph describes specific management roles (CFO, COO, Controller, Director – Finance) and their involvement in cybersecurity communications and threat notification, establishing a reporting structure. However, these are standard business/financial roles rather than cybersecurity-specific titles, and the roles and structure described are generic and widely applicable across companies, yielding Generic Boilerplate specificity.


reasoning: The paragraph describes the company's own internal cybersecurity risk management activities—policies, training programs, testing, and incident response procedures—without reference to any actual incident, board governance, or named management roles. All content is generic language that could appear in any company's filing with no specific dates, named frameworks, third-party firms, or unique identifiers.


reasoning: The paragraph describes an actual cybersecurity incident (detection, network impact, response actions, investigation), which places it in Incident Disclosure rather than Strategy Integration or Risk Management Process. However, the disclosure contains no firm-specific details: no specific dates (only year), no named third parties, no named tools/products, and no granular scope descriptions. The generic phrasing ('thorough investigation,' 'incident response protocols') could appear in any company's disclosure.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes — controls, monitoring, training, and vendor oversight — without mentioning a board, a named individual, an actual incident, or financial materiality. The absence of any named standards, specific dates, named firms, or firm-specific details makes it generic boilerplate.


reasoning: The paragraph describes the company's own internal incident response processes, including the IRT structure, IRP guidance, escalation procedures, and materiality assessment workflows—placing it squarely in Risk Management Process rather than Board Governance (the board is not the grammatical subject) or any other category.


reasoning: The paragraph describes the company's internal cybersecurity program design, employee awareness training, and security exercises—all internal processes without referencing any specific persons, named frameworks, tools, or firm-unique identifiers. It contains only generic security practices (training programs, simulations, attestations) that are standard across disclosures.


reasoning: This paragraph describes an actual cybersecurity incident—a ransomware attack in late May 2023 affecting certain network systems—including narrative details (what happened), temporal specificity (late May 2023), and response actions (investigation, engaging experts, law enforcement involvement, containment and remediation). The single specific fact (late May 2023) elevates it to Firm-Specific, but no named third-party firms, products, or dollar amounts appear to reach Quantified-Verifiable.


reasoning: The paragraph describes the company's internal risk assessment and evaluation processes, with the IT department head working with management to address cybersecurity risks. This describes the company's own processes for managing cyber risk rather than board oversight, an actual incident, or vendor oversight. No specific facts remain after filtering: 'IT department head' does not meet the cybersecurity-specific role threshold (CISO/CTO/CIO), 'CFO' is a generic C-suite title, and 'continuously' and 'following these assessments' are vague cadences without specific dates.


reasoning: This paragraph describes an actual cybersecurity incident with a specific date (January 31, 2022), the target systems (Aurora acquisition systems), response actions taken (isolating systems, taking them offline), and investigation findings (no spread beyond target systems, no critical data accessed). The paragraph clearly describes what happened in a real incident, making it an Incident Disclosure.


reasoning: The paragraph describes the company's own internal cybersecurity processes—policies, risk assessment, monitoring, incident response, and employee training—which are the hallmarks of a risk management program. No board oversight, named executives, vendor oversight, incident narrative, or financial materiality language is present.


reasoning: This paragraph describes the company's own internal information security training and awareness programs, including mandatory training, phishing campaigns, and policy acknowledgments. These are internal processes under the company's control. The training practices described (computer-based training, phishing simulations, security awareness courses) are standard security hygiene found across organizations and contain no named frameworks, specific dates, named tools, or unique identifiers that would elevate specificity beyond generic boilerplate.


reasoning: The paragraph describes the company's own internal cybersecurity risk management framework, detailing technical safeguards (monitoring, vulnerability scans, encryption, access controls) and organizational safeguards (incident response plans, training, risk assessments, policies, insurance) — all of which are the company's own processes. No board governance, named management individuals, third-party vendor oversight requirements, incident narratives, or financial/materiality discussions are present.


reasoning: The paragraph describes the company's own internal cybersecurity processes (security monitoring, enterprise-wide risk assessment program), fitting the 'Risk Management Process' category. It contains no specific facts—no named frameworks, specific dates, dollar amounts, headcounts, named tools, or named third-party firms. All language is generic boilerplate ('comprehensive program,' 'regular oversight,' 'formal, risk-based') that could appear in any company's disclosure.


reasoning: The paragraph describes the company's own internal cybersecurity infrastructure and processes (SOC, threat detection technology, vulnerability scanning, threat hunting programs), with the CISO role serving as the grammatical subject of the team's responsibilities rather than being the focal point of biographical/personnel detail. The CISO is mentioned by function, not by qualification or career background, making this Risk Management Process rather than Management Role.


content_category: Board Governance

reasoning: The grammatical subject is the 'cybersecurity sub-committee,' which functions as a board-level oversight body for cyber risk, consistent with the Board Governance category. However, the paragraph lacks any verifiable hard facts—all details are generic descriptions of committee functions that could appear in any company's filing; the '45 years of combined experience' is an aggregate/soft figure and does not count as a hard verifiable fact per the criteria.


reasoning: The paragraph describes board-level reporting and committee oversight of cybersecurity risk at Morgan Stanley, with the grammatical subjects being management-level committees and their reporting to board committees (Firm Risk Committee, BOTC, MS Board). While it mentions the CIO and Head of Operational Risk, they function as reporters to governance bodies rather than being the central subject. The named committees (Non-Financial Risk Committee, Firm Risk Committee, BOTC) are firm-specific entities that go beyond generic boilerplate.


reasoning: The paragraph focuses on individual qualifications, career history, educational backgrounds, and professional certifications of named cybersecurity management roles (Director Cyber Security, Director Technology Compliance, CIO) and risk management officers (CLO, CFO), making Management Role the appropriate category. The multiple years-of-experience figures, named professional certifications (CISSP, CISA), and prior employer descriptions constitute firm-specific identifying facts about these individuals.


reasoning: The paragraph primarily describes the company's Cybersecurity Program's internal notification and escalation processes (severity thresholds, recipient groups, incident review procedures), which is the company's own risk management process. The final sentence about an independent board member's IT experience is ancillary detail supporting governance structure. The paragraph lacks hard verifiable facts (no dates, dollar amounts, named third-party firms, named tools) but contains enough named internal structures to exceed generic boilerplate.


reasoning: The paragraph describes how cybersecurity information flows from management (CISO, senior management) to the Audit Committee and Board of Directors, which is about board oversight of cyber risk. However, it contains no specific details: 'Audit Committee' is a standard committee (not a named cybersecurity committee), 'quarterly' is a generic cadence, and there are no named frameworks, dates, tools, or other identifying facts.


reasoning: The paragraph describes the company's internal vendor management program as a risk management process, which falls under Risk Management Process rather than Third-Party Risk since it describes the company's own oversight activities rather than requirements imposed on vendors per se. All elements—risk assessments, security questionnaires, audits, vulnerability scans—are generic practices with no company-specific identifiers, named frameworks, dates, or quantifiable details.


reasoning: The paragraph's primary focus is on management's responsibilities (identifying risks, establishing processes, maintaining programs, directing through the CEO, updating the Audit Committee), making Management Role the appropriate category. The content contains only standard generic terms (Board, Audit Committee, Management, CEO) with no firm-specific identifiers, named frameworks, specific dates, dollar amounts, headcounts, or named third-party firms, resulting in Generic Boilerplate specificity.


content_category: Strategy Integration

reasoning: The paragraph's primary purpose is a negative materiality conclusion (no material incidents have affected the company), not a description of an actual cybersecurity incident. Per the tiebreakers, brief mentions of incidents with materiality conclusions as the main point map to Strategy Integration. While 'January 2018' appears, it refers to company inception rather than a cybersecurity event or process—company self-references do not count toward specificity. The cross-reference to Risk Factors is appended to the materiality assessment, which does not change classification.


reasoning: The paragraph describes the company's internal cybersecurity processes (monitoring, penetration testing, incident response planning) rather than focusing on the CIO's personal qualifications or credentials, making Risk Management Process the most applicable category. All security activities mentioned (ongoing education, system monitoring, penetration testing, incident response plan) are common practices described without any firm-specific identifiers—no named frameworks, tools, dates, or measurable specifics that would differentiate this disclosure from any other company's generic cybersecurity program description.


reasoning: The paragraph describes the company's internal cybersecurity processes including monitoring procedures, incident response framework, cross-functional team composition, and escalation protocols. While it references the Board briefly as part of notification protocols, the grammatical and topical focus is on internal processes rather than board governance or oversight. For specificity: the third-party firms are unnamed ('specialized managed services firm,' 'leading cyber forensics firm'), no specific dates/dollar amounts/percentages/headcounts appear, no named standards are referenced, and while the departmental composition is listed, it falls under the ✗ NOT list for specificity purposes as organizational structure details do not qualify as hard verifiable facts. No single item on the ✓ IS list is present.


reasoning: The paragraph's grammatical subject is the Information Security Officer and IT security team, focusing on their responsibilities and qualifications, which maps to Management Role. While it mentions training processes, these are subordinate to describing the people running the cybersecurity program. The 'Information Security Officer' title is a cybersecurity-specific role (IS list), and the specific claim of 'over a decade of experience' is a verifiable fact—both elevate this beyond generic boilerplate.


reasoning: Paragraph identifies the CIO and CISO, describes their reporting relationship, and provides detailed credentials (years of experience, named certifications, specific degrees). The subject matter is the management roles themselves, not internal processes or board governance.


reasoning: The paragraph provides a high-level overview of the company's cybersecurity risk management approach, mentioning the VP of IT's responsibility for the information security program and Board oversight, but it describes these in generic terms without specific details about processes, frameworks, or activities that would distinguish this company's approach. No named frameworks (NIST, ISO), no specific controls, no named tools or programs, and no unique identifiers appear.


reasoning: The paragraph's primary subject is the Board of Directors and its delegation to the Audit Committee, placing it squarely in Board Governance. Although an 'employee of the Manager' is briefly mentioned, the paragraph lacks any cybersecurity-specific titles (CISO, CTO, CIO), named frameworks, dates, dollar amounts, or other verifiable facts that would elevate the specificity beyond generic boilerplate.


reasoning: This paragraph describes the company's internal risk management framework and its approach to identifying and estimating protective measure costs. It contains no named frameworks (NIST, ISO, etc.), no specific roles, dates, tools, or other identifying details—just generic language about risk management processes that could appear in any company's filing.


reasoning: The paragraph's grammatical subject is the CIO, describing their primary responsibility, qualifications (19 years experience, 11 years at company, named certifications), and the reporting structure under their direction. While processes are briefly mentioned, the primary focus is on identifying the management role and establishing their credentials.


reasoning: The paragraph's grammatical subject is the Board of Directors, and the primary focus is board-level oversight of cybersecurity risks through annual committee reporting—a clear Board Governance topic. The paragraph contains at least one firm-specific fact: the named 'Cybersecurity Committee' which is a specific internal governance structure (distinguished from generic 'Audit Committee' references).


category_confidence: low

reasoning: This paragraph is introductory/contextual language describing the company's general reliance on IT systems and third-party providers. It does not describe any actual risk management processes, vendor oversight procedures, or cybersecurity controls. It lacks any specific facts (no named tools, vendors, dates, or processes) and contains only boilerplate language about information systems reliance.


reasoning: The paragraph describes a reporting relationship where a VP reports to the board on cybersecurity matters, making Board Governance the primary category. The paragraph contains no firm-specific details: the VP title is not cybersecurity-specific (Corporate Development & Administration), the reporting topics are standard risk/impact/monitoring language, and 'on a regular basis' provides no specific cadence. No named frameworks, dates, figures, or unique identifiers are present.


reasoning: The paragraph's grammatical subjects are the Board and its committees (Audit Committee, Technology and Innovation Committee, Governance Committee), making Board Governance the appropriate category. The specificity is Firm-Specific because the named committees (Technology and Innovation, Governance) distinguish this disclosure from generic board oversight language, though the governance concepts themselves are standard.


reasoning: Although the paragraph references a cybersecurity incident, the majority of content focuses on financial quantification (specific dollar amounts in 2023 and 2024) and insurance recovery rather than describing the incident event itself. The incident description is brief and generic ('affected certain of our information technology systems'), while the substantive disclosure is about the material costs and insurance proceeds, making Strategy Integration the appropriate category.


reasoning: The paragraph describes the existence of committees and management positions responsible for cybersecurity risk management, which falls under internal risk management processes; however, it contains no specific details about actual processes, named individuals, specific committee compositions, or firm-unique practices—it merely states that such structures exist without describing what they do or how they operate.


reasoning: The paragraph describes management's functional responsibilities within the cybersecurity program (identifying risks, coordinating response, assessing policies, reporting to the board), making Risk Management Process the appropriate category. The Executive Vice President, Administration is mentioned as the directing role but no personal qualifications or credentials are provided, so it remains about the function rather than the person. The paragraph contains no specific dates, dollar amounts, named third-party firms, named tools, or unique identifiers — all described elements (risk identification, incident response, policy assessment, board reporting) are generic cybersecurity program functions that could apply to any company.


reasoning: The paragraph's primary focus is on board oversight mechanisms—monthly reporting cadence and evaluation processes reported to the Board of Directors—making Board Governance the most applicable category. The specificity is Generic Boilerplate because there are no named frameworks, named third-party firms, specific dates, dollar amounts, headcounts, or named internal programs; all entities are generic ('Board of Directors,' 'senior management,' 'internal and external experts') and the cadence ('monthly basis') lacks the hard-verifiable precision required.


reasoning: The paragraph's grammatical subjects are the CISO, cybersecurity team, and Incident Response Team, with the primary focus on identifying WHO comprises the oversight structure and their roles/responsibilities (leadership, coordination, monitoring, reporting). While it mentions the incident response plan as a tool, the main thrust is organizational composition and reporting lines, not the risk management process itself. The specific team compositions (Incident Response Team with named functional areas; Strategy Board with named C-suite roles) distinguish this as firm-specific rather than generic boilerplate about cybersecurity governance.


reasoning: This paragraph is primarily a materiality acknowledgment and risk summary, briefly mentioning a past ransomware incident and explicitly stating its material adverse impact, while referring readers to the Risk Factors section for details — fitting the 'brief mention of a past incident + materiality conclusion as the main point' pattern for Strategy Integration. The paragraph contains no firm-specific operational details about the incident itself (no affected systems, no response actions, no specific scope), making it standard boilerplate language applicable to any company with cybersecurity exposure.


reasoning: The paragraph's grammatical subjects are the Audit Committee (board oversight) and the CISO (cybersecurity-specific role), with primary focus on how the board receives cybersecurity briefings and the CISO's reporting function to the Audit Committee—this is board governance. While the CISO title makes this Firm-Specific, the content is largely generic board oversight language without hard verifiable facts like specific dates, dollar amounts, or named third parties.


reasoning: The paragraph's grammatical subjects are the CISO and Risk Committee (who chair, determine processes, assess materiality, and report), making this primarily about management roles rather than board governance—the Audit Committee is the recipient of reporting, not the actor performing cybersecurity oversight. The paragraph contains firm-specific identifiers: the CISO title, a named Risk Committee with a specific charter, and cross-functional composition, none of which appear in generic boilerplate.


reasoning: The paragraph focuses on identifying specific named management roles (CFO, CCO, CIO) and describes their qualifications, tenure, and industry experience—directly meeting the PERSON-VS-FUNCTION test for Management Role. The multiple specific tenure figures (four years, five years, nineteen years, fifteen years, sixteen years) constitute at least two hard verifiable facts, meeting the Quantified-Verifiable threshold.


reasoning: The paragraph references past incidents but does not describe what happened, the scope, or response actions—the incidents are merely acknowledged and cross-referenced to other filings. The substantive content focuses on implementing safeguards and making a forward-looking materiality statement, which is the hallmark of Strategy Integration. The language is entirely generic boilerplate with no firm-specific facts.


reasoning: The paragraph centers on the CTO's specific qualifications, career history, and credentials, which are hard verifiable facts (named person, named prior employers, 10+ years experience). This makes Management Role the primary category and Quantified-Verifiable the specificity level given the multiple independently verifiable facts.


reasoning: The paragraph is about the CISO's biographical details, qualifications, and career history, which maps to Management Role per the person-versus-function test. It contains multiple independently verifiable hard facts including a specific appointment date (October 2021), named prior government employers (NSA, US Army), and specific academic credentials (BA, MS, MBA with named fields), meeting the Quantified-Verifiable threshold of two or more hard verifiable facts.


reasoning: The paragraph describes the company's internal Enterprise Risk Council structure, its composition, and meeting cadence for managing cybersecurity risk—this is about the company's own risk management process. The CISO's role is mentioned as part of the process description, not as a profile of the individual.


reasoning: The paragraph is about personnel transitions for cybersecurity leadership (who left, who's interim, their qualifications) rather than describing any processes or activities the cybersecurity function performs. For specificity, there are two or more hard verifiable facts: a specific date (February 25, 2025) and a specific duration (two years of experience).


reasoning: The paragraph identifies the CIO as the person primarily responsible for cybersecurity risk management and details their qualifications and tenure at the company, which is the core of Management Role classification. The Strategy Committee Chair is mentioned for her expertise and credentials, not as the grammatical subject performing ongoing oversight.


reasoning: The paragraph describes the company's internal cybersecurity organizational structure and processes—what the team is responsible for, how it operates, and how it coordinates incident response—rather than focusing on the CISO's personal qualifications or background. The CISO is mentioned as a role/function, not as a person with credentials.


reasoning: The paragraph's grammatical subject is management (members of management providing briefings to the audit committee), and the primary focus is on management's reporting function and responsibilities regarding cybersecurity—consistent with Management Role. While it mentions the audit committee, management is the actor and main subject. All content describes standard reporting structures found in virtually any company's governance disclosure, with no firm-specific details, named frameworks, specific dates, or other distinguishing facts.


reasoning: The paragraph's primary focus is on the biographical credentials, tenure, and career history of named individuals (CTO and Senior Director, Information Security), including specific prior employers, rather than describing what cybersecurity processes do. Per the PERSON-VS-FUNCTION TEST, this is Management Role. Specificity is Quantified-Verifiable because the paragraph contains two specific years of experience plus three named prior employers (Ticketmaster, Sony Pictures, Warner Bros.), all of which are independently verifiable external facts.


reasoning: The paragraph's grammatical subject is 'our cybersecurity risk management and strategy processes' and the substantive disclosure describes the IT team meeting quarterly to review the NIST framework and evaluate processes — both are descriptions of internal risk management activities. While the CIO is mentioned, the focus is on what the security function does rather than the person's credentials or background.


reasoning: The paragraph's grammatical subject is the Board of Directors and describes board-level oversight of cyber risk and the establishment of a Risk Committee for enterprise risk management, including cybersecurity. While the content describes a governance structure, it contains no specific verifiable facts—'Risk Committee' is a generic committee name (analogous to 'Audit Committee'), the risk categories listed are standard boilerplate, and there are no named frameworks, dates, third-party firms, tools, or quantified details.


reasoning: The paragraph is primarily about management roles and organizational structure: the VP of IT leading the security team, the COO leading the Cybersecurity Incident Management Team, and reporting lines to the Audit Committee. While incident monitoring is mentioned, the focus is on WHO holds responsibility, not the processes themselves. The named internal program (Cybersecurity Incident Management Team) and specific cross-functional composition elevate this beyond generic boilerplate.


reasoning: The paragraph's grammatical subject is the ISMS Governance Committee, describing its function and activities in driving cybersecurity risk management alignment across stakeholder groups; the interim CSO and DPO appear as co-chairs of this committee rather than as the primary topic. While audit committee reporting is mentioned briefly, the substantive content describes internal governance processes, not board-level oversight.


reasoning: The paragraph describes the 2024 Cybersecurity Incident (unauthorized activity, scope of operational disruption to online ordering in parts of the U.S.) and includes specific financial impacts. Although the bulk of the paragraph covers financial costs, the narrative describing what happened in the incident (unauthorized access, affected systems, operational disruptions) satisfies the Incident Disclosure category. The financial details and cyber insurance information are firm-specific facts, though they do not reach the two hard verifiable facts threshold for Quantified-Verifiable.


reasoning: The paragraph centers on the ISO (Information Security Officer) — their leadership role, reporting structure, and extensive professional qualifications/credentials. The ISO is the grammatical subject across the first two sentences. Although the final sentence briefly mentions company-level tabletop exercises, this is subordinate context. The named certifications and specific 25-year experience threshold make this firm-specific rather than generic boilerplate.


reasoning: The paragraph describes an actual cybersecurity incident from November 2023, including what happened (IT system disruption), response actions taken (investigation with external experts, law enforcement coordination, remediation measures), and scope (affected data, notifications to individuals and regulators). While the external experts are not named, the incident narrative with specific timing and actions makes this an Incident Disclosure rather than Strategy Integration.


reasoning: The paragraph merely acknowledges past incidents by cross-referencing other filings and states that 'additional safeguards' (unnamed) were implemented, without describing what those safeguards are, what the incidents involved, or any specifics unique to this company's cybersecurity program. It defers all substantive incident detail to prior disclosures while using only generic protective language.


reasoning: The paragraph's grammatical subject is the company's incident response and vulnerability management processes, describing internal procedures for escalating and responding to incidents. The CISO and board committee members are mentioned as participants within these processes rather than as standalone subjects. The CISO title qualifies as a cybersecurity-specific fact, making this at least Firm-Specific.


reasoning: The paragraph is about a specific named management role (Chief Security and Cash Operations Officer) and describes that person's qualifications, credentials, expertise areas, and educational background. The subject is the individual, not a process or program. Per the person-vs-function test, removing the person's title and credentials would leave only vague descriptors of expertise areas rather than the substance of the paragraph.


reasoning: The paragraph centers on the Board's expected oversight role and reporting cadences, with 'Board of Directors' and 'Board members' as the grammatical subjects. While the content is about board governance, every claim is hedged with 'We expect' — it describes anticipated future arrangements rather than current practices or any established program. No named entities, specific dates, named committees, named frameworks, or other distinguishing facts are present; 'at least an annual basis' and 'periodic conversations' are vague cadences, not specific facts per the calibration guidance.


reasoning: The paragraph's grammatical subject is 'The Company's processes' describing internal risk management integration, framework adoption (NIST, COSO, ISO 27001), and third-party testing of the security program—all hallmarks of Risk Management Process. While the Cybersecurity Committee is mentioned, it appears as a brief oversight reference subordinate to the process description rather than as the main topic. The paragraph names three specific industry frameworks, meeting the threshold for Sector-Adapted specificity.


reasoning: The paragraph's grammatical subject is the Nominating and Governance Committee describing its oversight activities (receiving reports, access to cybersecurity materials), which is board governance content. The mention of 'CISO Information Security' identifies the report source but is incidental—the paragraph is not about the CISO's role or qualifications. No specific dates, dollar amounts, named tools, named third-party firms, or other hard verifiable facts appear; all language ('periodic reports,' 'significant cybersecurity threats') is boilerplate that could appear in any company's filing.


reasoning: The paragraph describes the company's own internal cybersecurity risk management approach, with third-party due diligence as one component. No named vendors, frameworks, dates, or other identifiable specifics are present, making the content generic boilerplate.


reasoning: The paragraph focuses on the Cybersecurity Steering Committee's governance functions (ownership, oversight, policy review, strategic direction), making Board Governance the primary category even though it mentions specific roles (interim CLO, CSO) as committee co-chairs. No hard verifiable facts are present — the named committee and role titles are organizational descriptors without specific dates, dollar amounts, headcounts, named third-party firms, or named tools/products that would elevate specificity.


reasoning: The paragraph describes an actual cybersecurity incident including what happened (user information accessed and downloaded without authorization), when (October 2023), scope (individual 23andMe.com accounts), and specific response actions (password resets, two-factor verification, detection tools). This clearly qualifies as Incident Disclosure per the tiebreaker rules for describing an incident's narrative and response.


reasoning: The paragraph describes the company's own data storage and handling practices as internal processes, with the mention of Google Cloud and AWS being incidental to describing where data resides rather than about vendor oversight/risk management. The named cloud platforms are extremely common in cloud-dependent company disclosures and don't constitute a firm-unique fact.


reasoning: The paragraph describes the company's cybersecurity assessment and audit processes (IAD reviews, third-party assessments, regulatory examinations), which are internal risk management activities. While BOTC is mentioned, it appears only as a report recipient, not as the grammatical subject or primary focus.


reasoning: The paragraph is centered on Board-level oversight structure and reporting cadences, with the Audit Committee as the grammatical subject. While CIO and CISO titles appear, they are mentioned only as brief descriptors of who briefs the committee, not as firm-specific identifying details. All elements—'Board of Directors,' 'Audit Committee,' 'quarterly,' 'risk oversight'—are standard governance boilerplate found in virtually every SEC cybersecurity disclosure.


reasoning: This paragraph is a negative disclosure stating the absence of cybersecurity incidents rather than a description of an actual incident with narrative, scope, or response actions. As a standalone negative statement about incident history without describing any real event, it is best classified as None/Other. The mention of 'December 31, 2024' is a standard fiscal year reference, not a specific incident date, and the statement contains no unique identifiers, named tools, or firm-specific details.


reasoning: The paragraph describes the company's own internal incident response plan and procedures (detection, analysis, containment, recovery), which falls under Risk Management Process. The IT Leader is mentioned only as part of the process description, not as a person with qualifications or background. No named frameworks, tools, dates, or other identifying specifics are present.


reasoning: The paragraph focuses on the company's own internal cybersecurity risk assessment and monitoring processes, with third-party experts mentioned as a resource used by the company rather than vendors being managed—consistent with Risk Management Process. The named regulatory bodies (FFIEC, FDIC, UDFI) anchor this to the company's specific regulatory environment as a financial institution, making it Firm-Specific rather than Sector-Adapted, though no hard verifiable external facts (specific dates, named firms, dollar amounts) are present to reach Quantified-Verifiable.


reasoning: Paragraph describes the CDIO and CISO as persons — their professional backgrounds, tenure, and credentials — making Management Role the appropriate category. Two specific duration claims plus five named third-party certifications constitute multiple hard verifiable facts, elevating this to Quantified-Verifiable.


reasoning: The paragraph's grammatical subjects are 'our board' and 'the cybersecurity risk committee,' making Board Governance the appropriate category. It describes board oversight structure and committee responsibilities for cybersecurity without naming specific frameworks, dates, named third-party firms, or other verifiable facts that would elevate it beyond boilerplate disclosure language.


reasoning: The paragraph's grammatical subject centers on the Global Information Security organization implementing and maintaining an information security program, with detailed description of protection methods and tools (firewalls, SIEM, MFA, encryption). While board reporting channels are mentioned, they appear as secondary context. The Chief Security & Cash Operations Officer is mentioned by title but no person-specific details are provided, and the paragraph describes program functions rather than the individual's qualifications. No hard verifiable facts (dates, dollar amounts, named third-party firms, specific headcount, or named tools) appear; all security methods described are generic industry-standard practices.


reasoning: The paragraph describes the company's own information security program, its components, and how the IT/IT Security Departments carry out risk management activities—this is the grammatical subject throughout. While external parties (AON and Netdiligence) are named, they are described as vendors engaged BY the company's internal program to perform specific activities, which qualifies this as Risk Management Process rather than Third-Party Risk per the tiebreaker guidelines. The named external firms and their specific roles distinguish this from generic boilerplate.


reasoning: The paragraph describes the company's own internal cybersecurity risk management framework, incident classification system, and governance escalation procedures—centrally focused on what the company's program DOES. While the Directors Risk Committee is mentioned, it appears as part of the incident escalation mechanism rather than as the primary subject of board governance.


reasoning: The paragraph describes a real cybersecurity incident at Change Healthcare (third party), including what happened (unauthorized access), the operational scope of impact on Bioventus (billing disruption, claims delays, delayed cash remittances), and the company's response actions (identified alternative processor, resumed submissions). The narrative describes the incident and its effects, meeting the Incident Disclosure threshold. While it names two entities (Change Healthcare and UnitedHealth Group), these are general company names rather than cybersecurity-specific firms (like Mandiant or CrowdStrike), and the paragraph lacks specific dates, dollar amounts, or named security tools that would elevate specificity beyond Sector-Adapted.


reasoning: This paragraph describes an actual cybersecurity incident—a ransomware attack in late May 2023—detailing what happened (ransomware attack on certain network systems) and response actions taken (investigation initiated, cybersecurity experts and outside advisors engaged, law enforcement involved). The specific date 'late May 2023' provides a firm-specific identifying fact, making this Firm-Specific rather than generic boilerplate, though no named third-party firms or hard verifiable metrics elevate it to Quantified-Verifiable.


reasoning: The paragraph describes the company's internal cybersecurity risk assessment and monitoring processes (identifying threats, automated tools, real-time monitoring, escalation protocols), making it about the function rather than the individual. Under the PERSON-VS-FUNCTION test, removing the CFO title still leaves a complete description of the risk management activities. No named frameworks, specific tools, named vendors, dates, or other verifiable facts appear—the language is entirely generic boilerplate.


reasoning: Paragraph describes an actual cybersecurity breach and the company's response actions (public disclosure, customer notifications) as well as the ongoing SEC investigation into this incident. While lacking technical breach details, the core subject is a specific disclosed incident and its regulatory aftermath, not financial materiality or insurance coverage.


reasoning: The paragraph focuses on a board/committee's oversight role—DPIRC implementing policies, overseeing protection/response capabilities, and providing strategic direction—making Board Governance the primary category. The specificity is Generic Boilerplate because while it names internal committees (DPIRC, Enterprise Risk Committee), it contains no hard verifiable facts (no specific dates, dollar amounts, named tools, named third-party firms, or quantifiable metrics); the governance functions described are standard and could apply to any company.


reasoning: The paragraph describes the company's internal cybersecurity monitoring and incident escalation processes, making Risk Management Process the appropriate category. The paragraph would still convey the same process information without the CISO reference, confirming it's about the function rather than the person. CISO is a cybersecurity-specific role (IS list), making it Firm-Specific.


reasoning: The paragraph's grammatical subject is 'our management team' and it describes team composition, qualifications, and oversight responsibilities rather than describing specific processes or frameworks. No named roles (CISO, CTO, CIO), named programs, specific dates, or named third-party firms appear—all descriptions are generic and could apply to any company.


reasoning: The paragraph's main focus is on management's cybersecurity qualifications and operational capabilities — specifically the CEO's 15+ years of IT/software development experience contrasted with other executive officers' limited cybersecurity expertise — rather than describing board-level governance processes. The board appears as a structural reference point, but the substantive content centers on who manages cybersecurity and their relative qualifications.


reasoning: The paragraph describes the company's own internal security controls and risk mitigation architecture (limited access model, network isolation). This is about the company's internal risk management process, not board governance or incident disclosure. The multiple specific employee numbers make this Firm-Specific, though the cybersecurity measures themselves are descriptive rather than containing named frameworks, tools, or named third-party firms.


reasoning: The EROC (Enterprise Risk Oversight Committee) is the grammatical subject, and the paragraph describes the board committee's oversight function and what they receive briefings on regarding cybersecurity—this is Board Governance. The specificity is Firm-Specific because the paragraph explicitly names the EROC committee and lists the specific departmental composition (Legal, Compliance, and Finance) involved in cybersecurity threat assessment, meeting the threshold for at least one IS fact.


reasoning: The paragraph's grammatical subject is the Board (overseeing, receiving reports), making Board Governance the primary category. The mention of CISO and CTO as report sources provides firm-specific grounding through cybersecurity-specific role titles.


reasoning: This paragraph describes an actual cybersecurity incident including the date, attack vector (social engineering on outsourced vendor), scope (loyalty program database), and response actions (IRP activation, law enforcement notification, third-party engagement). The reference to a previously disclosed incident with specific factual details about what happened and when clearly qualifies as Incident Disclosure.


reasoning: The paragraph's grammatical subjects are predominantly the board of directors and audit committee, focusing on board-level oversight of cybersecurity (policy adoption, committee responsibilities, director training). The CTO is discussed in the context of supporting board governance rather than as the primary subject. The 25-year experience figure and named policy provide two hard verifiable facts, crossing the QV threshold.


reasoning: The paragraph's grammatical subjects are named management roles (CIO, Senior Directors, Senior Information Security Architect) and their personal qualifications/experience, clearly making this a Management Role disclosure. It contains multiple cybersecurity-specific titles (CIO, Senior Information Security Architect) and specific verifiable facts (25+ years experience, 15+ years public company experience, CISSP certification) that uniquely identify this company's disclosure.


reasoning: While the paragraph opens mentioning the CISO's leadership role, the bulk of content focuses on the Board's oversight activities—specifically the Board's oversight function, the cadence of briefings, and the governance structure. This makes Board Governance the primary category. The named CISO/CIO roles and specific 'at least semiannual' update cadence provide firm-specific organizational details beyond generic boilerplate.


reasoning: The paragraph focuses on two named cybersecurity management roles (Director of IT and third-party CISO), their specific qualifications, experience levels, and reporting relationship. Applying the Person-vs-Function test, the paragraph is primarily about the persons and their credentials rather than the processes they execute, making Management Role the appropriate category. The paragraph contains multiple hard verifiable facts (two specific year counts of experience and a named certification) meeting the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's organizational governance structure for cybersecurity risk management, including two named committees (IT Operating Committee and IT Steering Committee) with specific compositions and review cadences—this is a description of internal risk management processes. While the Director of IT and CISO are mentioned, the focus is on governance structure and processes rather than the individuals' qualifications or backgrounds, so Management Role is secondary.


reasoning: This paragraph is a general risk acknowledgment statement combined with a negative declaration (no material cybersecurity incidents to date). It contains no description of actual incidents, no governance/management details, no process descriptions, and no financial or strategic conclusions about business impact. It's standard boilerplate language applicable to any public company.


reasoning: The paragraph describes the board's oversight cadence and the scope of cybersecurity topics reviewed at board meetings. While management roles (CIO, General Counsel) are mentioned as the subjects doing the briefing, the substantive focus is on board governance—specifically what the board oversees and reviews. All elements are generic (standard committee references, standard cybersecurity program topics, no named frameworks or firm-specific details).