reasoning: This paragraph describes the company's own internal risk management processes for cybersecurity—integrating cyber risk into enterprise risk management, monitoring activities, and periodic reporting to the audit committee. While the board's audit committee is mentioned as a report recipient, management processes are the grammatical subject and main focus. No specific dates, dollar amounts, named frameworks, tools, third-party firms, or other uniquely identifiable facts appear; the language uses vague temporal terms ('continual basis,' 'periodic basis,' 'monthly basis') that apply generically to any company.


content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This is a risk factor header followed by generic boilerplate language describing potential cybersecurity threats. It contains no board oversight, management roles, actual incidents, specific processes, vendor oversight, or any firm-specific details. It is forward-looking risk disclaimer language that could appear in any company's filing unchanged.

provider: minimax

stage: benchmark


content_category: Third-Party Risk

specificity_confidence: medium

reasoning: The paragraph is centrally about vendor oversight and the security requirements imposed on third-party service providers, including contractual obligations and specific assessment mechanisms tailored to vendor risk. While internal processes are mentioned, the focus on managing risks associated with vendors and the 'imposition of certain contractual obligations' clearly places this in Third-Party Risk rather than internal Risk Management Process. The named internal program (vendor management program) and named internal policy provide firm-specificity beyond generic vendor management language.


content_category: Risk Management Process

reasoning: The paragraph describes the company's own internal processes for assessing and managing cybersecurity incidents — specifically an incident response program, escalation protocols, severity assessment procedures, and third-party support relationships. No actual incident is described, no board or management role is the grammatical subject, and there is no materiality or financial discussion. All elements are generic and could appear in any company's filing.


reasoning: The paragraph describes the company's internal cybersecurity incident response processes and escalation procedures, with the Sr Director of Tech as the grammatical subject throughout. The board is only mentioned as the final recipient of notifications for material incidents, making this primarily about internal risk management rather than board governance. Contains two firm-specific facts: a named cybersecurity-relevant role (Sr Director of Tech) and a specific cross-functional team composition (IT specialists, accountants, and lawyers).


content_category: Strategy Integration

reasoning: This paragraph is a forward-looking materiality disclaimer stating no material incidents have occurred and expenses have been immaterial, with a standard cross-reference to Risk Factors. Per the tiebreaker rules, a materiality conclusion paired with a Risk Factors cross-reference classifies as Strategy Integration, not None/Other. The paragraph contains no firm-specific details—no dates, named roles, named frameworks, dollar amounts, or other hard facts—it consists entirely of standard SEC boilerplate language that could appear in any company's filing.


reasoning: The paragraph describes the company's own internal cybersecurity risk assessment processes, security tools, monitoring capabilities, incident response protocols, and testing procedures—all central to risk management. While third-party service providers and independent assessments are mentioned, they serve the company's internal processes rather than being the central topic.


reasoning: The paragraph describes the company's internal enterprise risk management process and its integration of cybersecurity risks, which is a description of the company's own internal processes. The board is mentioned only as a recipient of the review results, not as the grammatical subject performing oversight.


reasoning: The paragraph describes the company's methodology for designing and assessing its cybersecurity program, which is a core internal risk management process. It is not about board oversight, specific personnel, vendor management, incidents, or financial impact. The paragraph qualifies as Sector-Adapted because it names three specific, recognized cybersecurity frameworks (ISO 27001, CIS 18, and NIST) while containing no firm-specific facts, verifiable numbers, or named third parties beyond these standards.


content_category: Board Governance

reasoning: The paragraph describes the Audit Committee receiving periodic reports from management on cybersecurity threats, which is board-level oversight of cyber risk. However, all elements are generic boilerplate: the Audit Committee is a standard committee, 'periodic' is a vague cadence, 'management' is unnamed, and there are no specific dates, named frameworks, or unique details that would elevate this to firm-specific.


reasoning: This paragraph is a general acknowledgment of cybersecurity risk categories (operational risks, IP theft, fraud, extortion, privacy violations) without describing any actual board oversight, management roles, specific processes, incidents, or financial impacts. It reads as a standard risk-recognition disclaimer that could appear verbatim in any SEC filing and contains no firm-specific details.


content_category: Management Role

category_confidence: medium

reasoning: The paragraph's grammatical subject is the senior management team (CFO, VP of Finance, SVP Legal/GC, VP Quality) and their collective qualifications and experience in information security — this is a Management Role disclosure. The specificity is Generic Boilerplate because all named roles are standard executive titles (CFO, VP, SVP) found at any company, and the description of their experience ('significant prior work experience in various roles involving managing information security') is a generic qualifier with no specific certifications, credentials, or unique identifiers.


reasoning: This paragraph contains a standalone materiality conclusion (no material effect from cybersecurity threats) with an appended cross-reference to Risk Factors. Per the tiebreakers, a materiality disclaimer with a cross-reference is classified as Strategy Integration, not None/Other, because the materiality assessment is the primary content. The paragraph contains no firm-specific facts, dates, named entities, or hard verifiable details—it is standard boilerplate language applicable to any filing.


reasoning: The paragraph's primary function is a forward-looking materiality disclaimer ('not reasonably likely to materially affect us') combined with an affirmative statement of no past material incidents, which qualifies as a standalone materiality conclusion per the tiebreaker rules. The cross-reference to Risk Factors does not change this classification.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, specifically reporting structures (Chief Security and Trust Officer reporting to executive leadership) and integration with the enterprise risk management program via internal audit. While management roles are mentioned, the focus is on the process of managing cyber risk, not on the person's qualifications or background.


reasoning: The paragraph describes the company's own internal cybersecurity processes—monitoring, risk assessments, penetration testing, and internal drills—all of which are core risk management activities. The third-party service provider mention is subordinate to and part of 'our overall cybersecurity risk management framework,' not a standalone discussion of vendor oversight requirements.


reasoning: The paragraph focuses on specific named individuals (IT Director and IS Director) and details their qualifications, credentials, experience, and backgrounds. Per the person-vs-function test, removing the person/credentials would leave virtually nothing. This is about WHO leads the cybersecurity function and their qualifications, making it Management Role rather than Risk Management Process.


reasoning: The paragraph's grammatical subject is vendor/service provider oversight, with specific focus on third-party risk assessments and monitoring compliance. This is the central topic, not an incidental component. For specificity: while the section header 'Managing Third Party Risk' appears specific, the content describes generic practices (risk-weighted assessments, annual and ongoing monitoring) without naming any specific frameworks (NIST, ISO), tools, third-party firms, dates, or other verifiable facts unique to Oceaneering — it could be pasted into most companies' filings.


reasoning: The paragraph primarily describes the company's own internal communication and disclosure framework for cybersecurity incidents, including specific stakeholders involved (disclosure committee, executive management, legal counsel, audit teams) — this is describing the company's internal processes for incident response. The brief mention of past incidents at the end serves only as context for the framework's existence and leads into a boilerplate materiality conclusion, which does not constitute an incident narrative requiring Incident Disclosure classification.


reasoning: The paragraph describes the company's own internal processes—implementing a protection program and managing incident response and risk management (mitigation, transference, acceptance)—which fits Risk Management Process. While the Director – Information Systems is named, the role is not among the explicitly cybersecurity-specific titles listed in guidance (CISO, CIO, CTO, etc.), and no other hard verifiable facts (dates, dollar amounts, named frameworks, third-party firms, or named products) are present, making this Generic Boilerplate.


reasoning: The paragraph is centrally about third-party vendor oversight—describing a vetting process, attestation reviews, and contractual security requirements—which maps directly to Third-Party Risk. It contains no named frameworks, specific dates, dollar amounts, named third-party firms, or other firm-specific details; it describes a generic third-party risk management process applicable to any company.


reasoning: The paragraph's central topic is third-party vendor oversight (security incidents at vendors, service providers, customers), which maps directly to Third-Party Risk category. While the company describes its own processes, the focus is squarely on vendor risk, not internal security processes broadly. The content contains no named frameworks, tools, vendors, dates, or other specific facts—only generic references to 'systems and processes' and 'cybersecurity risk insurance' that could appear in any company's disclosure.


reasoning: The paragraph primarily describes the company's internal cyber risk management process—maintaining safeguards, investing in protection resources, and designing detection/response capabilities—making 'Risk Management Process' the most applicable category. While specific roles (SVP Operations, VP Deputy General Counsel) are mentioned, the paragraph focuses on what the process does rather than the individuals' qualifications or backgrounds, and no cybersecurity-specific titles (CISO, CIO) are identified.


reasoning: The paragraph describes the company's own internal cybersecurity risk management activities (threat evaluation, security reviews, monitoring, training) but uses only generic, non-specific language. No named frameworks (only 'industry standard security frameworks'), no named tools, no named roles, no dates, and no firm-specific details that would distinguish Oracle's program from any other company's.


reasoning: The paragraph's grammatical subjects are the CTO, CSO, and CIO, focusing on their qualifications, experience, and coordination roles. While the CTO's board membership is noted, the paragraph emphasizes their management functions and cybersecurity program oversight rather than board governance processes. The CIO's career history and experience are described as the main content.


reasoning: This paragraph is a forward-looking materiality disclaimer with a cross-reference to Item 1A Risk Factors. It contains no substantive disclosure about governance, processes, roles, or incidents—only a general acknowledgment that cyber risks could affect the company, paired with a reference to another section for additional detail.


reasoning: The primary purpose of this paragraph is to deliver a materiality conclusion (cybersecurity risks have not materially affected business strategy, results of operations, or financial condition), which is the hallmark of Strategy Integration. The brief mention of experiencing 'threats and breaches from time to time' is incidental to the main point. No specific dates, dollar amounts, named third-party firms, or named tools appear; all language is generic boilerplate that could appear in any company's filing.


reasoning: The paragraph describes MetLife's own internal cybersecurity program components—incident response team, IR plan, policies, testing, training, vendor procedures, and cross-functional governance—rather than describing an actual incident or board oversight. The CISO and specific functional group composition (Global Technology & Operations, Risk, Compliance, Legal, Privacy, Internal Audit) distinguish this as firm-specific rather than generic boilerplate.


content_category: Incident Disclosure

reasoning: This paragraph describes an actual cybersecurity incident with specific details: a precise date (February 13, 2023), a named attack vector (third-party secure file transfer vendor), and scope (patient personal information exposed). While the vendor is not named, the incident narrative and specific circumstances distinguish this from generic boilerplate.


reasoning: The paragraph describes the company's own internal cybersecurity preparedness activities (tabletop exercises, incident response procedures) and risk transfer mechanisms (cyber insurance), which falls under Risk Management Process. It contains no specific facts—no named frameworks, dates, dollar amounts, named tools, or unique identifiers—that would elevate it beyond generic boilerplate language applicable to any company's disclosure.


reasoning: The paragraph focuses on the management team's responsibility for the cybersecurity risk management program and its oversight functions (assessing risks, supervising external consultants), which describes internal processes rather than identifying a specific management role's qualifications or reporting lines. The brief mention of 'COO' is incidental to the description of team responsibilities, not a focus on the role itself. No specific frameworks, dates, named programs, or other distinguishing facts are present.


reasoning: The paragraph describes the company's own incident response, business continuity, and disaster recovery programs, which are internal risk management processes. No specific dates, named personnel, third-party firms, tools, or unique identifiers are present — only generic program descriptions and 'periodic exercises' (a vague cadence) appear, making this Generic Boilerplate.


reasoning: The grammatical subject is the SVP of IT (a cybersecurity-specific management role) whose briefing responsibilities are described, making this a Management Role disclosure. However, the content contains no firm-specific details—'periodic briefings' and 'senior management team' are generic boilerplate language without specific dates, named programs, or identifiable processes unique to EyePoint.


reasoning: This paragraph describes an actual cybersecurity incident, including what happened (data exfiltration to dark web), the scope of affected data (PII of employees/former employees/dependents, customer bank account information), and response actions (cooperation with regulators, notice delivery in Q4 2023). The 'Q4 2023' date and 'three state regulators' provide two independently verifiable facts.


reasoning: The paragraph's grammatical subject is the audit committee, and it describes the board's oversight cadence (receiving regular reports) on cybersecurity threats and processes—this is classic Board Governance content. However, the paragraph contains no specific facts: the Audit Committee is a standard committee (not a specific fact per guidelines), 'Security Team' is unnamed, 'regular reports' is vague cadence, and no dates, dollar amounts, frameworks, or named third parties appear. This is standard audit committee oversight language that could appear in any public company's filing.


reasoning: This paragraph is a generalized risk acknowledgment statement describing hypothetical threats and their potential business impact. It does not describe actual incidents with specific details, does not discuss governance processes or management roles, and does not present a materiality assessment with specifics—it simply states that past incidents have not been material. This is standard risk language that could appear in virtually any company's filing.


reasoning: The paragraph's grammatical subjects are the Board and the Audit Committee, describing their oversight role in cybersecurity. While the CISO is mentioned, it is only as the party providing updates to the committee, not as the subject. The two specific director certifications (CERT designation) and the named oversight program distinguish this as firm-specific rather than generic boilerplate about board oversight.


reasoning: This paragraph is a forward-looking disclaimer combined with a materiality statement asserting no prior material incidents. It contains no descriptions of actual processes, tools, frameworks, named roles, or specific facts. The language is standard boilerplate that could appear in any company's filing with no substantive cybersecurity disclosure.


reasoning: The paragraph describes the company's internal cybersecurity risk assessment and monitoring processes using a third-party firm, with the IT Firm serving as a support tool for the company's own risk management program rather than being the central topic of vendor security oversight. All entities are unnamed placeholders (e.g., 'IT Firm', 'IT Lead') and no specific frameworks, tools, dates, or verifiable details are provided, making this standard boilerplate that could apply to any company of similar size.


reasoning: The paragraph identifies key roles (CCO, risk management/legal/IT/compliance personnel of the Investment Adviser) responsible for cybersecurity oversight, making Management Role the primary category. No specific framework standards, named programs, specific dates, or unique firm-specific details are present—only generic references to standard financial services roles and a common third-party reliance structure.


reasoning: The paragraph's primary purpose is a boilerplate materiality disclaimer stating the company is unaware of material cybersecurity risks affecting business strategy, results of operations, or financial condition. While the paragraph mentions escalation controls to management and the Board, this is incidental context rather than a substantive description of governance processes. The cross-reference to Risk Factors reinforces that this is a standard materiality statement.


reasoning: The paragraph centers on identifying specific management individuals and detailing their qualifications (years of experience), which aligns with Management Role classification. The three specific tenure durations (17 years, 10 years, 19 years) constitute multiple hard verifiable facts, qualifying this as Quantified-Verifiable specificity.


reasoning: Paragraph describes an actual cybersecurity incident including date, attack type, system shutdown scope, three-week operational impact, and response actions — all elements of incident disclosure. Two hard verifiable facts (specific month/year and specific duration) support Quantified-Verifiable.


reasoning: This paragraph describes an actual cybersecurity incident (timing of detection, investigation with experts, law enforcement notification, security enhancements) that occurred at the company. It constitutes an incident narrative with response actions. While it lacks named third-party firms or tools, it contains one specific verifiable fact—the detection date of early April 2023—which elevates it from Generic Boilerplate to Firm-Specific.


reasoning: The paragraph's grammatical subject is the Vice President, Head of Technology, and the content focuses on their qualifications, credentials, experience, and responsibilities rather than describing internal processes in the abstract. The person is the main topic, not the processes themselves. Three hard verifiable facts are present: a cybersecurity-specific title (VP of Technology), a named certification (CISM), and a specific number (20+ years experience), which together support Quantified-Verifiable specificity.


reasoning: This paragraph describes general internal procedures for coordinating incident response activities without identifying specific roles (no CISO/CIO), named programs, dates, or other unique details. It is standard boilerplate language describing incident response coordination that could appear in any company's filing.


reasoning: The paragraph describes the company's own cybersecurity risk management processes—specifically how it uses third-party consultants to design controls, perform penetration testing, and monitor threats. This is internal program description, not vendor oversight. All references are to generic 'third-party consultant' or 'third parties' without named firms, dates, frameworks, or other identifying details, making it generic boilerplate applicable to any company.


reasoning: The paragraph's grammatical subjects are the Audit Committee and Board of Directors describing their oversight structure and engagement cadence with management on cybersecurity risks. While the CIO is mentioned, the primary focus is on board-level governance and reporting cadences rather than the CIO's qualifications or management function. The specific cadences ('at least once each calendar year,' 'at least annually') and the enumerated reporting topics distinguish this from generic boilerplate about board oversight.


reasoning: The paragraph describes the company's internal risk management framework—how the Global Security Organization executes cyber strategy within the ERM program, the establishment of the IRM program, and governance cadences through the IRM Steering Committee. The primary subject is the company's own internal processes. While it names internal programs (Global Security Organization, IRM program, IRM Steering Committee), it contains no hard verifiable external facts (no specific dates, dollar amounts, headcounts, named third-party firms, named tools, or certifications), making it generic boilerplate that could apply to many similarly-sized enterprises.


reasoning: This paragraph discusses the potential financial and business strategy impact of cybersecurity risks, states a materiality conclusion (no incidents have materially affected the company), and mentions cyber insurance—all hallmarks of Strategy Integration. No specific verifiable facts are present: no dates, dollar amounts, named insurers, named third parties, or specific numbers. The language is entirely generic and could appear in any online company's 10-K.


reasoning: The paragraph describes the company's own internal cybersecurity processes (automated tools, testing, training, third-party oversight mechanisms), making Risk Management Process the appropriate category. The third-party vendor reference is about how the company's internal processes extend to vendor oversight, not a standalone vendor risk management topic. No specific facts appear: the practices named (penetration testing, vulnerability scanning, tabletop exercises, employee training) are explicitly excluded as specific facts per calibration guidelines, 'cybersecurity team' is a generic role, 'outside advisors' are unnamed, and no dates, dollar amounts, named frameworks, or named products appear.


reasoning: The paragraph describes the TRCC, a named governance committee with specific composition (CISO, senior business stakeholders), reporting lines, and oversight responsibilities for cybersecurity risk. While the TRCC is a management-level committee rather than a board committee, the focus on committee-based oversight of cybersecurity risk and escalation processes aligns with Board Governance as the central topic.


reasoning: This paragraph is a general risk-factor description of cybersecurity threat types (hackers, cyber criminals, nation-state actors, social engineering, cyber extortion) that could appear verbatim in any company's filing. It contains no substantive disclosure about Diode Inc.'s specific cybersecurity governance, processes, incidents, or strategy.


reasoning: The paragraph describes incident response actions (containment, solution implementation, recovery) following a cybersecurity event, with language suggesting an actual incident occurred ('further identifying any additional compromised machines... not previously identified'). However, the actions listed are standard incident response steps with no firm-specific details such as named tools, dates, affected systems scope, or response team specifics.


reasoning: The paragraph primarily describes internal cybersecurity processes (incident response procedures) and organizational structure for managing cybersecurity, making Risk Management Process the best fit even though it briefly mentions board oversight and a management role. The paragraph contains no named frameworks, specific dates, dollar amounts, named tools, or other verifiable specifics that would elevate it beyond generic boilerplate.


reasoning: The paragraph centers on the audit committee (a board committee) as the grammatical subject receiving cybersecurity briefings, fitting Board Governance. However, the content describes only standard board-level oversight practices with no firm-specific details—no named committees beyond the generic Audit Committee, no specific reporting dates, no named programs, tools, or third-party firms.


reasoning: The paragraph's primary subject is the board of directors receiving periodic reports on cybersecurity risks, which constitutes board governance. While the CTO is mentioned as the reporting mechanism, the grammatical and topical focus is on how the board oversees cyber risk. The paragraph contains no firm-specific facts—BDT & MSD appears to be a parent/sponsor entity, 'periodically' is a vague cadence, and the report topics (controls, third-party oversight, materiality) are generic security language.


reasoning: The paragraph's grammatical subject is vendor security assessments for service providers, making Third-Party Risk the appropriate category. The specificity is Generic Boilerplate because the paragraph contains no named third-party vendor ratings firm (only 'an industry leading third-party vendor security ratings company'), no specific dates, amounts, or other verifiable facts that would differentiate this disclosure from any other company's vendor oversight description.


reasoning: The paragraph describes the company's own internal risk assessment process—collaborating with third parties to evaluate their cybersecurity program and assessing it against a named framework. Third-party service providers are referenced as inputs into the company's internal process, not as the central topic of vendor security oversight. The only named standard is NIST, which elevates this to Sector-Adapted, but all practices described are generic.


reasoning: The paragraph describes cybersecurity reporting to the Risk Committee (board-level oversight), which is the primary focus, making this Board Governance. While 'IT Management team' is the grammatical subject, the substance centers on board oversight mechanisms. For specificity: no named frameworks, no specific dates, no named roles beyond generic 'IT Management,' no third-party firms, no dollar amounts, and the named 'Risk Committee' is standard board committee terminology similar to the excluded 'Audit Committee' — making this fully generic boilerplate that could appear in any company's filing.


reasoning: This paragraph contains only general acknowledgments about the importance of cybersecurity and increasing IT dependence risks, with no substantive disclosure about actual governance structures, management roles, processes, or procedures. It reads as introductory/framing language rather than a substantive description of the company's cybersecurity program.


reasoning: The paragraph is a forward-looking disclaimer acknowledging the company lacks the resources, expertise, and personnel to effectively manage cybersecurity risks—this is a risk acknowledgment statement, not a description of any actual cybersecurity governance, process, or incident. It aligns with the None/Other category for entities explicitly stating they lack adequate cybersecurity capabilities, and contains no named entities, dates, figures, or firm-specific details.


reasoning: The paragraph identifies a named management role (Director of Information Technology) and describes their qualifications (35 years experience), responsibilities, and oversight structure, which is the core of Management Role classification. The focus is on WHO manages cybersecurity rather than describing specific internal processes or frameworks in detail.


reasoning: The paragraph describes internal risk assessment and audit processes as the main subject (what is done), rather than focusing on the qualifications or background of the VP of Internal Audit. The processes mentioned are generic periodic activities without specific frameworks, tools, or named programs.


reasoning: The paragraph describes the company's own internal cybersecurity risk management program and security team activities (risk assessment, controls, incident response, training), which falls under internal processes. It contains no specific facts—no named cybersecurity titles (CISO/CTO/CIO), no named frameworks (NIST/ISO), no dates, numbers, named programs, or products. Every element is generic boilerplate that could appear in any company's disclosure.


reasoning: The paragraph primarily describes two named individuals (Katherine Dowling and Hong Kim) and their professional qualifications, career histories, and educational backgrounds rather than focusing on internal processes or frameworks. The biographical content about their experience, credentials, and prior employers dominates the paragraph, making Management Role the appropriate category. The paragraph contains multiple independently verifiable facts: specific year (2015), specific organization (U.S. Attorney's Office for Northern District of California), specific degree (BS in Computer Science from UPenn), named employer (Google), and named unit (Economic Crimes Unit) — well exceeding the two-fact threshold for Quantified-Verifiable.


reasoning: The paragraph's grammatical subject is the company's risk assessment and management processes (internal processes), with the named management role mentioned as the implementer. While the person's qualifications are described, the primary topic is the existence and nature of the internal cybersecurity processes. The Senior Principal Security and Infrastructure Architect title is a cybersecurity-specific role, and the 20 years of experience is a specific qualification — both qualify this as Firm-Specific rather than boilerplate.


reasoning: The paragraph describes the company's own risk management approach, with third-party engagement as a component of that internal process (not vendor oversight as a standalone topic). The content consists of generic cybersecurity practices—system audits, threat assessments, monitoring, and consultation—without naming any specific frameworks, tools, third-party firms, dates, or other unique identifiers that would elevate the specificity.


reasoning: This paragraph contains a materiality disclaimer stating no material cybersecurity incidents have occurred, which qualifies it as Strategy Integration per the tiebreaker rules. A cross-reference to Risk Factors appended to a materiality assessment does not change the classification. No specific facts are present—no named entities beyond the company, no dates, no frameworks, no numbers—just standard boilerplate risk language applicable to any trust or fund.


reasoning: The paragraph describes the company's own internal cybersecurity risk management program elements (vulnerability management, third-party risk process, training, consultants) with no mention of any specific named parties, dates, or verifiable details. While third-party vendor oversight is mentioned, it appears as one component within the broader internal risk management strategy rather than the central topic, making Risk Management Process the appropriate category.


reasoning: The paragraph's main purpose is a materiality conclusion stating that cybersecurity risks have not materially affected the company, which is the hallmark of Strategy Integration. The brief mention of 'experiencing threats' is incidental to the financial impact assessment, and the cross-reference to Risk Factors does not change the classification.


reasoning: The paragraph describes the company's own internal Incident Response Plan and its scope of application, which constitutes a description of internal cybersecurity processes. While third-party contractors and vendors are mentioned, they are referenced only as parties subject to the IRP—not as entities being independently overseen for vendor risk purposes.


reasoning: The paragraph describes the company's internal cybersecurity risk identification and assessment processes using only common security tools and practices (monitoring, vulnerability assessments, penetration testing, tabletop exercises) with no specific dates, named frameworks, named products, or other identifying details, making it generic boilerplate.


reasoning: This paragraph is a pure cross-reference directing readers to the Risk Factors section. It contains no substantive cybersecurity disclosure—no description of governance, processes, incidents, or strategy. Cross-references with no materiality conclusion fall under None/Other.


reasoning: The paragraph primarily describes the company's own internal cybersecurity risk management processes, including incident response strategy, monitoring/testing procedures, and risk reporting mechanisms. While it mentions specific management roles (CIO, Senior Director of Information Security), these are described in the context of their function within the risk management framework rather than as standalone biographical or credential information. The paragraph weaves together governance oversight and internal processes, with the bulk of content focused on what the company DOES rather than who the individuals ARE.


reasoning: The paragraph describes the company's internal risk management process (assess, analyze, evaluate, remediate) and how specific roles function within it, making Risk Management Process the primary category. While it mentions roles (VP CISO, EVP of Global IT), the focus is on what these functions DO within the risk management process, not on the individuals' qualifications or backgrounds.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management processes: its ISO 27001:2013 certification (which is a verifiable firm-specific claim beyond merely naming a standard), the structure of its incident response procedures, and the internal reporting chain (IT Security Team to Legal and Compliance). While the Board and CTO are mentioned as reviewers in the opening sentence, they serve as subjects of a brief governance statement rather than the central focus. The substantive content is about the company's own risk management processes and procedures.


reasoning: The paragraph describes board and Audit Committee oversight of cybersecurity risk, with 'Board of Directors' and 'Audit Committee' as grammatical subjects, making Board Governance the appropriate category. The content contains only generic governance references (Board of Directors, Audit Committee), vague cadences (periodic, each quarter), and standard program language with no named frameworks, specific dates, dollar amounts, or other uniquely identifiable facts.


reasoning: The paragraph describes the company's own internal safeguards and disaster recovery infrastructure (redundant telecom, off-site backups, fire suppression, power generation, disaster recovery plan), which are internal processes rather than an actual incident or vendor oversight.


reasoning: The paragraph focuses on identifying specific management roles (Chief Business Officer, Chief Accounting Officer, Head of Legal) and their cybersecurity responsibilities, with a brief mention of the Cybersecurity Risk Management Committee. Although it describes who holds cybersecurity oversight duties, it contains no cybersecurity-specific titles (CISO, CIO, CTO), no named third-party firms, no specific dates, no named tools/products, and no quantifiable metrics—making it generic boilerplate about management structure that could appear in any company's disclosure.


reasoning: The Audit Committee is the grammatical subject throughout the paragraph, making this a Board Governance disclosure about committee oversight and reporting cadence rather than a description of the management role itself. The chief security officer appears only as the source of reports to the board, not as the focus.


reasoning: The paragraph describes the company's own internal cybersecurity strategy and processes—employee training, technology, policies, and third-party assessments—placing it squarely within Risk Management Process. While third-party consultants are mentioned, they function as a component of the company's internal risk management program rather than the central topic. The specificity is Generic Boilerplate because there are no named frameworks, named third-party firms, specific dates, dollar amounts, named products, or any other fact unique to this company. The practices described (penetration tests, risk assessments, audits, employee training) are standard and could appear in any company's disclosure.


reasoning: The audit committee is the grammatical subject throughout, describing board-level oversight of cybersecurity risks, including the cadence and topics of reports received. While the audit committee itself is a standard governance body, the paragraph specifically identifies that cybersecurity reports come from Apollo's CSO or CISO (cybersecurity-specific titles) — a named internal role responsible for cybersecurity briefing to the board.


reasoning: The paragraph describes management's supervisory activities over cybersecurity (prevention, detection, mitigation, remediation) through various internal means, which constitutes a description of the company's own internal risk management processes. While 'management team' is the grammatical subject, the paragraph focuses on what they do rather than identifying a specific person or their qualifications. The paragraph contains no firm-specific identifiers—no named frameworks, tools, dates, third-party firms, or named programs—and relies entirely on generic cybersecurity terminology that could appear in any company's disclosure.


reasoning: The paragraph describes the company's own internal incident response infrastructure—a cybersecurity incident response plan with specific protocols and a predesignated team led by SDIS and DPO roles—making this a Risk Management Process disclosure. The specificity is Firm-Specific because it identifies cybersecurity-specific leadership roles (SDIS, DPO) and a specific team composition that are unique to this company, even though no external verifiable facts (dates, amounts, named third-party firms) are present.


reasoning: The paragraph's grammatical subject is the CSO as a person, describing their responsibilities, reporting line, and professional background/tenure. While board oversight is mentioned (Technology Committee receives updates), it is incidental to the primary focus on the management role. Contains multiple hard verifiable facts: specific years of tenure (11 years), specific prior experience (10 years in banking), and named committee/program (Management Risk Committee, Enterprise Risk Management program).


reasoning: This paragraph contains a standalone materiality conclusion (no material risks from cybersecurity threats) with no incident narrative, combined with a cross-reference to Risk Factors. Per tiebreaker rules, paragraphs with only financial/materiality language and no incident description are Strategy Integration. The paragraph contains no specific facts—no dates, named entities, frameworks, roles, or other identifiable details—making it purely boilerplate language applicable to any company.


reasoning: Although third-party vendors are the central topic, the paragraph describes the company's OWN processes for managing those vendor risks (assessing practices, requiring contractual controls, monitoring compliance), which is internal risk management. The third-party vendors are the object of the company's oversight, not the subject performing activities. Contains no named frameworks, tools, dates, amounts, or other specific facts.


reasoning: The paragraph describes the company's internal risk management process for integrating cybersecurity into enterprise risk management, with the COO and General Counsel mentioned as functional roles performing risk evaluation—not as named individuals with credentials or background. All elements (audit committee, ERM program, risk prioritization) are standard governance structures with no unique identifiers, named frameworks, specific dates, or third-party firms.


reasoning: The paragraph centers on the Board Risk Committee's oversight responsibility ('primarily responsible for overseeing risk management, including risks associated with cybersecurity'), making Board Governance the primary category. While management roles (CISO, CRO) are mentioned, they serve as the reporting mechanism to the board rather than the main subject.


reasoning: The paragraph's grammatical subjects are the Board of Directors and its Technology and Cybersecurity Committee, with oversight structure as the central topic—CIO/CISO roles appear only as sources of reports to the board, not as primary subjects. Contains firm-specific facts: named Technology and Cybersecurity Committee (a specific, non-generic committee identifier) and cybersecurity-specific executive titles (CIO, CISO).


reasoning: The paragraph's grammatical subject is 'leaders' and 'such individuals,' focusing on the management personnel overseeing cybersecurity and their collective qualifications (average 20+ years experience). While incident response is mentioned, it is incidental to describing WHO manages the program, not the process itself. The specific team composition (Information Security, Compliance, Legal, Internal Auditing) and quantified experience level provide firm-specific detail beyond generic governance language.


reasoning: The paragraph describes the ISO Committee's composition and member expertise, making board/committee governance the grammatical subject. While CISO and CTO appear as participants, the focus is on committee structure. The presence of specific business unit leaders (Co-Presidents of First American Title Insurance Company, Vice-Chairman of data and analytics, President of international division) and a firm-specific title (Chief Intellectual Property and Privacy Officer) distinguishes this from generic governance language.


reasoning: The paragraph centers on the Board's oversight role and reporting cadence for cybersecurity risk, with the Board and Audit Committee as grammatical subjects. The content describes standard board-level governance mechanisms without any firm-specific details—no named internal programs, specific dates, named third-party firms, or unique organizational facts. The mention of the 'Chief Operating Officer' is a generic C-suite title (COO is explicitly excluded from specific facts), and 'periodic reports' uses vague cadence language.


reasoning: The paragraph is about the biographical qualifications, educational credentials, career history, and professional experience of two named individuals (CSO and CISO). Per the PERSON-VS-FUNCTION TEST, when the paragraph focuses on who a person is (their credentials, background, tenure, career history) rather than what a role does (processes, activities, frameworks), the category is Management Role. The specificity is Firm-Specific because CSO and CISO are cybersecurity-specific titles not on the NOT list, and the extensive biographical details provide firm-unique identifying information.


reasoning: The paragraph describes a governance structure for cybersecurity risk oversight using generic entities (Board of Directors, Nominating and Corporate Governance Committee, COO, CFO, General Counsel) with no substantive disclosure of actual cybersecurity processes, incidents, or unique company-specific facts. This is effectively a cross-reference to standard governance roles without describing what the cybersecurity program actually does or contains.


reasoning: The primary purpose of this paragraph is to deliver a materiality conclusion (that cybersecurity risks have not materially affected the company) combined with a cross-reference to Risk Factors. Although it briefly acknowledges past threats/breaches, this is incidental to the main point, which is the disclaimer. Per tiebreaker guidance, a 'brief mention of a past incident + materiality conclusion as the main point' maps to Strategy Integration, not Incident Disclosure.


reasoning: This paragraph describes the company's own internal process for identifying cybersecurity risks that includes third-party vendors. The focus is on what 'We' (the company) do internally, making this a risk management process description rather than a standalone third-party risk disclosure. No specific frameworks, named vendors, dates, or other identifiable details are present.


reasoning: The paragraph focuses on board oversight mechanisms—CIO reporting to the Audit Committee, board member authority to raise concerns, and escalation protocols to the Board of Directors—making Board Governance the primary category. Although CSIRP and Executive Leadership Team are named programs, they are internal organizational identifiers that do not constitute independently verifiable external facts; the paragraph lacks specific dates, dollar amounts, named third parties, or other hard facts that would elevate specificity beyond Generic Boilerplate.


reasoning: This paragraph discusses cybersecurity insurance as a financial protection mechanism, which falls under Strategy Integration. It contains no specific details—no named insurers, coverage amounts, or firm-specific details—making it Generic Boilerplate that any company could use.


reasoning: The paragraph's grammatical subject is 'Our Board' and its committees, with the content focused on board-level risk oversight structure and reporting cadences. The named entities (Audit Committee, CTO, third-party experts) are all generic—Audit Committee is a standard committee, CTO is a generic C-suite title (not a cybersecurity-specific role like CISO), and third-party experts are unnamed. No specific dates, named frameworks, internal programs with unique identifiers, or other identifying details are present.


reasoning: The paragraph describes the company's own internal incident response and business continuity management processes, including plans and reporting cadences, without referencing any actual cybersecurity incident, specific personnel, or third-party risk. No specific dates, dollar amounts, named frameworks, or unique identifiers are present—just standard cybersecurity program language applicable to any company.


reasoning: The paragraph is primarily about the VP of Global Cybersecurity as a person—their credentials (CISO certification), their 20 years of experience, and their reporting chain—making Management Role the appropriate category. The paragraph contains four verifiable facts: the named cybersecurity-specific title, named certification, specific tenure of 20 years, and a named committee, which together meet the Quantified-Verifiable threshold.


reasoning: The paragraph focuses on a board committee's oversight cadence for receiving cybersecurity briefings and updates from the CTO, with 'the Committee' as the primary grammatical subject. All language is generic governance boilerplate ('quarterly,' 'periodically,' 'as necessary') with no named committees, specific dates, named third parties, or firm-unique details.


reasoning: The paragraph focuses on the Company's internal cybersecurity risk management processes and the methods used (threat monitoring, environment scanning, threat intelligence analysis), rather than on the qualifications or background of the Director. The Director is identified as leading the function, but the substantive content describes what the function does. Using the Person-vs-Function test, the paragraph would still convey meaningful information about cybersecurity processes if the person's name and title were removed, confirming this is about the Risk Management Process function.


reasoning: The paragraph's grammatical subject is the board-approved IT Steering Committee, a named committee with specific composition (CIO, CTO, Information Security Officer), which performs oversight of cyber risk and reports to the board—aligning with Board Governance. The named cybersecurity-specific roles (CIO, CTO, ISO) and quarterly meeting cadence provide firm-specific details beyond generic governance language.


reasoning: The paragraph describes Ford's internal incident response processes and escalation workflows rather than individual qualifications or backgrounds, making it about the risk management function. The CISO and CETO titles, along with the specific escalation chain to both CETO and General Counsel, provide firm-specific organizational details beyond generic boilerplate.


reasoning: While the paragraph opens by identifying the CFO as the management role responsible for cybersecurity oversight, the grammatical subject and bulk of content focuses on the company's internal processes (protocols, policies, tools, safeguards, incident response plan, training), making Risk Management Process the primary category. The paragraph is Sector-Adapted because it names ISO 27001 and references an annual third-party assessment, but contains no firm-specific identifiers (no named consultants, no specific dates, no internal program names).


reasoning: The paragraph's grammatical subjects are the Senior Director (a named management role) working with the CFO, General Counsel, and an outside consulting firm to form the Rapid Response Team—placing the focus on identifying WHO manages cybersecurity risk and their team composition rather than describing specific processes or tools they use. The inclusion of named management roles (Senior Director, CFO, General Counsel) and a named policy (Incident Response Policy) makes this Firm-Specific rather than generic boilerplate.


reasoning: The paragraph's primary purpose is a materiality conclusion ('has not...experienced a cybersecurity threat or incident that materially affected its business strategy, results of operations or financial condition') with a forward-looking disclaimer and risk factor cross-references. Per the tiebreaker rules, materiality disclaimers — even boilerplate ones — are classified as Strategy Integration, and a cross-reference appended to a materiality assessment does not change the classification.


reasoning: The paragraph's grammatical subject is 'management team' and it describes management's responsibilities, qualifications, and experience overseeing cybersecurity — characteristics of the role rather than specific processes performed. No firm-specific identifiers (named cybersecurity titles like CISO/CIO/CTO, named programs, specific dates, named tools, or named third-party firms) are present; references like 'third-party service providers' and 'external consultants' are generic. The result is a boilerplate description of cybersecurity governance responsibilities that could apply to any company.


reasoning: This paragraph describes two actual cybersecurity incidents in detail—what happened (targeted attacks), when (December 2021, March 2024), scope (global systems, Canadian subsidiary), operational impact (approximately two weeks, one week disruptions), and response actions (shutdowns, incident response team engagement). The two specific dates and two specific durations constitute multiple independently verifiable facts.


reasoning: The paragraph describes the company's own cybersecurity program activities including WISP reviews, vulnerability management, and incident response drills, placing it squarely in Risk Management Process. The only named framework is NIST (a recognized standard), making this Sector-Adapted — no firm-specific identifiers, named third parties, specific dates, or quantifiable metrics are present.


reasoning: The paragraph's grammatical subjects are primarily the SVP, Head of Legal and Compliance role, describing their specific responsibilities for risk management, incident response, and reporting to the Audit Committee — making this a Management Role disclosure. The specificity is Generic Boilerplate because while the SVP title is cybersecurity-specific, the roles and reporting structures described (Audit Committee oversight, quarterly reports, incident response responsibilities) are standard governance language that could appear in any company's disclosure with no unique firm-specific details, named frameworks, dates, dollar amounts, or named third-party firms.


reasoning: This paragraph describes an actual cybersecurity incident: a specific date (July 19, 2024), the cause (CrowdStrike-caused outage), the affected scope (customer-facing systems), and the response and restoration timeline. This clearly falls under Incident Disclosure as it narrates what happened, when, and the company's response actions.


reasoning: The paragraph's main substantive point is the standalone materiality conclusion at the end ('are not aware of any risks from cybersecurity threats...which have materially affected or are reasonably likely to materially affect it'), which classifies as Strategy Integration per the tiebreakers; all content about third-party assistance is generic boilerplate with no specific named entities, dates, or hard facts.


reasoning: The paragraph's grammatical subject is the management team (CIO/CISO) and the majority of content focuses on their personal qualifications, credentials, experience levels, and certifications rather than describing processes or activities. Per the person-vs-function test, removing the person's names, titles, and credentials would gut the paragraph entirely, confirming this is about the individuals rather than the function they perform.


reasoning: The paragraph focuses on the company's internal incident response process and team structure rather than board oversight (which is only mentioned as a recipient of escalation), a specific person, or an actual incident. The detailed enumeration of 11 departments/functions in the incident response team constitutes a firm-specific organizational detail beyond generic boilerplate.


reasoning: The paragraph describes the company's own internal procedures for cybersecurity incident detection, analysis, mitigation, and escalation—this is clearly an internal risk management process. While the Board and its committees are mentioned as reporting destinations, the grammatical subject is the company's cybersecurity program, not the board's governance role.


reasoning: The paragraph describes management's reporting cadence to an internal committee and the board, which constitutes a component of the company's cybersecurity risk management process. The named Information Technology Steering Committee is a firm-specific identifier distinguishing this from generic boilerplate.


reasoning: The paragraph describes the management reporting structure (cybersecurity team providing quarterly updates to the Audit Committee) which is an internal process, making it Risk Management Process. It contains no firm-specific details, named frameworks, tools, firms, dates, or numbers—all elements are generic boilerplate about standard corporate cybersecurity reporting practices.


reasoning: This paragraph's main point is a materiality conclusion — no cybersecurity incidents have materially affected the company — which maps to Strategy Integration per the tiebreaker rules. The brief acknowledgment of 'threats from time to time' is generic and not a description of actual incidents. No specific facts (dates, amounts, named entities, tools, or standards) are present; the cross-reference to Item 1A Risk Factors is not substantive disclosure.


reasoning: The paragraph describes senior management's risk assessment activities (identifying, assessing, evaluating risks) as a general company process, which aligns with Risk Management Process. It does not identify a specific cybersecurity role (e.g., CISO) or discuss that person's qualifications, which would shift it to Management Role. The language is entirely generic boilerplate—'senior management,' 'severity and likelihood,' and 'past business experience' contain no named entities, dates, frameworks, or other identifiable specifics unique to this company.


reasoning: The paragraph's primary focus is on identifying the VP of IT as the key management role responsible for cybersecurity processes, detailing their qualifications (25 years IT experience, Department of Defense Research background) and reporting structure to the CFO. While risk assessment and management processes are mentioned, they are not described in detail—the emphasis is on who implements them and their credentials. The specific Department of Defense Research background is a verifiable firm-specific fact unique to this individual's professional history.


reasoning: This paragraph is primarily a forward-looking disclaimer expressing uncertainty about future cybersecurity incidents, with a cross-reference to Risk Factors. Although it briefly mentions cybersecurity insurance and contains a forward-looking materiality statement ('could have a material adverse effect on us'), the dominant function is protective boilerplate language rather than substantive disclosure about the company's cybersecurity governance, processes, or strategy.


reasoning: The paragraph focuses on the potential materiality of cybersecurity threats to the Company's business and financial condition, concluding with a cross-reference to Risk Factors. It does not describe actual incidents, internal processes, or governance structures—merely acknowledges that risks exist and references another section for details.


reasoning: This paragraph is a forward-looking risk disclaimer stating they have no prior material incidents but may be impacted in the future, with consequences described in standard boilerplate language. The final sentence is a cross-reference to Risk Factors. No substantive cybersecurity governance, processes, roles, or incidents are described.


reasoning: The paragraph describes an internal working group implementing cybersecurity protection and monitoring processes, with the grammatical subject being the group's activities rather than individual qualifications. Although CISO is mentioned, the paragraph focuses on what the role does (monitoring, reporting, implementing plans) rather than the person's background or credentials, making this about the risk management function.


reasoning: The paragraph's grammatical subjects are the CyTOC committee and the Board, describing their oversight cadence and reporting structure for cybersecurity matters. The named CyTOC committee, CISO role, and specific executive title provide firm-specific context beyond generic boilerplate governance language.


reasoning: This paragraph is a cross-reference directing readers to the Risk Factors section for cybersecurity threat information. It contains no substantive disclosure of its own—no materiality conclusion, no incident narrative, no process description. It is purely a navigational pointer, which maps to None/Other by the annotation guidelines.


reasoning: This paragraph contains a standalone materiality conclusion stating that cybersecurity threats have not materially affected the Company, without describing any actual incidents, board oversight, management roles, or internal processes. Per the classification rules, materiality disclaimers with cross-references to Risk Factors map to Strategy Integration. The paragraph contains no specific dates, named entities, dollar amounts, or other verifiable facts—it is entirely generic boilerplate language.


reasoning: The paragraph focuses on the company's own internal processes for managing cybersecurity risk—specifically risk evaluation, vulnerability detection, and incident notification procedures—with the CISO mentioned as a collaborator rather than as a person with credentials. The presence of the CISO title provides one firm-specific fact, elevating it beyond generic boilerplate.


reasoning: The paragraph's central focus is the Principal Accounting Officer's role in directing cybersecurity programs, monitoring incidents, and receiving reports from consultants, which establishes a specific management function responsible for cybersecurity. Although Board oversight is mentioned, it serves as the context for why management reports upward; the grammatical emphasis and operational substance centers on the PAO's responsibilities.


reasoning: This paragraph is a forward-looking disclaimer and materiality acknowledgment with no description of specific incidents, processes, roles, or firm-specific details. The reference to third-party incidents is incidental context within a boilerplate risk warning, not a substantive disclosure. The prominent cross-reference to Item 1A Risk Factors further indicates this is a standard disclaimer rather than operational disclosure.


reasoning: The paragraph describes an actual cybersecurity incident (the MOVEit Transfer breach affecting the company's customers), including what happened, the scope of impact, response actions taken, and operational outcome. While the incident is real and the company identifies itself as affected, the content uses standard incident disclosure language without hard verifiable facts (no specific dates, dollar amounts, customer counts, or named third-party investigators).


reasoning: The paragraph's grammatical subject is the committee and its members, with the primary focus on identifying specific cybersecurity management roles (CISO, Director of IT Security, Risk and Compliance) and their qualifications rather than describing internal processes the company performs. While the roles' experience encompasses cybersecurity activities, the paragraph is about who holds these positions and their credentials, making Management Role the appropriate category.


reasoning: The paragraph describes the company's own internal information security processes for managing cybersecurity risk, which is the core of Risk Management Process. While it lists what is being protected (networks, systems, data), it contains no named frameworks, specific tools, dates, dollar amounts, headcounts, or any other verifiable specifics that would elevate it beyond generic boilerplate language.


reasoning: The paragraph is about the VP of IT's personal qualifications, credentials, and career history—meeting the criteria for Management Role as a PERSON rather than a function. It contains multiple hard verifiable facts: two specific numbers (over 25 years, three public companies) and two named certifications (CISM, Data Privacy), satisfying the Quantified-Verifiable threshold of two or more hard facts.


reasoning: The paragraph describes the Sponsor's own internal cybersecurity risk management approach through a 'Cybersecurity Policies and Procedures Plan,' which is an internal process topic. However, no specific framework is named, no dates appear, no cybersecurity-specific roles are identified, and no unique identifiers or verifiable facts are present—the language is entirely generic and could apply to any company.


reasoning: The paragraph's grammatical subjects are the VP/CIO and Director of Information Security, and the primary focus is identifying these named cybersecurity-specific roles with their unique qualifications (27 years experience each, specific degrees). While committee structure is described, it serves as context for management's oversight function rather than being the central topic. The named roles and specific credentials clearly identify this company's disclosure.


reasoning: The paragraph describes the company's own Cybersecurity Plan and its objectives, making internal risk management processes the central topic. The mention of NERC CIP and Bulk Electric System standards names recognized industry standards, qualifying as Sector-Adapted rather than Generic Boilerplate.


reasoning: The paragraph describes the company's internal organizational structure for cybersecurity oversight, including an incident response team and a specific advisory board with named functional representations—these are the company's own internal processes. While the Board is mentioned as a recipient of reports, the grammatical subjects are the internal management structures, making this Risk Management Process rather than Board Governance.


reasoning: The paragraph describes Lifecore's own internal cybersecurity risk management program including risk assessments, security monitoring, incident response planning, and third-party risk processes—all core internal processes rather than board oversight or incident disclosure. No specific dates, named third parties, framework names, hard numbers, or unique identifiers appear; the program structure is templated language applicable to any company.


reasoning: The paragraph's grammatical subject is the Vice President of Informatics, and the primary focus is on that person's qualifications (20+ years of IT experience) and their scope of oversight. The PERSON-VS-FUNCTION test is satisfied: removing the person's title and credentials would eliminate the core information. The specificity is Firm-Specific due to the named cybersecurity-relevant role (VP of Informatics) and the specific departmental composition (hardware, software, help desk, and cybersecurity team).


reasoning: The paragraph's grammatical subject is 'our CTO and our CISO' implementing processes, but the main focus is describing the qualified personnel and cross-functional team structure overseeing the cybersecurity program rather than detailing the processes themselves. The 25-year experience figures and specific team composition (Information Technology, Legal, Privacy, Finance, Regulatory, Quality, and Compliance) provide firm-specific identifying details beyond boilerplate governance language.


reasoning: The paragraph describes the AMCA Incident, a real cybersecurity event involving unauthorized access to patient data through an external collection agency, including specific details about when it occurred (May 14, 2019) and the entity involved. While it focuses on litigation/regulatory status, the primary subject is the disclosure of an actual past incident. Contains two hard verifiable facts (specific date + named third-party firm), meeting the threshold for Firm-Specific.


reasoning: The paragraph describes the company's own internal risk management processes (committee, testing cadence, vendor support), making Risk Management Process the appropriate category. No named frameworks, specific dates, dollar amounts, named third-party firms, or named tools appear; all elements are generic security practices applicable to any company.


reasoning: The paragraph describes the company's own security testing practices and framework alignment (NIST CSF, PCI DSS), which are internal risk management processes. It does not describe a specific incident, name a management individual, or focus on vendor oversight.


reasoning: The paragraph describes internal incident response processes and team structure (the cyber incident response plan and cyber emergency response team), with escalation procedures. While it mentions the Audit Committee, this is in the context of the escalation process rather than board oversight as the primary topic. The paragraph contains only standard, generic terms—no named frameworks, specific dates, dollar amounts, headcounts, named products, or named third-party firms.


reasoning: The paragraph describes the company's internal monitoring process for cybersecurity incidents, including how management receives information about prevention, detection, mitigation, and remediation. The mention of 'service providers' and 'ISP personnel' serves only to describe the communication channels within this process, not to address third-party vendor oversight as the primary topic.


reasoning: The paragraph's primary focus is on internal cybersecurity processes (monitoring systems, incident response runbook procedures) rather than board governance or individual management qualifications. All language is generic boilerplate with no named frameworks, dates, amounts, tools, or firm-specific identifiers.


reasoning: The paragraph focuses on board committee oversight structure—board approval of committees, board members chairing committees (ITAC and ERM), and board-level governance of the cybersecurity program—making Board Governance the primary category despite the inclusion of management role details. The paragraph is Firm-Specific because it names non-generic committees (ITAC, ERM, ITSC) and specific cybersecurity-specific officer titles that go beyond generic C-suite roles.


reasoning: The paragraph is from a SPAC that explicitly states it has no operations, no cybersecurity program, and no personnel or processes of its own. Per the annotation rules, the absence of a program is not a description of a program. The references to board oversight and third-party dependence are incidental context, not substantive disclosure of an actual cybersecurity governance or risk management process.


reasoning: The paragraph describes the company's own internal cybersecurity strategy and processes (training, policies, third-party assessments), with no mention of board governance or named management roles. All content consists of generic security practices with no named frameworks, specific dates, dollar amounts, named vendors, or unique organizational details.


reasoning: The paragraph describes the company's own internal incident response escalation procedures and the Incident Management Team, which is the core of its own risk management process. However, all elements mentioned are standard governance structures (disclosure committee, Audit Committee, Incident Management Team) with no firm-specific identifiers, named frameworks, dates, or quantifiable details.


reasoning: The paragraph focuses on the CISO as the grammatical subject and emphasizes their qualifications, experience (36 years in IT/IS, 24 years as CISO), and responsibility for managing cybersecurity risks, making Management Role the appropriate category. The paragraph contains multiple verifiable facts: specific years of experience (36 years, 24 years as CISO), named committee (cybersecurity operations risk steering group), and specific team composition (technology, security, privacy, and legal teams), meeting the Quantified-Verifiable threshold of two or more hard facts.


reasoning: While the paragraph opens by noting board involvement in oversight, the substantive content describes the company's own internal processes: cybersecurity policies, standards, processes, and practices integrated into the risk management program. The board mention serves as introductory context rather than the central topic. The paragraph names NIST and ISO as the frameworks underlying their approach, making it Sector-Adapted rather than Generic Boilerplate.


reasoning: The paragraph leads with the Director of IT and Security as the grammatical subject, emphasizing their leadership role and specific qualification (40 years of experience), supported by description of the CSIRT team composition. While some process activities are mentioned, the primary focus is establishing management structure and personnel, not describing an internal risk management methodology. The combination of a cybersecurity-specific management title, a quantified credential (40 years), and specific team composition (cross-functional professionals) provides multiple verifiable facts.


reasoning: The paragraph describes how the Board receives cybersecurity updates (from the CFO), with the board as the grammatical object and the topic of board oversight cadences. While CFO, DIT, and DIS roles are mentioned, they are standard organizational roles and acronyms without identifying the individuals, their qualifications, or firm-specific structural details. No specific dates, dollar amounts, named third-party firms, or framework standards are present.


reasoning: The paragraph describes board and Audit Committee oversight of cybersecurity risk, which is the grammatical subject of the disclosure, making it Board Governance. However, all elements are generic boilerplate: 'Board of Directors' and 'Audit Committee' are standard governance structures excluded from specific facts, 'CFO' is a generic C-suite title, 'periodic updates' lacks specific cadence dates, and no named frameworks, tools, dates, or firm-specific details appear.


reasoning: This paragraph is a forward-looking risk disclaimer describing general cybersecurity threats and noting that no significant incidents have occurred to date. It contains no substantive disclosure about board oversight, management roles, specific security processes, vendor oversight, actual incidents, or financial/materiality assessments.


reasoning: The paragraph describes the information security team's day-to-day monitoring, assessment, and mitigation activities as part of the company's internal risk management system. Third parties are mentioned only as unnamed service providers ('nationally recognized third parties') and tools are described generically ('various cybersecurity tools and products'), with no specific named frameworks, tools, or firm-specific details. The insurance reference is incidental and lacks specificity. No actual cybersecurity incident is described.


reasoning: The paragraph describes AMG's own internal processes for supporting Affiliates' cybersecurity programs and conducting pre-investment due diligence. While Affiliates are involved, the subject is AMG's internal risk management approach, not vendor oversight as typically defined under Third-Party Risk. No named frameworks, specific dates, dollar amounts, or unique identifiers appear.


reasoning: The paragraph is entirely centered on third-party vendor oversight—assessing vendors, enforcing access controls, and mandating data deletion/return upon termination. No firm-specific details appear: no named vendors, tools, dates, certifications, or unique programs. All language describes standard industry practices for vendor risk management that could appear in any company's filing.


reasoning: While the paragraph opens with board-level oversight, the majority of content focuses on the Chief Security Officer's qualifications and the Information Security team's specific certifications, making Management Role the primary category per the instruction to assign based on main focus when board and management are both present.


reasoning: The paragraph describes the company's internal incident reporting protocols and communication procedures, which falls under risk management processes. While the Board is mentioned, it is incidental to the description of the reporting protocols rather than the central focus on board governance. The content is entirely generic boilerplate with no specific dates, named roles, named frameworks, or other identifiable facts that would distinguish it from any other company's filing.


reasoning: The CISO is the primary grammatical subject throughout the paragraph, with the discussion centering on what the CISO does (coordinates, implements, monitors, reports) rather than the board's independent oversight activities; the board is mentioned only as the recipient of CISO reports.


reasoning: The paragraph describes the company's internal cybersecurity risk management structure — specifically the outsourced security function and reporting relationship to the Principal Financial Officer. This describes the company's own risk management processes, making 'Risk Management Process' the appropriate category. Regarding specificity: the paragraph contains no named third-party firms, specific dates, dollar amounts, headcounts, percentages, named tools, or named certifications — only generic references to 'service providers' without identification, a standard Principal Financial Officer role, and boilerplate language about risk assessment and reporting channels that could appear in any company's disclosure.


reasoning: The paragraph is about a specific person's qualifications, credentials, background, and career history (the VP of Platform and Technology Services), which are hallmarks of Management Role. While the CISO is mentioned, it's in the context of reporting lines to the VP whose qualifications are the focus. The paragraph contains multiple identifiable facts—specific titles, a specific date of hire, duration of experience, and the number of prior employers—that are unique to this company.


reasoning: This paragraph is a generic risk acknowledgment statement describing AFG's awareness of cybersecurity threats without disclosing any substantive details about the company's actual cybersecurity governance, processes, roles, or incident history. It contains no specific facts about board oversight, management roles, risk management processes, or actual incidents—only boilerplate language about being a target for cyber threats and potential consequences.


reasoning: The paragraph focuses on board and Audit Committee oversight of cybersecurity risks through regular reporting, making Board Governance the appropriate category. The paragraph contains only generic governance language ('The Board', 'Audit Committee', 'quarterly') with no specific dates, named frameworks, named roles (CISO/CIO/CTO), named third-party firms, or other firm-specific identifying facts—typical boilerplate that could appear in any company's disclosure.


reasoning: This paragraph contains a materiality disclaimer stating the company has not experienced cybersecurity incidents that materially affect it, with generic risk language about potential business disruptions. While it references cybersecurity, it describes no actual incidents, processes, roles, or specific threats—making it a standalone materiality conclusion rather than substantive disclosure, per the guidance that such disclaimers fall under Strategy Integration even when boilerplate.


reasoning: The paragraph's grammatical subject is 'Our Board' with overall oversight responsibility, and the majority of content describes board/committee governance structures (Board, Audit Committee, management reporting lines). While the no-incident statement relates to incidents, it serves as verification of the governance process rather than an incident narrative. The governance structure described is standard for publicly traded companies without naming non-generic committees, recognized frameworks, or named third-party firms.


reasoning: This paragraph is a standalone materiality conclusion stating that cybersecurity threats have not materially affected the company to date, which explicitly qualifies under Strategy Integration per the classification guidelines. It contains no specific dates, named entities, frameworks, or other identifying details—pure boilerplate risk language that could appear in any company's filing.


reasoning: The grammatical subject is the CIO/CISO as a person, and the paragraph describes both the individual's qualifications (25 years of experience) and his specific oversight responsibilities, fitting the Management Role category.


reasoning: This paragraph is a forward-looking materiality disclaimer with a cross-reference to Risk Factors. It contains no description of actual incidents, no specific dates, named tools, named firms, or any other firm-identifying information. It functions as a legal safe-harvest statement rather than substantive cybersecurity disclosure, making it None/Other.


reasoning: The paragraph centers on vendor and service provider cybersecurity oversight—evaluating third-party risks, seeking 'reputable' vendors, and using contractual terms—which is the central topic of Third-Party Risk. It contains no named standards, specific vendors, dates, dollar amounts, or other identifiable facts unique to this company, making it standard boilerplate that could appear in any company's filing.


reasoning: The paragraph is a forward-looking materiality disclaimer stating the company has not been materially affected by prior incidents and cannot assure future immunity. While it references 'prior cybersecurity incidents,' the main point is the financial/materiality conclusion, not a description of any actual event. Per the tiebreaker rules, materiality disclaimers without incident narratives are Strategy Integration.


reasoning: The paragraph describes the company's internal post-incident review process—reassessing cybersecurity programs, identifying adjustments, and reporting to senior management and the Audit Committee—which is a company internal process rather than describing an actual incident or financial impact.


reasoning: This paragraph is a regulatory preamble discussing the SEC's purpose in adopting Item 106(b)(1) disclosure requirements and references Item 106(b)(2). It contains no substantive disclosure about the company's own cybersecurity practices, governance, or risk management—it merely explains regulatory intent. This is cross-reference/background content that could appear verbatim in any registrant's filing.


reasoning: The paragraph describes the internal cybersecurity team's structure, composition, and operational activities (preventing/detecting risks, analyzing threat intelligence, deploying security tools, reporting to senior management), making Risk Management Process the primary category; while a senior role is mentioned, the focus is on what the team and function DO rather than the individual's personal qualifications.


reasoning: The paragraph describes the company's internal process for evaluating third-party service providers for security compliance and states that the Board/Audit Committee oversees cybersecurity risk—neither element contains firm-specific detail. The vendor evaluation describes a general practice with no named frameworks, tools, or specific requirements, and the board oversight references only the standard Audit Committee without naming any cybersecurity-specific committee or role.


reasoning: This paragraph's primary purpose is a materiality conclusion stating no cybersecurity incident has materially affected the company, with references to Risk Factors and general mentions of investing in cybersecurity. Per the tiebreaker rules, a materiality conclusion is classified as Strategy Integration, not None/Other, even when a cross-reference to Risk Factors is appended. No specific facts are present—no dates, dollar amounts, named frameworks, tools, firms, or unique identifiers—making this generic boilerplate language applicable to any company.


reasoning: This paragraph contains a negative materiality conclusion (no cybersecurity incidents have materially affected the company) with a cross-reference to Risk Factors appended. Per the tiebreaker rules, a materiality conclusion—even when negative—classified as Strategy Integration. The language is entirely boilerplate with no company-specific facts, named frameworks, dates, or other identifiable details.


reasoning: The paragraph's grammatical subjects are 'Our Board' and 'The Audit Committee,' describing board-level oversight responsibilities for cybersecurity risk — clearly fitting Board Governance. The content contains no firm-specific details: Audit Committee is a standard committee found at all public companies, and phrases like 'processes designed to identify and evaluate cybersecurity risks' are boilerplate that could appear in any 10-K filing.


reasoning: The paragraph's grammatical subject is the CISO and IT Security team, describing their qualifications (40 years IT experience, 20+ years in security), reporting structure (CISO → CIO → Executive Chairman/CEO), and team credentials. This is about the person and their background, not about processes the function performs. The two specific experience numbers (40 years and 20+ years) qualify as hard verifiable facts, meeting the Quantified-Verifiable threshold.


reasoning: The paragraph describes the company's internal cybersecurity training processes (learning management platform, new hire training, phishing testing) as the central topic. While the Board and management are mentioned, they appear only as overseers of these programs, not as the grammatical subject. The paragraph contains only generic security practices with no named frameworks, specific dates, named tools, or other identifying details.


reasoning: The paragraph primarily focuses on the IT Director as the grammatical subject, describing their qualifications, leadership role, and reporting line to the CFO. While board and committee oversight are mentioned, they serve as context for the management structure. The IT Director with cybersecurity-specific experience and the explicit reporting line to the CFO represent firm-specific organizational details rather than generic governance language.


reasoning: The paragraph's main thrust is a materiality disclaimer ('have not materially affected us') with only a bare, incidental acknowledgment of past incidents ('from time to time, experienced threats to and breaches') with no specifics about what happened, when, or scope. The cross-reference to Item 1A Risk Factors is appended to this materiality assessment, which does not change the classification per the tiebreaker rules.


reasoning: The paragraph focuses on the CISO's qualifications (31 years of experience, domain expertise in satellite/terrestrial networks) and the SVP of Inmarsat's prior government roles and current integration into the team—clearly about persons and their credentials rather than processes the function performs. This is Management Role per the PERSON-VS-FUNCTION test.


reasoning: The paragraph's grammatical subject is 'Our Board' throughout and describes board-level cybersecurity oversight activities (appointing a director, quarterly briefings, reviewing assessments, participating in exercises). No specific dates, named third-party firms, named products, dollar amounts, headcounts, or other uniquely identifiable facts are present — all elements are standard cybersecurity governance language applicable to any company.


reasoning: The paragraph's primary focus is on governance and oversight structures—named councils/committees, reporting lines to the CEO, and quarterly board-level review of incidents—placing it in Board Governance. While the CISO is mentioned, the paragraph describes the oversight structure and cadences rather than the CISO's qualifications or background, so Management Role is secondary. The specificity is Firm-Specific because it names two specific internal committees (Information Security Council, Executive Information Security Committee) which are non-generic identifiers unique to this company's structure, and describes a specific oversight cadence with the CEO meeting the InfoSec team quarterly.


reasoning: The paragraph explicitly discusses board oversight of cybersecurity risk and describes a governance structure under board direction, making Board Governance the appropriate category. However, it contains no specific facts—no named committees, specific dates, cybersecurity-specific roles (CFO is a generic C-suite title), named programs, or verifiable details—making it purely generic boilerplate language about having board oversight.


reasoning: The paragraph primarily describes the company's own internal processes for assessing, identifying, and managing cybersecurity risks to their information systems. While third-party risk is mentioned, it appears as one component within the broader internal risk management discussion rather than as the central topic. The paragraph contains no named frameworks, specific tools, named vendors, dates, or other identifying details—it consists entirely of generic security terminology that could appear in any company's filing.


reasoning: The paragraph's grammatical subjects are the CTO and VPCS, and the content focuses on their educational credentials (specific degrees from named universities), professional certifications (CISSP, CISM, CISA), and quantified experience (25 years, 20+ years, 10 years in leadership) — all personal qualifications rather than descriptions of processes or functions performed.


reasoning: The paragraph's grammatical subject is 'Our information technology function,' and the content focuses on what the company's own internal IT/cybersecurity function does: managing operations, performing risk assessments, and implementing controls. The reference to third-party service providers is in the context of the company's own internal risk identification processes, not as a standalone vendor oversight discussion. No specific frameworks, named tools, named third-party firms, dates, dollar amounts, or other verifiable facts are present, making this standard cybersecurity process language applicable to any company.


reasoning: The paragraph describes an actual cybersecurity incident including what happened (network attack), scope of impact (operations delays, data exfiltration including PII of employees), response actions (contained, notified, restored), and remediation measures. This is the core definition of Incident Disclosure. The specificity is Firm-Specific because it references a concrete time period (Q3 2022) identifying the incident as past, rather than generic boilerplate language, but lacks the two+ hard verifiable facts (specific dates, dollar amounts, named firms) needed for Quantified-Verifiable.


reasoning: This SPAC explicitly states it has no operations, no personnel, and no cybersecurity processes of its own, instead relying entirely on third parties. Per calibration rules, SPACs and shell companies explicitly stating they have no cybersecurity program or formal processes map to None/Other, regardless of incidental mentions of board reporting or risk acknowledgment.


reasoning: The primary purpose of this paragraph is a materiality disclaimer (cybersecurity risks have not materially affected business strategy, results of operations, or financial condition) with a cross-reference to risk factors. The brief mention of past threats/breaches is incidental and vague ('from time to time,' generic threat types), not a substantive incident narrative. Per tiebreakers, a materiality conclusion as the main point—even with incidental incident mention—classifies as Strategy Integration.


reasoning: This paragraph describes a financial control weakness (material weakness in internal control over financial reporting related to cash disbursements), not a cybersecurity incident. The erroneous payments and subsequent investigation concern accounting processes, not unauthorized access, data breaches, or cybersecurity events. Regardless of its placement in the filing, the content falls outside the scope of cybersecurity disclosure.


reasoning: The paragraph centers on the Information Security Governance Committee's structure and its role in providing board-level cybersecurity oversight, including specific reporting cadences (at least annually) and educational sessions with external advisors — making Board Governance the primary category even though the CIO is mentioned as a committee member.


reasoning: The paragraph's grammatical subject is the company's internal risk assessment process ('we evaluate...we regularly monitor'), placing it in Risk Management Process. The named individuals appear as those who manage the process rather than as the primary subject. The two specific experience counts (25 years and 15 years) tied to cybersecurity-relevant roles qualify this as Firm-Specific, as these are unique facts about this company's disclosure.


reasoning: This paragraph makes a materiality conclusion about cybersecurity risks rather than describing an actual incident or internal process, making it a Strategy Integration disclosure. The paragraph contains no named entities, frameworks, dates, dollar amounts, or other identifying details — only generic risk types and standard materiality boilerplate language.


reasoning: The paragraph's grammatical subject is the CTO, and the second sentence focuses entirely on the person's qualifications (education from a named university, 25 years of experience), making this a Management Role classification per the PERSON-VS-FUNCTION test. The specificity is Firm-Specific due to the named Risk Committee, CTO title, named university, and specific tenure figure.


reasoning: The paragraph's grammatical subject is the CISO, describing their qualifications, responsibilities, and reporting structure to the CDO. Per the person-vs-function test, the opening sentence focuses on the CISO's credentials and experience, making this primarily about the role rather than internal processes. The brief mention of board updates at the end is subordinate to the management role description.


reasoning: The paragraph focuses on the company's internal cybersecurity management approach, including monitoring, detection, prevention, and compliance with regulatory requirements — core components of risk management process. While the Board is briefly mentioned, it is not the grammatical subject; the primary focus is the company's cybersecurity program structure. The paragraph names two specific recognized standards (NIST CSF, ISO 27001) but contains no firm-specific facts unique to Wintrust — only boilerplate descriptions of compliance and framework adoption.


reasoning: The paragraph's primary focus is identifying the ISO role and the cybersecurity team under the CIO, along with their specific qualifications (certifications, degrees, combined experience). This is a description of WHO is responsible and their credentials, which maps to Management Role. The disclosure contains multiple hard verifiable facts: the specific certification (CISA), the specific degree type (master's in cybersecurity), and the quantified combined experience (50+ years), meeting the Quantified-Verifiable threshold of two or more hard facts.


reasoning: The paragraph's grammatical subject is the Chief Technology Officer, describing the person's qualifications, reporting line, and activities in leading the cybersecurity function. While it mentions activities that could fall under Risk Management Process, the primary focus is on the management role itself and the individual's background (25 years of experience, participation in cybersecurity organizations), which are personal qualifications.


reasoning: This paragraph describes an actual cybersecurity incident—the CDK outage—including specific dates (four distinct dates), named systems (DMS, CRM), a named third-party firm (CDK), and operational impacts on the company's business during Q2 and Q3 2024, making it an Incident Disclosure. The multiple specific dates and named entities provide verifiable facts that independently confirm the incident's scope and timeline.


reasoning: The paragraph describes the company's internal approach to risk management using recognized frameworks (ISO and NIST) as guidance for identifying, assessing, and managing cybersecurity risks. The company explicitly disclaims meeting specific technical standards, but the naming of these frameworks constitutes Sector-Adapted specificity.


reasoning: This paragraph describes the company's own internal cybersecurity risk management program components (risk assessments, security team, incident response plan, third-party risk process). While third-party risk is mentioned, it is only one component of the broader internal program, making Risk Management Process the appropriate category. The paragraph contains no named frameworks, specific roles, dates, tools, or other identifiable specifics—it could appear in any company's filing.


reasoning: The paragraph's grammatical subject is 'the program' (enterprise risk management framework) and describes what the internal process does (assess risk, determine tolerance, manage strategies), with the committee and board mentioned as structural components of this process rather than as the primary focus.


reasoning: The paragraph describes the company's internal cybersecurity risk management program and its integration with the enterprise risk management framework, focusing on risk assessment processes. No specific dates, named frameworks, roles, or other identifying details are present.


reasoning: The paragraph describes the composition and function of the company's internal Risk Committee, which reviews cybersecurity risk as part of its enterprise-wide risk assessment process—this is the company's own internal governance/risk management process. While the Risk Committee reports to 'the Committee' (likely the board), the grammatical subject and primary focus is the management-led Risk Committee and its processes, not board oversight per se. The named committee with its detailed executive composition, including cybersecurity-relevant roles like the CIO and Chief Compliance Officer, constitutes firm-specific information.


reasoning: The paragraph describes the company's own internal cybersecurity processes (risk assessments, security controls on storage and systems) without mentioning any board oversight, specific management roles, or actual incidents. No named frameworks, tools, roles, dates, or other identifying details are present—this could appear in virtually any company's filing.


reasoning: The paragraph's grammatical subjects are the Board of Directors and Audit Committee actively involved in cybersecurity oversight, making Board Governance the primary category. The Security Steering Group is introduced as a 'key component' of the oversight structure rather than the central topic. The specific role composition (CISO, Chief Product Officer, VP of Cloud Technology) elevates specificity to Firm-Specific, as these named roles identify unique organizational structure elements beyond standard generic governance references.