reasoning: The paragraph primarily identifies the ISSC management committee, its composition (CTO, CLO, CIO, CISO), and the qualifications of its members (CISSP, CCISO, ISO 27001 certification experience). While it touches on what the committee does (monthly reports, supervising personnel), the dominant purpose is identifying WHO manages cybersecurity and their credentials — the person/team, not the function. Two QV-eligible hard facts: CISSP and CCISO named certifications.

thinking:
Let me analyze this paragraph.

Content: Describes the ISSC committee composition (CTO, CLO, CIO, CISO), their responsibilities, reporting cadence, and team member qualifications (ISO 27001 certification experience, CISSP, CCISO).

Category: This is about management - the ISSC committee and its members' roles and qualifications. The paragraph tells us WHO these people are and what qualifications they hold. But it also describes what the ISSC does (assessing/managing risks, receiving reports, supervising personnel).

Person-vs-function test: The paragraph describes both the committee composition and qualifications AND what the committee does. The qualifications (ISO 27001 certification, CISSP, CCISO) are about the people. The committee composition (CTO, CLO, CIO, CISO) is about who's on it. But there's also process content (monthly reports, risk management program, supervising personnel and consultants).

The ISSC is fundamentally a management committee, and this paragraph is primarily about identifying who oversees cybersecurity and their professional credentials. The specific named committee with its roster of executive roles (CTO, CIO, CISO) and required certifications (CISSP, CCISO) establishes the governance structure and expertise requirements.

Now I'm evaluating whether this meets the Quantified-Verifiable threshold. The paragraph mentions two named certifications—CISSP and CCISO—which are specific, verifiable credentials. Even though they're attributed to team members rather than named individuals, these are concrete certification claims that can be verified, similar to how the calibration example treats named certifications as QV-eligible facts. I'd classify this as Quantified-Verifiable based on those two named certifications.

fact: ISSC (Information Security Steering Committee) named as management committee

fact: CTO, CIO, CISO named as committee members

fact: Chief Legal Officer on committee

fact: CISSP certification held by team members

fact: CCISO certification held by team members

fact: ISO 27001 certification completion experience


content_category: Management Role

category_confidence: medium

specificity_confidence: high

reasoning: The paragraph's primary content is the organizational structure of the cybersecurity leadership team — service-aligned leads all reporting to the CISO — which describes reporting lines and team design (Management Role). The second sentence about law enforcement and industry group relationships is a subordinate Risk Management Process element. The CISO title is a cybersecurity-specific role on the IS list, yielding Firm-Specific, but there is only one hard fact so it does not reach Quantified-Verifiable.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Classify this paragraph.

The paragraph describes the structure of the cybersecurity leadership team (reporting to CISO) and mentions relationships with external groups. Let me apply the person-vs-function test.

The first sentence describes team structure - leads for each service offering reporting to the CISO. This is about organizational structure/reporting lines. The second sentence is about relationships with law enforcement and industry groups for intelligence/risk management.

Is this about the person (Management Role) or the function (Risk Management Process)?

The paragraph describes team structure (leads reporting to CISO) - this is organizational structure. But it's not about a specific person's credentials, background, or qualifications.

The core issue is whether this falls under Management Role, which covers management committees and reporting lines. The paragraph is fundamentally about how the cybersecurity team is organized with leads reporting to the CISO, plus their external relationships. Even though it mentions the CISO, the focus is on the organizational structure itself rather than that individual's qualifications, so this maps to Management Role.

For classification purposes, I'm seeing only one IS-specific fact (the CISO title), no quantifiable data like headcounts or dates, and unnamed external entities. That puts it in the Firm-Specific category.

fact: CISO


content_category: Strategy Integration

category_confidence: high

reasoning: The paragraph makes an explicit materiality assessment — that cybersecurity risks/incidents have not materially affected and are not reasonably likely to materially affect business strategy, results of operations, or financial condition. Per Rule 6, this is Strategy Integration. The language is boilerplate with no firm-specific facts.

thinking: Materiality assessment paragraph.


reasoning: The paragraph contains an explicit materiality assessment ('have not materially affected us' and 'reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition'), making it Strategy Integration per Rule 6. The cross-references to specific risk factor titles are company self-references (NOT list), and no named frameworks, cybersecurity-specific roles, or other IS-list facts are present, so specificity remains Generic Boilerplate.

thinking:
Classify this paragraph.

Content: Opens with generic security disclaimer, then has a materiality assessment ("have not materially affected us" + "reasonably likely to materially affect us"), then cross-references to Risk Factors.

Category: Strategy Integration — contains explicit materiality assessment per Rule 6.

Specificity: The cross-reference names specific risk factor titles, but those are just the company's own filing section names — company self-references on the NOT list. No named frameworks, no firm-specific facts from the IS list. → Generic Boilerplate.


reasoning: The paragraph contains an explicit materiality assessment ('have not materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition'), which per Rule 6 makes it Strategy Integration regardless of the appended cross-reference to Item 1A. No specific facts — the language is standard boilerplate materiality disclaimer found across thousands of filings.

thinking:
Let me classify this paragraph.

Content: Materiality assessment + cross-reference to Risk Factors. Per Rule 6, any paragraph with an explicit materiality conclusion is Strategy Integration, even with a cross-reference appended.

Specificity: Boilerplate materiality language, no specific facts. Generic Boilerplate.


reasoning: The paragraph contains an explicit materiality assessment ('have not materially affected... our business, results of operations, or financial condition'), which per Rule 6 makes it Strategy Integration. The cross-reference to Risk Factors and generic threat language are noise. No specific facts from the IS list are present — 'last two fiscal years' is vague, not a specific date.


content_category: Third-Party Risk

reasoning: The paragraph's central topic is managing cybersecurity risk associated with third-party service providers — contractual provisions imposed on vendors for data protection and use of a third-party to maintain information systems. No named firms, frameworks, dates, or specific details are provided; all language is generic and interchangeable across companies.

thinking:
Let me analyze this paragraph.

Content: Discusses third-party service providers, contractual provisions for data protection, and use of a third-party to maintain information systems.

Category: The central topic is oversight of external parties - contractual requirements imposed on vendors, and use of third-party providers. This is Third-Party Risk.

Specificity: No named frameworks, no named firms, no specific dates, no numbers, no cybersecurity-specific titles. Everything is generic ("third-party collaborators or vendors", "provisions safeguarding", "technical safeguards"). → Generic Boilerplate.


content_category: Risk Management Process

reasoning: The paragraph describes an internal disaster recovery program for IT services, which is a risk management process. It contains no named frameworks, specific facts, or firm-specific details — 'disaster recovery program' is a generic program name and the description is boilerplate.

thinking:
Classify this paragraph.

Content: Describes a disaster recovery program for IT services. This is about internal processes.

Category: Risk Management Process - describes an internal program (disaster recovery).

Specificity: "disaster recovery program" is a generic program name. No named frameworks, no specific facts. Generic Boilerplate.


content_category: Board Governance

reasoning: The board of directors and audit committee are the grammatical subjects performing oversight of cybersecurity risks, making this Board Governance. All entities mentioned ('board of directors', 'audit committee', 'management') are on the IS-NOT list as generic governance terms, with no named frameworks, cybersecurity-specific roles, or firm-specific facts — this language could appear in any company's filing unchanged.

thinking:
Let me classify this paragraph.

Content: Board/audit committee oversight of cybersecurity risks. Board is the grammatical subject in key clauses. → Board Governance

Specificity: "board of directors", "audit committee" — both generic. No named frameworks, no cybersecurity-specific roles, no firm-specific facts. Everything here is boilerplate. → Generic Boilerplate


reasoning: The paragraph makes an explicit materiality assessment ('have not materially affected... business strategy, results of operations, or financial condition'), which per Rule 6 is Strategy Integration even when boilerplate. The second sentence is a generic risk caveat. No specific facts from the IS list are present — 'In 2025' is a fiscal year reference but is essentially the current reporting period rather than a distinguishing date, and the remaining language is standard materiality disclaimer found across thousands of filings.


reasoning: The paragraph contains an explicit materiality assessment ('materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition'), which per Rule 6 is Strategy Integration even when boilerplate. The remainder is generic risk disclaimer language. No named entities, frameworks, dates, or firm-specific facts are present.

thinking:
Classify this paragraph.

This contains a materiality assessment ("materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition") → Strategy Integration per Rule 6.

The rest is generic risk language. No specific facts.

Specificity: Generic Boilerplate - pure boilerplate materiality language.


specificity_confidence: medium

reasoning: The paragraph's dominant content describes how the company manages cybersecurity: CEO engagement with outsourced vendors for network operations, investments in infrastructure hardware/software, and vendor reporting. While the final sentence contains a materiality/no-incident statement (Strategy Integration per Rule 6), the bulk of the paragraph describes the company's internal cybersecurity management approach, making Risk Management Process dominant. CEO is generic C-suite (NOT list) and 'outsourced vendors' are unnamed, but the specific fiscal year end date (May 31, 2025) is one firm-specific fact, yielding Firm-Specific.

thinking:
Let me analyze this paragraph carefully.

Content category: This paragraph covers multiple topics. Let me break it down:
- "We manage data security and privacy at the highest levels" - generic
- "Our CEO is actively engaged in oversight of cybersecurity and IT infrastructure" - CEO oversight, but CEO is generic C-suite
- "works with outsourced vendors to manage all network operations" - touches third-party
- "Our vendors keep our CEO informed on cybersecurity and privacy matters" - vendor relationship/reporting
- "We have strengthened our data protection capabilities through investments in our infrastructure" - strategy/investment
- "During the fiscal year ended May 31, 2025, the Company did not experience any material cybersecurity incidents" - materiality assessment

The real question is what's the dominant theme here. The paragraph is essentially describing the company's cybersecurity governance structure—CEO oversight, vendor partnerships, infrastructure investments—but then ends with a materiality statement about no incidents occurring. That final sentence is the key disclosure under Rule 6, though the bulk of the paragraph is really about how they've organized their cybersecurity function.

Looking at it this way, Risk Management Process fits better than a materiality assessment, since most of the content explains their actual approach rather than just stating they had no incidents. The CEO mention is generic C-suite, not a specialized role, and the vendors and investments are unnamed, so neither triggers the list requirement. The fiscal year reference is just a date anchor.

That leaves one concrete fact—the fiscal year ending May 31, 2025—which makes this Firm-Specific.

fact: fiscal year ended May 31, 2025


reasoning: The paragraph opens by establishing the CEO as the sole board member responsible for cybersecurity oversight, then describes how management (CEO and President) manages and reports cybersecurity matters back to the Board. The board-as-overseer framing dominates, and the management activity is presented as delegated from and reporting to the Board, fitting Rule 2 ('Board delegates responsibility to management → Board Governance'). No cybersecurity-specific titles (only generic CEO/President), no named frameworks, dates, tools, or other IS-list facts are present — entirely boilerplate language applicable to any small company.

thinking:
Let me analyze this paragraph carefully.

This is from a small company where the CEO is the sole board member. Let me classify it.

Content: The paragraph covers board oversight (CEO is sole board member responsible for oversight), management role (CEO and President manage cybersecurity), incident reporting procedures, and staffing adequacy.

The primary communicative purpose: This is a blended paragraph. The CEO as sole board member oversees cyber risk (Board Governance), CEO and President manage and assess practices (Management Role), incident reporting procedures (Risk Management Process), and staffing belief (generic).

The grammatical subjects shift: "Our CEO is the sole member of our Board... responsible for oversight" - this is Board Governance framing.

The paragraph then transitions to the CEO and President's management responsibilities, followed by incident reporting procedures. Since the CEO serves as both the board and management, the distinction between board oversight and management roles gets blurred together. The structure moves from board governance into operational management and then incident response, with the CEO's dual role making these categories overlap rather than remain separate. The incident reporting process is the longest part, but the whole paragraph is really about governance structure—who oversees what and how they report back to the board. Since the board oversight frames everything and management reports to it, this fits Board Governance under Rule 2. Looking at the specifics, there's nothing concrete here—just generic C-suite roles like CEO and President, no named frameworks or dates or cybersecurity-specific titles. This is Generic Boilerplate with no IS-list facts.


reasoning: The paragraph covers both board oversight and management roles, but Board Governance is dominant: the Board receiving updates, the Audit Committee's role in cybersecurity reporting, and board members' experience/qualifications occupy the majority of the text, with management details (CEO, Director of IT Security) serving as supporting context for the oversight structure. The 'Director of IT Security & Future Solutions' is a cybersecurity-specific title on the IS list, yielding Firm-Specific; other elements (Audit Committee, CEO, 'periodic', 'regularly') are all on the NOT list and do not elevate specificity further.

thinking:
Let me analyze this paragraph carefully.

This is a dense paragraph covering multiple topics. Let me identify the dominant category.

Content:
1. Board receives updates from management and Audit Committee - Board Governance
2. Management responsible for identifying/assessing cyber risks - Management Role
3. Cybersecurity programs under CEO direction - Management Role
4. Management updates Audit Committee - Board Governance
5. Directors lack formal cyber certs but have experience - Board Governance
6. Board receives periodic updates - Board Governance
7. Day-to-day responsibility with Director of IT Security & Future Solutions - Management Role
8. Team monitors networks, implements safeguards, training, IR - Risk Management Process

The paragraph weaves together board oversight responsibilities with management's operational structure, opening with the Board's role in receiving updates before detailing how management organizes cybersecurity efforts under the CEO, then circling back to the Board's expertise and periodic reporting, ultimately ending with the Director of IT Security's day-to-day leadership. Looking at what qualifies as a specific fact here—the "Director of IT Security & Future Solutions" is a unique, cybersecurity-specific role title that's particular to this firm, so that's my one IS fact. Everything else on the list falls into generic categories like C-suite positions, standard committees, or vague cadences. That gives me Firm-Specific classification with just the single fact.


reasoning: The paragraph contains an explicit materiality assessment ('We have not experienced any cybersecurity incidents to date... that have materially impacted our business, financial condition, or results of operations'), which per Rule 6 makes this Strategy Integration regardless of the appended cross-reference to Risk Factors. The opening threat language and cross-reference are secondary. No facts from the IS list are present — 'third-party vendors' is unnamed/generic, 'Brighthouse Financial' is a company self-reference (NOT list), and the rest is boilerplate materiality and risk language.

thinking:
Let me analyze this paragraph.

The paragraph has three parts:
1. Description of threats to systems and third-party vendors
2. A materiality assessment: "We have not experienced any cybersecurity incidents to date... that have materially impacted our business, financial condition, or results of operations"
3. A cross-reference to Risk Factors

Per Rule 6 and the codebook, any paragraph with an explicit materiality assessment is Strategy Integration, even with cross-references appended.

Specificity: The materiality language is boilerplate. No named frameworks, no firm-specific facts from the IS list. The cross-reference mentions Brighthouse Financial by name but company self-references are on the NOT list.

So this falls into Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity processes: threat assessment, monitoring, vulnerability assessments, penetration testing, tabletop exercises, internal audits, and third-party control evaluations. It names the NIST Framework as an alignment standard but contains no firm-specific facts — no named roles, tools, firms, dates, or headcounts. 'Cybersecurity team,' 'third-party consultants,' and common practices like tabletop exercises and penetration testing are all on the NOT list.

thinking:
Let me analyze this paragraph.

Content: Describes the company's internal cybersecurity processes - threat assessment, monitoring, tools, testing, audits, third-party assessments against NIST. This is clearly Risk Management Process.

Specificity: Names NIST Framework (twice). No firm-specific facts from the IS list - no named roles (CISO etc.), no named committees, no specific dates, no named tools/products, no named firms, no headcounts. "Cybersecurity team" is generic. "Third-party consultants" is unnamed. Practices like penetration testing, tabletop exercises, vulnerability assessments are common practices on the NOT list.

The mention of NIST Framework qualifies this as Sector-Adapted since it references a named standard, but there's nothing beyond that framework reference that would push it into the IS-list category.

fact: NIST Framework

type: framework


reasoning: The paragraph describes the company's internal cybersecurity processes, technologies, controls, and investments for assessing and managing cyber risk — squarely Risk Management Process. No named frameworks, tools, roles, dates, or firm-specific facts are present; 'Information Technology controls framework' is a generic program name, and 'management' is on the NOT list. The language could be pasted into any company's filing unchanged.

thinking:
Let me analyze this paragraph.

Content: Describes the company's approach to cybersecurity risk management - assessing, identifying, managing risks, monitoring processes, making investments, establishing controls. This is about internal processes and programs.

Category: Risk Management Process - describes internal cybersecurity processes, technologies, controls, investments, and framework.

Specificity: Let me check for specific facts:
- No named frameworks (NIST, ISO, etc.)
- No named roles (CISO, CIO, etc.)
- No specific dates, dollar amounts, headcounts
- No named tools or firms
- "Information Technology controls framework" - generic program name

- Everything here is generic boilerplate language without concrete details.

→ Generic Boilerplate (1)


reasoning: The paragraph describes the company's internal cybersecurity governance function — the Executive Security Council's role in developing the risk program, managing threat response, meeting cadence, and engaging third parties. The ESC is the grammatical subject performing process-oriented activities (developing, implementing, managing, meeting), making this about the function rather than any individual person. The named non-generic committee (Executive Security Council) and CISSP certification reference are firm-specific facts, but only CISSP is QV-eligible (one hard fact), so specificity is Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the "Executive Security Council" governing cybersecurity, its responsibilities, meeting cadence, and mentions IT and Security team, third-party involvement, and CISSP certification.

Category: This is about the company's internal cybersecurity processes - risk program, threat response, meeting about incidents, engaging third parties. The Executive Security Council is a management-level body (not the board). The board is mentioned only as having oversight. The primary content is about what the ESC does - developing/implementing the risk program, managing response, meeting regularly. This is Risk Management Process - the paragraph describes the function, not the people.

Wait - "Executive Security Council" - is this a named non-generic committee? Yes, it's a named committee specific to this company.

Now I'm checking which elements qualify as firm-specific facts. The Executive Security Council is a named committee, so that's in scope. CISSP is a named certification that could be QV-eligible. The board of directors, third-party service providers, and generic references like "consultants, auditors, and other third parties" don't count as specific facts. "IT and Security team" is borderline but leans toward being a specific team name. "Regularly" is too vague to be a fact. So I'm looking at the Executive Security Council as the main firm-specific item here, with CISSP as a potential QV-eligible certification.

Since there's only one QV-eligible fact, this doesn't meet the QV threshold. But the firm-specific elements are there with the Executive Security Council and CISSP. For categorization, this paragraph is describing a process—what the Executive Security Council does in terms of developing and implementing the risk program, managing response, and meeting regularly about incidents. It's about the function and structure, not about specific individuals.

fact: Executive Security Council

fact: Certified Information Systems Security Professional (CISSP) certification


reasoning: The paragraph describes what the CIO and IT team do — monitoring, security measures, audits, incident response planning. Applying the person-vs-function test, the content is about processes and activities, not the CIO's qualifications or background; replacing 'CIO and IT team' with 'the Company' leaves the paragraph intact. The CIO (cybersecurity-specific title) and the cybersecurity risk management committee (non-generic committee) are firm-specific facts, but neither is QV-eligible, so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes the CIO and IT team's activities - monitoring, security measures, audits, incident response plan. The CIO is mentioned as attribution, but the paragraph is about what they DO (processes, monitoring, security measures, audits, IR plan). This is the person-vs-function test - remove "Our CIO and information technology team" and replace with "The Company" and it still makes sense as a process description.

Category: Risk Management Process

Specific facts:
- CIO - cybersecurity-specific title per the IS list
- "cybersecurity risk management committee" - this could be a named non-generic committee... but it's not capitalized consistently. Let me check - "cybersecurity risk management committee" - this seems like a specific committee name. But looking at the IS list: "Named non-generic committees: Technology Committee, Cybersecurity Committee, Risk Committee, ERM Committee." A "cybersecurity risk management committee" would qualify as a non-generic committee.

- Audit Committee - NOT list item

So I'm identifying the firm-specific facts here: CIO as a named role and the cybersecurity risk management committee as a named committee. Neither qualifies for QV eligibility, so this falls under firm-specific specificity.

fact: CIO

fact: cybersecurity risk management committee


reasoning: The Audit Committee is the grammatical subject overseeing cybersecurity risk, with management reporting to it and it reporting to the full Board — classic board governance structure. All entities mentioned (Audit Committee, Board of Directors, management) and cadences ('periodic') are on the NOT list, leaving no firm-specific facts.

thinking:
Let me analyze this paragraph.

Content: Board/Audit Committee oversight, periodic reports from management, reporting to full Board.

Category: Board Governance - the Audit Committee is the grammatical subject performing oversight actions.

Specificity: Let me check the facts:
- "Audit Committee" - on the NOT list (generic governance)
- "Board of Directors" - on the NOT list
- "management" - on the NOT list
- "periodic reports" - generic cadence

No named frameworks, no IS-list facts. → Generic Boilerplate


reasoning: The paragraph describes the company's internal process for assessing and managing cybersecurity risks — senior management conducts assessments, employees report suspicious activity, and the Audit Committee evaluates policies. Applying the person-vs-function test, the content is about what the process does (assessment, reporting, evaluation) rather than who the people are (no credentials, background, or named individuals). The Audit Committee and board mention is one subordinate sentence, while the dominant frame is the overall risk management workflow. No IS-list facts are present: 'senior management,' 'Audit Committee,' 'quarterly,' and 'third-party service providers' all fall on the NOT list.

thinking:
Let me analyze this paragraph carefully.

The paragraph has three parts:
1. Senior management conducts regular assessment of cyber risks, including review with IT team and third-party service providers.
2. Employees/consultants report suspicious activity to senior management.
3. Audit Committee evaluates cybersecurity policies, including quarterly interviews.

Dominant category: This spans Management Role, Risk Management Process, and Board Governance. The paragraph describes what senior management does (assessment), what employees do (reporting), and what the Audit Committee does (evaluates).

The primary communicative purpose seems to be describing the overall risk management process - how the company assesses and manages cybersecurity risks. The management team is the subject but described in terms of function (conducting assessments), not person (credentials, background). The Audit Committee mention is one sentence. The dominant theme is the process of assessment and management.

Actually, I'm reconsidering the weight here. Management assessments and Audit Committee evaluation carry roughly equal emphasis, but the real focus is the process itself—who performs what function in the risk management chain. When I apply the person-versus-function test and swap in "the Company" for the role titles, the paragraph still reads as a description of processes like assessment, reporting, and evaluation, which points to Risk Management Process as the category. The specifics are all generic references—no named individuals, just role titles and departments—with only "quarterly" providing any concrete detail.


reasoning: The paragraph's primary content is the management governance structure: identifying cybersecurity leadership roles (CISO, Data Privacy Officer), their reporting lines (to CIO and CLO respectively), and a cybersecurity council with its specific departmental composition. While it briefly mentions what these roles do, the dominant purpose is describing who fills these positions and how they are organized — the person/structure, not the function. Multiple firm-specific facts (CISO, Data Privacy Officer, named council with specific composition) but no QV-eligible hard facts (no dates, dollar amounts, headcounts, named firms/tools/certifications).

thinking:
Let me analyze this paragraph.

Content: Describes CISO reporting to CIO, InfoSec function, Data Privacy Officer reporting to CLO, cybersecurity council composition and meeting cadence.

This is about management roles and structure - who fills cybersecurity leadership positions, their reporting lines, and the management committee. The primary content is about the people/roles and organizational structure, not about processes themselves.

Wait - let me apply the person-vs-function test. The paragraph names roles (CISO, Data Privacy Officer) and their reporting lines, plus a cybersecurity council with its composition. It's about organizational structure and who is responsible. But it also mentions what the InfoSec function does ("maintaining and monitoring cybersecurity infrastructure") and what the council does ("review and discuss compliance, cybersecurity risk, and preventive programs").

So this is definitely Management Role - the core is the governance structure with specific cybersecurity leadership positions like CISO and Data Privacy Officer, their reporting relationships, and the council's composition including IT security, compliance, and communications representatives. I've got multiple verifiable facts here: the CISO role, the CIO reporting line, the Data Privacy Officer, the named InfoSec function, and the cybersecurity council with its specific composition.

But looking at what qualifies as hard verifiable facts - the named roles themselves don't count as QV-eligible since they're just titles without external verification. The council composition is firm-specific but not independently verifiable. There are no dates, financial figures, headcount numbers, third-party vendors, specific tools, certifications, or concrete metrics mentioned. So this lands as Firm-Specific with multiple internal facts but nothing that reaches the 2+ hard verifiable facts threshold needed for QV.

fact: CISO reporting into the Chief Information Officer

fact: Data Privacy Officer reporting into the Chief Legal Officer

fact: Information Security ("InfoSec") function

fact: Cybersecurity council composed of management with expertise in IT security, compliance, and communications


reasoning: The paragraph describes the integration of cybersecurity risk assessment into the company's overall enterprise risk management efforts, which is a core Risk Management Process topic (ERM integration). It contains no named frameworks, no cybersecurity-specific roles, no specific dates, and no firm-specific facts — 'ERM' is a generic concept present at every public company. The cross-reference to the 'Cybersecurity Governance' section is not substantive disclosure content.

thinking:
Classify this paragraph.

Content: States that cybersecurity risk management is integrated into ERM. This is about the company's internal risk management process.

Category: Risk Management Process - describes ERM integration of cybersecurity risks.

Specificity: No named frameworks, no firm-specific facts. "ERM" is a generic concept. The paragraph names "ERM" with the abbreviation, but that's standard. It cross-references another section ("Cybersecurity Governance"). No IS-list facts present.

This is Generic Boilerplate.


reasoning: The paragraph describes the governance information flow: how the Audit Committee and full board receive cybersecurity updates from the CTO, including cadence (quarterly, as-needed) and escalation thresholds. While the CTO is a frequent grammatical subject, the primary communicative purpose is the board-level oversight structure — how governance bodies stay informed — with the Audit Committee Chair relaying to the full board reinforcing this frame. CTO is a cybersecurity-specific title on the IS list, triggering Firm-Specific; no second QV-eligible hard fact prevents Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

The paragraph describes the CTO's reporting responsibilities regarding cybersecurity to senior management, the Audit Committee, and the board. It also describes the Audit Committee Chair's role in providing updates to the board.

Category: This is about reporting lines and information flow. The grammatical subjects alternate between "Our CTO" and "the Chair of our Audit Committee." The CTO is reporting TO the board/committee, and the Audit Committee Chair is reporting TO the board. The primary content is about communication channels and reporting cadence for cybersecurity matters.

The CTO is the primary actor reporting upward. But this is really about the governance structure - how information flows from management to the board. The Board/Audit Committee is receiving reports. Let me think about this more carefully.

Looking at the classification rules, the CTO is the main actor throughout—reporting to the Audit Committee and board on cybersecurity matters, with the Audit Committee Chair then relaying information to the full board. This straddles both governance and management reporting, but the CTO's direct reporting relationship to the board makes it lean toward Management Role. Looking at the rule table more carefully, the CTO is the primary grammatical subject and is actively reporting to governance bodies, which fits the Management Role pattern. Even though the Audit Committee Chair also reports to the board, the CTO's reporting dominates the text, so I'm categorizing this as Management Role. So this is actually about Board Governance—how cybersecurity information flows to the Audit Committee and the oversight structure, with the CTO serving as the reporting mechanism rather than being the focus. Looking at specificity, the CTO title is firm-specific, but "Audit Committee" and "quarterly" cadence are generic, and the IAC management reference is only somewhat specific. There's really just one QV-eligible fact here, which isn't enough to change the classification.

fact: CTO responsible for reporting on information security program


content_category: Incident Disclosure

reasoning: The paragraph's primary content is a description of an actual cybersecurity incident — a 2019 wire fraud scheme involving email compromise and an unauthorized wire transfer — along with remediation actions taken (MFA deployment, enhanced controls). While it opens with generic risk language and closes with process improvements, the incident narrative is dominant. Only one hard verifiable fact (the year 2019) qualifies; MFA and 'enhanced internal controls' are common practices on the NOT list, so specificity stays at Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes a past cybersecurity incident (2019 wire fraud scheme), response actions (MFA implementation), and some generic risk language.

Category: The paragraph describes an actual cybersecurity incident - the 2019 wire fraud scheme, what happened, and remediation. The dominant content is the incident narrative. → Incident Disclosure

Specific facts:
- "2019" - specific date
- "wire fraud scheme" - specific incident type
- "multi-factor authentication (MFA)" - this is a common practice, not a named product/tool
- "compromised the email account of one of our employees" - describes what happened

The Legal Proceedings reference is just noise. Looking at what's actually verifiable here, I've got the year 2019 as my one concrete fact. There are no named roles, committees, tools, firms, or specific numbers beyond that date, so this lands as Firm-Specific with just that single fact from the IS list.

fact: 2019 wire fraud incident


reasoning: The paragraph describes an actual cybersecurity incident — a zero-day vulnerability in MOVEit software discovered around May 31, 2023, disclosed via 8-K on July 14, 2023. It narrates what happened (vendor informed of vulnerability), names the affected system (MOVEit), and identifies impacted divisions. Two specific dates plus a named product yield three QV-eligible hard verifiable facts.

thinking:
Incident disclosure - describes a specific cybersecurity incident with dates, named software, named divisions.

Facts: May 31, 2023 (date), July 14, 2023 (date), MOVEit (named product), zero-day vulnerability specifics. That's multiple QV facts.

fact: Form 8-K filed on July 14, 2023

fact: On or about May 31, 2023

fact: MOVEit managed file transfer software


reasoning: The paragraph describes Zscaler's internal cybersecurity processes: threat research, product security reviews, penetration testing, and risk assessments. The named team (ThreatLabz) and headcount (150+) are firm-specific facts. However, only the headcount is QV-eligible (named internal programs don't count toward QV), so with one QV-eligible fact the paragraph reaches Firm-Specific, not Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes Zscaler's internal security processes - threat research team (ThreatLabz), 150+ experts, methodologies, product security checks, penetration testing, risk assessments.

Category: Risk Management Process - describes the company's own internal cybersecurity processes, tools, and methodologies.

Specific facts:
- "Zscaler ThreatLabz" - named internal program/team with unique identifier
- "more than 150 security experts" - headcount (quantified)
- Methodologies mentioned (malware reverse engineering, behavior analytics, data science, AI) - common practices, not specific facts

- "more than 150 security experts" qualifies as a QV-eligible fact (headcount), while "Zscaler ThreatLabz" is firm-specific but doesn't count toward QV since it's a named internal program. With only one QV-eligible fact, this falls into the Firm-Specific category overall.

fact: Zscaler ThreatLabz — named internal threat research team

fact: More than 150 security experts

type: quantified


reasoning: The entire paragraph describes the qualifications, experience, and credentials of two cybersecurity leadership roles (CTO and CISO) — this is purely about the persons, not the function. Multiple QV-eligible hard facts: specific years of experience (25 years for CTO, 25 years for CISO, 10 years as public company cybersecurity leader) and a named degree (PhD in engineering) — well over two quantified/verifiable facts.

fact: CTO role

fact: CISO role

fact: over 25 years experience (CTO)

fact: PhD in engineering (CTO)

fact: over 25 years experience (CISO)

fact: more than 10 years as cybersecurity leader for public companies (CISO)


reasoning: The paragraph opens with an explicit materiality assessment ('have not materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition'), which is the substantive content per Rule 6. The remainder is generic forward-looking risk language and a cross-reference to Item 1A Risk Factors, which does not change the classification. No firm-specific facts from the IS list are present.

thinking:
This paragraph contains a materiality assessment followed by a risk factors cross-reference.

The first sentence is a clear materiality disclaimer: "have not materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition." → Strategy Integration per Rule 6.

The rest is generic forward-looking risk language and a cross-reference to Risk Factors.

Specificity: No named frameworks, no firm-specific facts from the IS list. The cross-reference quotes risk factor titles but those are boilerplate. → Generic Boilerplate.


reasoning: The Board and Audit Committee are the grammatical subjects performing oversight actions (considers risk, delegated oversight, oversees implementation), making this clearly Board Governance. No specific facts are present — 'Board of Directors' and 'Audit Committee' are both on the IS-NOT list as generic governance terms, and no frameworks, dates, named roles, or firm-specific details appear.

thinking:
Classify this paragraph.

Board/committee is the grammatical subject throughout. Board delegates to Audit Committee, Audit Committee oversees. This is Board Governance.

Specificity: No named frameworks. "Audit Committee" is on the NOT list (generic). "Board" is generic. No cybersecurity-specific roles, no dates, no numbers. Everything here is generic boilerplate.

→ Board Governance, Generic Boilerplate


reasoning: The paragraph describes the company's internal cybersecurity risk management processes and their integration into the overall ERM program. It contains only generic language ('policies, procedures and processes,' 'assessing, identifying, and managing material risks') with no named frameworks, specific roles, or firm-specific details. The trailing 'Collaboration' appears to be a truncated bullet header but adds no substantive specificity.

thinking:
Let me analyze this paragraph from EPRT's 10-K filing.

The paragraph describes the company's cybersecurity risk management integration into ERM and mentions the program focuses on key areas, ending with "Collaboration" which appears to be a truncated bullet point header.

Category: Risk Management Process - describes internal processes, ERM integration
Specificity: Generic Boilerplate - no named frameworks, no firm-specific facts, all generic language


reasoning: The paragraph contains an explicit materiality assessment ('not reasonably likely to have a material effect on our results of operations or financial condition'), which per Rule 6 is Strategy Integration. The no-breach statement and risk acknowledgment are subordinate to this materiality conclusion. The specific fiscal year-end date (June 30, 2025) is one firm-specific fact, placing it at Firm-Specific rather than Generic Boilerplate.

thinking:
Let me analyze this paragraph.

Content: No breaches during the year, takes steps for cybersecurity, believes no material effect on results/financial condition. This is a materiality assessment.

Category: Strategy Integration - contains explicit materiality assessment ("not reasonably likely to have a material effect on our results of operations or financial condition"). Per Rule 6.

Specificity: "year ended June 30, 2025" is a specific date. But the materiality language is boilerplate. Let me check the IS list - "fiscal 2025" or specific dates count. "June 30, 2025" is a specific date. That's one fact.

Looking at the rest of the passage, I see only generic references like "the Manager or the Fund" - those are self-references, not specific entities. No named firms, tools, dollar amounts, or headcounts appear. With just the one specific date, this qualifies as Firm-Specific.

fact: year ended June 30, 2025


reasoning: The paragraph's grammatical subject throughout is the CIO, describing their reporting line (to CFO), responsibilities, and personal qualifications (over 25 years of experience). While sentences 1-2 touch on what the role entails, the paragraph's primary communicative purpose is identifying who holds the cybersecurity leadership role and what qualifies them — classic Management Role. For specificity, CIO is a cybersecurity-specific named role (Firm-Specific trigger) and 'over 25 years' is a specific duration of experience (QV-eligible); these two hard facts meet the two-fact QV threshold.

thinking:
Let me analyze this paragraph.

The paragraph describes the CIO - their reporting line, responsibilities, and experience/qualifications. Let me apply the person-vs-function test.

The paragraph has three sentences:
1. CIO reports to CFO, leads operational oversight of cybersecurity strategy/policy/standards/processes, works across departments
2. Specific responsibilities include overseeing detection, mitigation, remediation of incidents
3. CIO has extensive experience, over 25 years at several companies

Sentences 1-2 describe what the CIO does (function), but sentence 3 is about the person's qualifications. The paragraph's subject throughout is the CIO. The reporting line (CIO reports to CFO) is about organizational structure centered on the person. The experience/credentials in sentence 3 are clearly about the person.

Applying the person-vs-function test, if I strip away the title and reporting structure, what's left is fairly generic process language around detection and mitigation. But the paragraph consistently centers on the CIO as an individual - establishing their place in the hierarchy, detailing their specific responsibilities, and highlighting their 25 years of experience. This framing makes Management Role the right classification.

Now I'm checking the specific facts against the qualification lists. The CIO title appears on the cybersecurity-specific list, and "over 25 years" is a quantified experience metric. That gives me one QV-eligible fact, which isn't enough for the QV threshold - I need at least two. So this lands as Firm-Specific.

fact: Chief Information Officer (CIO) leads cybersecurity oversight

fact: Over 25 years of experience in cybersecurity and risk programs


reasoning: The paragraph mentions the CIO and Director of Information Security but primarily describes internal cybersecurity processes: monitoring, security measures, system audits, and incident response planning. Applying the person-vs-function test, removing the role titles leaves a complete process description. Two cybersecurity-specific roles (CIO, Director of Information Security) qualify as IS-list facts for Firm-Specific, but named roles are not QV-eligible, so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes monitoring of cybersecurity incidents, mentions CIO and Director of Information Security roles, but the bulk is about processes - monitoring, security measures, audits, incident response plan.

Category: The CIO and Director of Information Security are mentioned, but the paragraph is about what they do (processes) not who they are. Apply person-vs-function test: remove the role titles and the paragraph still describes monitoring, security measures, audits, IR plan. → Risk Management Process.

Specificity:
- CIO: generic C-suite per NOT list
- "Director of Information Security": This is close to "Director of IT Security" on the IS list.

I'm identifying the Director of Information Security as a cybersecurity-specific title that counts as a Firm-Specific fact. There are no named frameworks, dates, dollar amounts, or named tools mentioned, and "incident response plan" is too generic. CIO also appears on the IS list as cybersecurity-specific, giving me two IS facts, but since named roles don't qualify for QV eligibility, this stays categorized as Firm-Specific.

fact: CIO

fact: Director of Information Security


reasoning: The Audit Committee is the grammatical subject overseeing cybersecurity risks, with management providing updates to it — classic Board Governance. CIO is a cybersecurity-specific title on the IS list, elevating to Firm-Specific. CFO and 'Audit Committee' are on the NOT list; 'Security Incident Response Team' is a generic program name; 'regular updates' is a generic cadence. Only one IS-list fact (CIO), so not Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

The Audit Committee is the grammatical subject performing oversight. This is about board-level oversight of cybersecurity risks, with briefings from management. → Board Governance.

Specific facts:
- CIO (cybersecurity-specific title) → named_role
- Security Incident Response Team → this is a named team but generic program name... actually it's a specific team composition reference
- "Chief Financial Officer" → generic C-suite, NOT list

Wait, let me reconsider. CIO is on the IS list. "Security Incident Response Team" - this is a named internal team but fairly generic. CFO is on the NOT list.

The CIO is the only concrete, verifiable fact here—a cybersecurity-specific role—so this classifies as Firm-Specific without any quantifiable details like dates or dollar amounts.


reasoning: Although the paragraph opens with the CIO's credentials (Management Role content), the bulk of the text describes the management team's cybersecurity processes: program oversight, briefings from internal personnel, threat intelligence sources, NIST CSF assessments, security tools, and incident escalation procedures. Applying the person-vs-function test, removing the CIO's title and credentials leaves a fully coherent process description, making Risk Management Process the dominant category. Specificity reaches Quantified-Verifiable with two QV-eligible hard facts: 'over 30 years of experience' and 'over five years managing IT Infrastructure and Security.'

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics. Let me break it down:

1. "Our CIO leads our management team in assessing and managing our response to cybersecurity threats and incidents." - CIO attribution
2. "Our CIO has a Bachelor of Technology degree in Computer Science with over 30 years of experience in IT, with over five years managing IT Infrastructure and Security." - Person's credentials
3. Then it describes the management team's responsibilities - program management, supervising personnel and consultants
4. Then describes processes - monthly/quarterly briefings, threat intelligence, NIST CSF assessments, security tools
5. Escalation to Board in crisis

6. The CIO credentials take up about 2 sentences, and the process description takes up the remaining bulk.

The majority of text describes processes (risk management program, briefings, threat intelligence, NIST CSF, security tools, incident escalation). The CIO credentials are a significant but secondary component. So this is primarily about the function and processes, with the CIO's background serving as supporting context. The credentials are substantial enough that they can't be dismissed as purely incidental, but stripping them away still leaves a coherent description of the actual cybersecurity work—the processes, tools, and governance structures. The paragraph really does center on what the management team does rather than who they are. Risk Management Process is the right call here, even though the Management Role component is more prominent than usual.

Now I'm evaluating the specificity of individual facts to determine what qualifies for the IS list and what's QV-eligible. The CIO title itself is cybersecurity-specific, so that counts. The degree is too generic without a named institution. But the experience metrics—30 years in IT and five years in infrastructure and security—are specific numbers that would qualify for QV. The NIST CSF reference is a named framework, so that's sector-adapted. The incident response team name is fairly standard without unique branding, and the briefing cadences are just generic timeframes.

Looking at the QV-eligible facts, I have two concrete numbers: the 30 years and the 5 years of experience. That's enough to reach Quantified-Verifiable status. The CIO role adds a firm-specific element, and the NIST CSF is another notable detail. Both experience facts relate to the same person's background, but they're distinct enough to count as separate QV facts. So the overall classification is Risk Management Process at the Quantified-Verifiable level.

fact: CIO leads the management team

fact: over 30 years of experience in IT

fact: NIST CSF


reasoning: The paragraph describes the company's own internal cybersecurity measures and processes (incident response, encryption, access controls, monitoring, penetration testing, training, insurance). All items listed are common practices on the ✗ NOT list (penetration testing, security awareness training, incident response plan, etc.) with no named frameworks, roles, tools, firms, dates, or quantified details.

thinking:
Classify this paragraph.

Content: Describes the company's internal cybersecurity measures - technical, physical, organizational. Lists practices like incident response plan, detection, encryption, network security, access controls, physical security, asset management, monitoring, training, pen testing, insurance.

Category: Risk Management Process - describes internal processes and measures.

Specificity: Let me check for specific facts.
- No named frameworks (NIST, ISO, etc.)
- No named roles (CISO, etc.)
- No named tools or firms
- No dates, numbers, dollar amounts
- All items listed are common practices (pen testing, vulnerability scanning, etc.) which are on the NOT list

- Cybersecurity insurance is mentioned but without any details, and everything reads as generic boilerplate.

Specificity: Generic Boilerplate (1)


reasoning: The CDEO is the grammatical subject throughout, performing the actions of informing and reporting to the ERM Committee — making this about a management role's reporting responsibilities and escalation duties rather than about internal processes themselves. Two firm-specific facts (CDEO title, ERM Committee) but neither is QV-eligible, so Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: The CDEO (Chief Digital Experience Officer or similar) reports to the ERM Committee about cybersecurity incidents and material risks. This is about a management role's reporting relationship and escalation processes.

Category: The grammatical subject is "The CDEO" - a management role reporting to a committee. This describes reporting lines and escalation processes. The CDEO is the primary actor here, reporting upward. Per Rule 2: "Management role reports TO the board → Management Role" and "CISO reports quarterly to the Board on..." → Management Role (management is primary actor).

Wait - the ERM Committee could be a management committee, not necessarily a board committee.

The CDEO is clearly the subject performing the reporting and informing actions, so this centers on the management role's responsibilities. Though the paragraph focuses on escalation criteria and reporting processes, the CDEO is the one driving those actions, making this fundamentally about the management role rather than the process itself.

For specificity, I'm identifying two firm-specific facts: the CDEO title and the ERM Committee name. Neither qualifies as QV-eligible since they're both named entities rather than quantifiable metrics, so this lands as Firm-Specific.

fact: CDEO (Chief Digital/Experience Officer — cybersecurity-specific leadership title)

fact: ERM Committee (named non-generic committee)


reasoning: The paragraph describes the company's internal cybersecurity processes — monitoring, security measures, system audits, and incident response planning. The vCISO is mentioned as attribution for who structures these processes; applying the person-vs-function test, the substantive content is about what the program does, not who the person is. Two QV-eligible facts are present: the named cybersecurity-specific role 'vCISO' and the named third-party firm 'DeepSeas Security.' However, note that named roles are NOT QV-eligible per the codebook — only DeepSeas Security counts as a QV-eligible hard fact, making this Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes monitoring, prevention, detection, the vCISO's role in processes, deployment of security measures, audits, and incident response plan with DeepSeas Security partnership.

Category: The paragraph is about cybersecurity processes - monitoring, security measures, audits, incident response. The vCISO is mentioned as attribution for who structures these processes. Applying the person-vs-function test: remove "The vCISO" references and the paragraph still describes monitoring, security measures, audits, IR plan. → Risk Management Process.

Specificity:
- "vCISO" - this is a cybersecurity-specific role (virtual CISO) → IS list item

- "DeepSeas Security" - named third-party firm → IS list item, QV-eligible
- "Rhinebeck Bank" - company self-reference → NOT list

Looking at QV-eligible facts: DeepSeas Security is the named firm that qualifies. The vCISO is a role title, not QV-eligible. That gives me one QV-eligible fact total, so this falls under Firm-Specific.

fact: vCISO (virtual Chief Information Security Officer)

fact: DeepSeas Security (named third-party security partner)


reasoning: The paragraph describes the qualifications, education, experience, and certifications of management responsible for cybersecurity — this is about who these people are (the person test), not what the program does. Named certifications (CISSP, CISM) are mentioned as obtained by company leaders, qualifying as firm-specific facts, though the soft phrasing ('certain leaders also obtain... such as') and lack of cybersecurity-specific titles (no CISO/CTO/CIO named) or named individuals keeps it from Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the qualifications and background of management responsible for cybersecurity - formal education, experience, training, certifications (CISSP, CISM mentioned by full name but not as held by specific individuals).

Category: This is about the people - their qualifications, education, experience, training, certifications. This is Management Role per the codebook (covers qualifications, credentials of cybersecurity leadership).

But let me apply the person-vs-function test. The paragraph describes the collective qualifications of management - education, experience, training, certifications. It's about WHO these people are (their qualifications), not WHAT the program does. → Management Role.

Now I'm checking the specificity level. There are no named individuals, no specific titles like CISO or CTO—just generic references to "management" and "leaders." The certifications CISSP and CISM are named, but they're presented as general practices ("certain leaders also obtain") rather than specific claims about particular people holding them. No dates, numbers, or firm-specific details are provided.

The way these certifications are framed—using "such as" to illustrate examples—makes this feel more like a generic description of industry practices than a firm-specific credential claim. The roles are vague, the certifications are illustrative, and there's no definitive assertion that specific individuals hold these credentials. This leans toward generic boilerplate rather than a specificity concern. The named certifications CISSP and CISM are factual claims about what company leaders obtain, even with the "such as" framing—that pushes it toward Firm-Specific. Though these certifications are QV-eligible when held by individuals, the soft language here ("certain leaders also obtain") isn't strong enough to count as a definitive QV claim. I'll categorize this as Firm-Specific.

fact: Leaders obtain CISSP (Certified Information Systems Security Professional)

fact: Leaders obtain CISM (Certified Information Security Manager)


reasoning: The Board of Directors and Audit Committee are the grammatical subjects overseeing cybersecurity risk, with the Global IT Senior Director reporting TO them — classic Board Governance framing. 'Global IT Senior Director' is a generic IT leadership title (akin to 'Director of IT' on the NOT list, not a cybersecurity-specific role like CISO or Director of IT Security), 'Audit Committee' is standard governance, and 'quarterly' is a generic cadence, leaving no qualifying specific facts.

thinking:
Let me analyze this paragraph.

Content: Board and Audit Committee oversight, quarterly reports from Global IT Senior Director, reporting thresholds for incidents.

Category: Board Governance - the Board and Audit Committee are the grammatical subjects performing oversight. The Global IT Senior Director is mentioned but in context of reporting TO the board.

Specific facts:
- "Global IT Senior Director" - this is a cybersecurity-specific title? Let me check. "Global IT Senior Director" - this is more of a generic IT leadership title. The IS list includes "CISO, CTO, CIO, VP of IT/Security, Information Security Officer, Director of IT Security." "Global IT Senior Director" is close to "Director of IT Security" but it says "IT" not "IT Security." Hmm, it's borderline. I'd say this is more like a generic IT title - "Director of IT" equivalent.

Per the NOT list: "Head of IT", "IT Manager", "Director of IT" are generic IT leadership titles. "Global IT Senior Director" fits this pattern - it's essentially a Director of IT role, not a cybersecurity-specific position.

- "Audit Committee" - NOT list, generic governance
- "quarterly" - NOT list, generic cadence
- Board of Directors - NOT list

No named frameworks, no specific dates, no named firms/tools, no QV facts. After filtering, nothing specific remains, so this is generic boilerplate.


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management program — identifying, assessing, and managing risks, deploying security controls, and limiting vendor access. The MSP/vCIO engagement is an operational detail of how the program is staffed, not a description of the person's qualifications (so not Management Role). Third-party vendor risk is mentioned briefly as one component, not the central topic. The vCIO title (a CIO variant) is a cybersecurity-specific role on the IS list, making this Firm-Specific, but there is only one qualifying fact so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph from Vivani Medical's 10-K Item 1C filing.

Content: Describes their cybersecurity risk management program, engagement of an MSP with a vCIO, security controls, and vendor risk management efforts.

Category: This is primarily about the company's internal cybersecurity processes - risk management program, engaging MSP, security controls, limiting vendor access. The third-party/vendor mention is a component, not the central topic. The vCIO mention is incidental attribution. → Risk Management Process

Specificity: Let me check facts:
- "Managed Services Provider ('MSP')" — unnamed entity → NOT list

- "virtual Chief Information Officer ('vCIO')" — This is a variant of CIO, which appears on the cybersecurity-specific titles list, so it counts as a firm-specific fact.

No named frameworks, dates, dollar amounts, named firms, or tools mentioned. With only one hard fact identified, this doesn't meet the threshold for Qualified Vendor status.

The vCIO role itself—whether provided through an MSP or internally—represents a firm-specific organizational detail that triggers the cybersecurity-specific title criterion.

fact: virtual Chief Information Officer (vCIO) provided through MSP


reasoning: The paragraph describes the governance oversight chain: an IT Steering Committee (management-level) reviews cybersecurity program initiatives and reports to the Audit Committee quarterly. The primary communicative purpose is how cybersecurity oversight flows up to the board-level Audit Committee, making this Board Governance. The IT Steering Committee is a named non-generic committee (IS list), triggering Firm-Specific; no second QV-eligible hard fact prevents Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes an IT Steering Committee that includes management and MSP representatives, reviews cybersecurity program, and reports to the Audit Committee quarterly.

Category: The primary actor is the IT Steering Committee, which reports to the Audit Committee. This is about governance oversight structure. The IT Steering Committee is a named non-generic committee reporting to the board-level Audit Committee. The paragraph describes oversight flow - committee composition and reporting cadence to the board committee. This feels like Board Governance since the ultimate point is about how cybersecurity information flows up to the Audit Committee (board-level oversight).

Actually, the grammatical subject is "IT Steering Committee" which is a management-level committee, not a board committee.

The IT Steering Committee reports to the Audit Committee, so it's a management committee within the oversight chain. The key question is whether the paragraph's purpose is describing the committee itself as a management role or emphasizing how it feeds information up to the board—and since the focus is on the governance structure and reporting relationship, this leans toward Board Governance. I'm working through whether this fits Management Role or Board Governance. The IT Steering Committee is the primary actor describing its function—reviewing cybersecurity initiatives and reporting to the Audit Committee. Management Role covers management committees responsible for cybersecurity, which this clearly is, but the paragraph emphasizes the process and oversight flow rather than the specific person or their qualifications. I'm leaning toward this being more about the governance structure and reporting relationship than the management role itself.

Looking at the specificity markers: "IT Steering Committee" is a named, firm-specific committee, so that counts toward the list. "MSP" is generic, "Audit Committee" is generic, and "quarterly" is generic. So I have one firm-specific element here.

Since there's only one QV-eligible hard fact, this falls under Firm-Specific classification.

fact: IT Steering Committee (named non-generic management committee overseeing cybersecurity)


reasoning: The paragraph contains an explicit materiality assessment ('our operations or financial standing have not been materially impaired by any cybersecurity challenges'), which triggers Strategy Integration per Rule 6, even though the paragraph also includes a generic management statement and forward-looking training plans. No specific facts from the IS list are present — 'management team' is generic, training topics are common practices, and 'to date' is not a specific date — so specificity is Generic Boilerplate.

thinking:
Let me analyze this paragraph carefully.

The paragraph has three parts:
1. "Our management team actively evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs." - Generic management statement
2. "To date, our operations or financial standing have not been materially impaired by any cybersecurity challenges." - Materiality assessment
3. "Looking ahead, the Company will mandate comprehensive cybersecurity training for both the Board and employees, covering key areas such as physical security of assets, data privacy and other information security policies and procedures." - Forward-looking training plan

The materiality assessment ("not been materially impaired") is a Strategy Integration trigger per Rule 6. But there's also a forward-looking training statement and a generic management statement.

The explicit materiality claim about operations and financial standing not being impaired maps to Strategy Integration under Rule 6, while the rest of the disclosure lacks specificity—no named frameworks, no concrete facts from the IS list, no dates beyond "to date," and no named roles or numbers. This is Generic Boilerplate.


reasoning: The paragraph describes the company's incident response program, policy, IRT structure, and process steps — all internal risk management processes. While the Executive Cybersecurity Steering Committee membership is detailed, the paragraph's primary communicative purpose is explaining what the program does (governance oversight, incident detection, investigation, communication, mitigation), not who the individuals are personally. Applying the person-vs-function test, removing the titles leaves a complete process description. Multiple firm-specific facts (named committee, CISO/CIO roles, specific committee composition, named IRT program) but no QV-eligible hard facts (no dates, dollar amounts, headcounts, named third-party firms, or named tools).

thinking:
Let me analyze this paragraph from STERIS plc's 10-K filing, Item 1C.

Content Category: This paragraph describes an Executive Cybersecurity Steering Committee, its composition, and then describes the incident response program, IRT, and incident response policy. The primary content is about internal processes — the committee structure, the incident response program, the IRT responsibilities, and the steps in the incident response policy. While it names management roles, the paragraph is fundamentally about the company's risk management processes (incident response program, policy, procedures).

The committee is a management-level committee (not board), and the paragraph describes what it does (governance, risk, compliance oversight for IR program). Then it shifts to describing the incident response policy and IRT processes. The dominant content is process description.

I'm reconsidering whether the organizational structure details outweigh the process descriptions. Using the person-versus-function test, if I strip away the role titles and names, the core content remains the incident response program, policy, and IRT procedures — so this is fundamentally about risk management processes rather than organizational structure.

Now I'm checking the specificity of the details mentioned: the Executive Cybersecurity Steering Committee is a named entity, and the IRT is a named internal program with a unique identifier. The committee membership includes both cybersecurity-specific roles like CIO and CISO, as well as generic C-suite positions like CFO and General Counsel. The paragraph also specifies the exact composition of the team with full titles.

For the quantifiable verification check, there are no dates, dollar amounts, headcounts, percentages, or named third-party vendors—just named roles and organizational structures. This means it doesn't meet the QV threshold, but the multiple firm-specific facts about named committees and programs classify this as Firm-Specific information. The key extractable facts are the Executive Cybersecurity Steering Committee, the Incident Response Team with its abbreviation, and the specific roles of CIO and CISO.

fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

fact: Committee composed of SVP & CFO, VP Chief Accounting Officer, VP Investor Relations & Corporate Communications, VP & CIO, VP Chief Compliance Officer, SVP General Counsel & Company Secretary, and VP & CISO

fact: Incident Response Team ('IRT') — named internal program with unique identifier


reasoning: The paragraph's primary communicative purpose is defining which management roles are responsible for cybersecurity functions — the Executive Director of IT/IS and the CFO. However, it is borderline with Risk Management Process because no personal credentials, background, or qualifications are provided; the content is purely functional responsibility mapping. The cybersecurity-specific title 'Executive Director of Information Technology/Information Security' is an IS-list fact triggering Firm-Specific, while CFO is generic C-suite. Only one QV-eligible fact, so not Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes two roles - "Executive Director of Information Technology/Information Security" and CFO - and their responsibilities related to cybersecurity.

Category: The paragraph describes what these roles are responsible for. It's about the function/responsibilities rather than the person's credentials/background. But wait - the person-vs-function test: if I remove the role titles, the remaining content describes activities (hiring, integrating risk, preparing for incidents, approving processes, reviewing assessments, approving budgets). These are process/function descriptions attributed to roles.

However, the paragraph is primarily about WHO does WHAT - it's defining responsibilities and reporting structure.

Now I'm applying the codebook definition more carefully. Management Role specifically focuses on the person filling the position - their name, qualifications, career history, credentials, tenure, and reporting lines. But this paragraph doesn't mention any of that. When I strip away the role titles, what's left are substantive cybersecurity activities like hiring personnel, integrating risk considerations into overall risk management, and preparing for incidents. That points toward Risk Management Process rather than Management Role. The key distinction here is whether this is about defining management roles or describing processes. Since there are no personal qualifications or credentials—just functional responsibilities—and the grammatical structure centers on who is responsible for what, this reads as management structure definition rather than process description. The paragraph establishes the cybersecurity governance hierarchy by mapping responsibilities to specific positions. I'm noting that "Executive Director of Information Technology/Information Security" is a cybersecurity-specific title that appears on the IS list, while "CFO" is generic C-suite.

Looking at the QV check: no dates, dollar amounts, headcounts, named firms, named tools, or certifications—just that single IS fact about the specialized title. This points to Firm-Specific.


reasoning: The paragraph's primary communicative purpose is describing how the audit committee and board maintain oversight of cybersecurity through structured briefings. While the Head of Security & Privacy is the subject of the first sentence, the overall frame is the oversight mechanism — updates flow to the audit committee, which then reports to the board. The cybersecurity-specific title 'Head of Security & Privacy' is a firm-specific fact; 'audit committee,' 'quarterly,' and 'board of directors' are all on the NOT list.

thinking:
Let me analyze this paragraph.

Content: Describes briefing cadence from Head of Security & Privacy to audit committee, and audit committee to board. The audit committee and board are receiving updates - this is about oversight flow.

Category: The paragraph describes how the audit committee receives updates and then provides updates to the board. The grammatical subjects are "Head of Security & Privacy or other business leaders" (first sentence), "These updates" (second sentence), and "Our audit committee" (third sentence). The primary communicative purpose is about the oversight/briefing structure - how information flows from management to audit committee to board. The board/committee oversight of cyber risk via briefings is the dominant theme. This is Board Governance.

I'm reconsidering the classification here. The Head of Security & Privacy is the one initiating the updates to the audit committee, which could suggest a Management Role focus. But looking at the overall structure, two of the three sentences center on the audit committee and board as the primary actors receiving and distributing information. The paragraph is fundamentally describing the oversight mechanism rather than highlighting the CISO's independent reporting authority, so Board Governance still seems like the right fit.

For specificity, I've got one firm-specific element: the "Head of Security & Privacy" title is a cybersecurity-specific role that would appear on an IS list. The audit committee and quarterly cadence are generic. That single IS fact puts this at Firm-Specific level.

fact: Head of Security & Privacy


reasoning: The Board and its committees are the grammatical subjects throughout, describing oversight delegation, report reviews, and briefing structure — squarely Board Governance. The 'Risk & Sustainability Committee' is a named non-generic committee (IS list), giving one firm-specific fact, but no second QV-eligible hard fact exists (quarterly cadence and Audit Committee are on the NOT list).

thinking:
Let me analyze this paragraph.

Content: Board oversight of cybersecurity risks, delegated to Risk & Sustainability Committee, receives reports from management, meets quarterly, reports to Audit Committee and full Board.

Category: Board Governance - the Board and its committee are the grammatical subjects throughout.

Specific facts:
- "Risk & Sustainability Committee" - this is a named non-generic committee (not just "Audit Committee") → IS list
- Quarterly meeting cadence - generic cadence, NOT list
- "Audit Committee" - generic, NOT list

So one IS fact: Risk & Sustainability Committee → Firm-Specific

No QV facts (no dates, dollar amounts, headcounts, named firms, named tools, named certifications).

This gives me a specificity score of 3 for firm-specific facts.

fact: Risk & Sustainability Committee has delegated responsibility for cybersecurity oversight


reasoning: The paragraph describes internal security processes (developing, documenting, reviewing, and testing security and incident management procedures). Applying the person-vs-function test: the CIO and CISO are mentioned as attribution for who leads the work, but the substantive content is about the activities performed. Remove the role titles and the paragraph still describes processes. CIO and CISO are cybersecurity-specific titles on the IS list, triggering Firm-Specific, but named roles do not count toward QV.

thinking:
Classify this paragraph.

Content: Describes what the CIO and CISO do - they lead the IS team in developing security procedures. This is about the function/process, not about the people's credentials. The CISO/CIO are mentioned as attribution for who leads the process work.

Person-vs-function test: Remove "The service center's CIO and CISO" and replace with "The Company" → "The Company leads the IS team in developing, documenting, reviewing, and testing security and incident management procedures" — still makes sense as a process description.

So this is Risk Management Process.

Specific facts:
- CIO: cybersecurity-specific? CIO is on the IS list. Yes.

- CISO: yes, cybersecurity-specific title.
- "Information Security ("IS") team": named team with abbreviation - this could be a named internal program with unique identifier. Actually it's just a team name, pretty generic.

For specificity: CIO and CISO are on the IS list as cybersecurity-specific titles. That gives Firm-Specific.

QV check: Named roles don't count toward QV. No dates, dollar amounts, headcounts, named firms, named tools. So not QV.

Firm-Specific (3).

fact: CIO

fact: CISO


reasoning: The paragraph describes the company's own risk identification activities — regulatory monitoring, audits, policy reviews, framework adherence — making Risk Management Process the dominant category. Third-party collaboration is mentioned as one component, not the central topic. FFIEC and Gramm-Leach-Bliley Act are named standards that elevate beyond boilerplate to Sector-Adapted, but no firm-specific facts (no cybersecurity-specific roles, dates, named firms, or quantified details) are present.

thinking:
Let me analyze this paragraph.

Content: Describes risk identification activities - monitoring regulatory guidance, audits, third-party collaboration, frameworks (FFIEC, GLBA). Mix of internal processes and third-party mention.

Category: The paragraph primarily describes the company's own risk identification process. Third parties are mentioned as one component. The dominant topic is the company's internal risk management activities. → Risk Management Process

Specificity: Let me check for specific facts:
- FFIEC - this is a named regulatory framework/standard
- Gramm-Leach-Bliley Act - named regulation

These are named standards/frameworks → Sector-Adapted. No firm-specific facts from the IS list. No cybersecurity-specific titles, no dates, no named firms, no headcounts.

So this falls into the Sector-Adapted specificity level.

fact: FFIEC guidance

fact: Gramm-Leach-Bliley Act


reasoning: The paragraph is about the people on the management team — their roles, qualifications, years of experience, educational backgrounds, and tenure. This is squarely Management Role under the person-vs-function test, as the entire paragraph describes who these individuals are rather than what the cybersecurity program does. Multiple QV-eligible hard facts are present: specific durations of experience (almost 20 years, more than 10 years, over 25 years), a specific date (since 2013), and named universities (Harvard, MIT).

thinking:
Let me analyze this paragraph carefully.

Content: Describes management team members, their roles, qualifications, experience, education, reporting. This is about the people - their credentials, background, experience.

Category: Management Role - the paragraph is about who these people are, their qualifications, experience, education. The person-vs-function test: the paragraph is almost entirely about the people's backgrounds and credentials.

Specific facts:
- CIO (cybersecurity-specific title) ✓
- VP of Data Analytics and Information Security (cybersecurity-specific title) ✓
- Chief Legal Officer - generic C-suite, NOT list
- CFO, President - generic, NOT list

- Multiple team members with specific years of experience (ranging from over 10 to almost 20 years) and degrees from prestigious institutions like Harvard and MIT, all of which qualify as QV-eligible facts.
- I've identified well over 2 QV-eligible qualifications across the group, so this clearly meets the Quantified-Verifiable threshold.

fact: Chief Information Officer (cybersecurity-specific title)

fact: Vice President of Data Analytics and Information Security (cybersecurity-specific title)

fact: CIO has almost 20 years in IT roles

fact: CIO has been with the company since 2013

fact: CIO holds undergraduate and postgraduate degrees in computer science from Harvard University

fact: VP of Data Analytics and Information Security has more than 10 years in IT and information security

fact: VP holds undergraduate degree from Harvard University and postgraduate degrees from Massachusetts Institute of Technology

fact: Chief Legal Officer has over 25 years of experience managing risks


reasoning: The paragraph is primarily about the people responsible for cybersecurity — the Director of Information Systems's tenure and experience, and the team's background and qualifications. This passes the person-vs-function test: the content centers on who these people are and what makes them qualified, not on specific processes or tools. Two QV-eligible facts (over 15 years in IS, over 10 years leading the team) reach the Quantified-Verifiable threshold.

thinking:
Let me analyze this paragraph.

Content: Describes the management's role in cybersecurity, led by the Information Systems team and Director of Information Systems. Describes the director's experience (15 years in IS, 10 years leading the team), their oversight responsibilities, and the team's background.

Category: This is about the person/people - the Director of Information Systems, their experience, qualifications, and what they oversee. The person-vs-function test: the paragraph focuses on WHO leads cybersecurity (Director of IS), their experience/tenure, and the team's background. It's primarily about the people, not about specific processes/tools/frameworks.

The Director of Information Systems brings over 15 years of industry experience and has been leading the team for over 10 years—both of these are quantified and verifiable facts that support their qualifications for the role.

fact: Director of Information Systems

fact: over 15 years in information systems field

fact: over 10 years leading Information Systems team


reasoning: The paragraph's primary communicative purpose is describing how the Board and its Cybersecurity Committee maintain oversight of cybersecurity through briefings from the CISO and management. While the CISO and management are grammatical subjects, the paragraph is about the board-level oversight mechanism — how and when the board stays informed. The Cybersecurity Committee (a non-generic, named committee) and the CISO (a cybersecurity-specific title) are both firm-specific facts, but neither is QV-eligible, so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes how CISO and executive leadership discuss cyber matters with the Board, and how management updates the Cybersecurity Committee or Board about incidents.

Category: The primary actors are the Board and the Cybersecurity Committee receiving briefings. But the CISO and management are the ones doing the briefing. The paragraph is about the communication flow between management and the board. The board/committee is receiving oversight information - this is about the board's oversight mechanism (how they stay informed). The Board and Cybersecurity Committee are the recipients of these updates, making this about board-level oversight cadence.

Actually, looking more carefully: "CISO and other members... discuss... with the full Board" - the CISO is the grammatical subject doing the discussing.

Now I'm weighing whether this is primarily about management's reporting role or the board's oversight function. The CISO is clearly the active party initiating these discussions and updates, and the paragraph emphasizes the cadence and frequency of management's communication. Even though the board is receiving the information, the focus seems to be on how management structures and delivers these briefings. Using the tiebreaker rule, since management's actions are the main focus here, this falls under Management Role rather than Board Governance.

For the specificity classification, I'm identifying two firm-specific facts: the CISO as a named cybersecurity role and the Cybersecurity Committee as a named committee. Neither qualifies as QV-eligible since they're both specific organizational entities rather than generic governance concepts, so this is Firm-Specific.

fact: Cybersecurity Committee


reasoning: The paragraph primarily describes internal cybersecurity processes: self-assessments, third-party control testing, policy enforcement, and organizational structure. The CIO is mentioned as attribution for who enforces policies, and CISSP certifications describe team qualifications — both are subordinate to the process description. Applying the person-vs-function test, removing the CIO reference leaves the process description intact. Two IS-list facts (CIO as cybersecurity-specific title, CISSP certifications) establish Firm-Specific, but only one QV-eligible fact (CISSP), so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes IT risk assessments, third-party testing, management/CIO responsibility, CISSP certifications, organizational charts for cybersecurity.

Category: This is primarily about the company's internal cybersecurity processes and who manages them. The paragraph mentions the CIO and CISSP certifications, but the dominant content is about processes (self-assessment, controls testing, risk management decision making, policies, organizational charts). The CIO is mentioned as attribution. Let me apply the person-vs-function test: if I remove the CIO mention, the paragraph still describes processes. However, there's also mention of CISSP certifications held by team members.

The core here is really about risk management processes—self-assessments, third-party testing, and policy frameworks. The CIO and CISSP certifications are supporting details that indicate who's responsible and their qualifications, but they're secondary to the process description itself. For specificity, I can flag the CISSP certifications as a named credential and the CIO as a named role, though the unnamed third-party organization and generic cadence language don't meet the threshold.

Looking at what's actually QV-eligible, I've got the CISSP certifications as a named credential, but that's really the only concrete fact that qualifies. The CIO is firm-specific and doesn't carry over to other contexts, so this lands as firm-specific overall.

fact: Chief Information Officer (CIO)

fact: CISSP industry certifications held by cybersecurity and information security team members


reasoning: The paragraph is entirely about the people filling cybersecurity leadership roles — their titles, years of experience, and areas of expertise. It passes the person-vs-function test: remove the experience details and nothing substantive remains. Multiple QV-eligible facts (over 30 years, over 25 years, over 20 years, 19 years, over 10 years) easily exceed the two-fact threshold for Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes CCO, CIO, CISO, Head of Operational Risk - their experience and qualifications. This is about the people, not the function.

Category: Management Role - the paragraph is about who these people are, their qualifications and experience.

Specific facts:
- CCO (Chief Compliance Officer) - but this is on the NOT list as generic C-suite... actually wait, CCO isn't explicitly on the NOT list. Let me check. The NOT list says "Chief Compliance Officer" is NOT a specific fact (generic IT leadership, not cybersecurity-specific).

- CIO and CISO are both cybersecurity-specific titles that count as facts. Head of Operational Risk is a defined role worth noting. The experience metrics are all quantified - I've got 30, 25, 20, 19, and 10 years mentioned across these roles, with the 30 years for the CIO being QV-eligible.

Looking at the additional roles, the 25 years for the CISO, 20 years for Head of Operational Risk, and 19 years for the CCO all qualify as QV-eligible facts since they're specific numbers. That gives me well over the threshold of two QV-eligible facts needed to classify this as Quantified-Verifiable.

fact: CIO role identified

fact: CISO role identified

fact: Head of Operational Risk role identified

fact: CIO has over 30 years of experience

fact: CISO has over 25 years of experience

fact: Head of Operational Risk has over 20 years of experience

fact: CCO has 19 years in financial services

fact: CCO has over 10 years covering compliance


reasoning: The paragraph is overwhelmingly about the people filling cybersecurity leadership roles — their years of experience, areas of expertise, and backgrounds. This is the person-vs-function test: the content is about who these individuals are and what qualifies them, not about what the program does. Multiple specific years-of-experience figures (30, 25, 20, 19, 10) constitute well over two QV-eligible hard verifiable facts.

thinking:
Let me analyze this paragraph.

Content: Describes the CCO's role in overseeing risk management, and then details the qualifications of CIO, CISO, Head of NFR CTIS, and CCO. The paragraph is primarily about the people - their experience, backgrounds, and qualifications.

Category: Management Role - the paragraph is about the persons filling cybersecurity leadership positions, their qualifications and experience.

Specificity: Let me count hard verifiable facts:
- CIO: "over 30 years of experience" - quantified
- CISO: "over 25 years of experience" - quantified

- Head of NFR CTIS: "over 20 years of experience" - quantified
- CCO: "19 years" and "over 10 years" - quantified
- Named roles: CISO, CIO, Head of NFR CTIS (cybersecurity-specific titles)

All the leadership positions have specific years of experience attached to them, giving me well over 2 hard verifiable facts across the board. This qualifies as Quantified-Verifiable.

fact: CIO title

fact: CISO title

fact: Head of NFR CTIS title

fact: Head of NFR CTIS has over 20 years of experience


reasoning: The paragraph describes the company's own cybersecurity practices — engaging outside consultants, industry group memberships, and independent audits — all serving the company's internal risk management program. No named frameworks, firms, tools, roles, dates, or specific numbers are provided; references to 'outside consultants,' 'several cybersecurity industry groups,' and 'leading international cybersecurity standards' are all unnamed and generic.

thinking:
Let me classify this paragraph.

Content: Describes engaging outside consultants, membership in industry groups, and independent audits against cybersecurity standards. This is about the company's own internal processes for managing cyber risk.

Category: Risk Management Process - describes internal processes (engaging consultants, industry group membership, independent audits). The outside consultants serve the company's own program, not vendor oversight.

Specificity: No named frameworks, no named firms, no named roles, no dates, no numbers. "outside consultants," "legal advisors," "several cybersecurity industry groups," "leading international cybersecurity standards" - all unnamed/generic. → Generic Boilerplate.


reasoning: The paragraph describes the Audit Committee reporting to the full Board and the Board receiving briefings from management on cybersecurity — the Board is the primary actor receiving oversight information. All terms are generic: 'Audit Committee' is standard, 'management' is generic, 'periodically' and 'annual' are generic cadences with no specific dates or named roles.


reasoning: The paragraph's communicative purpose is to describe the reporting chain that enables board and Audit Committee oversight of cybersecurity — how information flows from the CISO to management, to the Audit Committee, and ultimately to the full board. While the CISO is the grammatical subject in most sentences, the dominant topic is the governance reporting structure (briefing cadence, escalation thresholds, Audit Committee Chair updates to the board). CISO is a cybersecurity-specific title on the IS list, yielding Firm-Specific; however, 'quarterly,' 'Audit Committee,' and 'board of directors' are all on the NOT list, and no QV-eligible hard facts are present.

thinking:
Let me analyze this paragraph.

The paragraph describes reporting lines and communication flows around cybersecurity. The CISO reports to senior management and Audit Committee. The Audit Committee Chair provides updates to the board.

Category: The primary actors are the CISO (reporting to management/committee) and the Audit Committee Chair (reporting to board). The paragraph is about communication/reporting structures. The CISO is the grammatical subject in most sentences, describing reporting lines. But this is really about the flow of information - CISO → management/Audit Committee → Board.

This is a mix of Management Role (CISO reporting lines) and Board Governance (Audit Committee/Board oversight).

The CISO is performing the reporting actions, but the real substance here is about oversight structure and how information flows upward to the board through the Audit Committee. Looking at the tiebreaker guidance, reporting lines fall under Management Role, but this paragraph doesn't actually describe who the CISO is—no credentials, background, or qualifications. It's purely about what gets reported and the cadence, which feels more like the mechanics of board oversight than the CISO's role itself. I'm leaning toward Board Governance since the substance is really about how the board receives cybersecurity information, even though the CISO is grammatically central.

For specificity, the CISO title is on the IS list, so that pushes it to Firm-Specific at minimum. The Audit Committee and quarterly cadence are generic. No QV-eligible facts like dates or certifications. So Firm-Specific, Level 3.

fact: CISO role responsible for reporting to senior management and Audit Committee