reasoning: The paragraph describes the qualifications and background of key IT security team members — their years of experience and industry backgrounds — making it about the people rather than the processes they run. One specific fact (over 20 years of experience) qualifies as Firm-Specific, but there is no second QV-eligible hard fact (no named firms, certifications, specific dates, or headcounts) to reach Quantified-Verifiable.

thinking:
Let me classify this paragraph.

Content: Describes key members of the IT team responsible for information security - their experience (20+ years) and industry backgrounds.

Category: This is about the people - their experience and backgrounds. It's describing who the people are, not what they do. This is Management Role.

Wait - it says "Key members of the IT team responsible for information security" - not a cybersecurity-specific title like CISO. It's "IT team" members. Let me check the person-vs-function test. The paragraph is about the people's qualifications and experience, so it's Management Role.

Specificity:
- "over 20 years of experience" - specific number → QV-eligible

- The role title "IT team responsible for information security" isn't from the cybersecurity-specific list like CISO or CTO, so that doesn't count as a named position. The industries mentioned (real estate, global retail, fintech, insurance) are descriptive categories rather than actual company names, and "top IT service and solutions providers" refers to unnamed entities. So I have one concrete fact - the 20+ years of experience - but I'd need at least two specific, verifiable facts to qualify for QV. There are no named firms, specific dates, or financial figures here. "Over 20 years" qualifies as a specific duration, so that's one QV-eligible fact pointing to Firm-Specific classification. Since there's no named standard to fall back on for Sector-Adapted, the result is Management Role with Firm-Specific designation.

fact: over 20 years of experience


content_category: Board Governance

category_confidence: high

specificity_confidence: high

reasoning: The Audit Committee is the grammatical subject throughout, describing its oversight responsibilities, briefing cadence, and information sources — all hallmarks of Board Governance. The paragraph names cybersecurity-specific roles (CIO, Senior Director of Information Security) and a non-generic committee (ERM committee), placing it at Firm-Specific. However, none of these qualify as QV-eligible hard facts (no dates, dollar amounts, headcounts, named third-party firms, or named tools).

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph.

The paragraph is about the Audit Committee's oversight of cybersecurity. The board committee is the grammatical subject throughout. It describes briefing cadence, topics covered, and who reports to the committee.

Content Category: Board Governance - The Audit Committee is the grammatical subject performing oversight actions.

Specific facts:
- "semiannually" - this is a specific cadence (not just "periodic" or "regular")
- "Chief Information Officer" - CIO is on the IS list as a cybersecurity-specific title
- "Senior Director, Information Security" - this is a cybersecurity-specific title

- "enterprise risk management committee" - the ERM Committee appears on the IS list as a named non-generic committee

Now I'm checking whether these constitute firm-specific details. The CIO and Senior Director titles are both cybersecurity-specific roles, and the ERM Committee is a named committee on the IS list. For the QV check, I need to identify hard verifiable facts like specific dates, dollar amounts, or headcounts, but this passage doesn't contain any of those elements.

So this qualifies as Firm-Specific with a score of 3.

fact: Chief Information Officer

fact: Senior Director, Information Security

fact: enterprise risk management committee


content_category: Strategy Integration

specificity_confidence: medium

reasoning: The paragraph assesses materiality of cybersecurity incidents across multiple fiscal years — no material breaches, no expenses from penalties/settlements — making it a Strategy Integration materiality assessment. It contains a firm-specific fact (the 2020 breach date), but the fiscal year-end dates are standard reporting periods rather than independent verifiable facts, so it reaches Firm-Specific but not Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Discusses a past breach (2020), states no material breaches in 2021-2023, and no expenses from breaches. This is primarily about the business/financial impact (or lack thereof) of cybersecurity - a materiality assessment.

Category: Strategy Integration - it's assessing materiality ("not experienced any material cybersecurity breach", "not incurred any net expenses from penalties and/or settlements"). This is a materiality assessment per Rule 6.

Specificity:
- "2020" - specific date
- "December 31, 2023, 2022 and 2021" - specific dates

- The fiscal year end dates are standard reporting periods but still constitute specific dates, and "2020" marks a particular year when the last breach occurred. These qualify as specific dates for QV purposes.

- However, the fiscal year references are routine disclosure requirements rather than independent verifiable facts, while the breach year is a concrete data point.

- Since there's only one genuinely firm-specific date (2020) and no dollar amounts mentioned for penalties or settlements, this falls under Firm-Specific classification.

fact: Last known cybersecurity breach occurred in 2020

fact: No material breach in years ended December 31, 2023, 2022, 2021


content_category: Management Role

reasoning: The paragraph's primary content is about the CIO as a person — their nearly 30 years of experience, their 2018 joining date, and their prior career in professional services — making it Management Role over Risk Management Process. The ISMS Committee description is subordinate to establishing the CIO's reporting structure. Two QV-eligible hard facts: 'nearly 30 years' of experience and the specific year '2018' when the CIO joined.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes:
1. CIO leadership of cybersecurity program - nearly 30 years of experience
2. CIO's background - joined Huron in 2018, prior roles in professional services
3. CIO reports quarterly to ISMS Committee
4. ISMS Committee composition and responsibilities

Person-vs-function test: The paragraph spends significant text on the CIO's qualifications (30 years experience, joined in 2018, prior roles). But it also describes the ISMS Committee's function extensively. The opening frames this as about who leads the program and their qualifications, then transitions to the committee structure.

The CIO's credentials and background dominate the first portion, while the ISMS Committee's organizational structure and responsibilities take up the second half. Since the paragraph centers on the CIO as an individual—their experience, tenure at Huron, and professional history—alongside how they fit into the management hierarchy, Management Role is the primary category here. The specific details about the CIO's nearly three decades in cybersecurity and their appointment in 2018 anchor this as a person-focused discussion.

Looking at what qualifies for quantified-verifiable facts: the "nearly 30 years" of experience and the "2018" joining date are both specific enough to verify. That gives me two QV-eligible facts, which means this content should be tagged as Quantified-Verifiable.

fact: CIO (Chief Information Officer) leads Information Security team

fact: Nearly 30 years of relevant work experience

type: quantified

fact: Joined Huron in 2018

fact: ISMS (Information Security Management System) Committee

fact: Prior roles in professional services industry at large public companies


content_category: Risk Management Process

reasoning: The paragraph describes the company's cybersecurity program in general terms — safeguarding information, investing in people/processes/technology, managing cyber risk. No named frameworks, roles, tools, or firm-specific details. The forward-looking disclaimer at the end doesn't change the primary topic of describing internal cybersecurity processes.


reasoning: The paragraph describes the Audit Committee's role in receiving prompt incident reports and updating the Board — board-level oversight is the primary topic. All elements (Audit Committee, Board, internal controls, reporting thresholds) are generic governance language with no named frameworks, firm-specific facts, or verifiable details.

thinking:
Classify this paragraph.

The paragraph describes the Audit Committee receiving information about cybersecurity incidents and providing updates to the Board. The grammatical subjects are "internal controls," "Audit Committee," and "Audit Committee" again - focusing on board/committee oversight mechanisms.

Category: Board Governance - the Audit Committee (a board committee) is the primary actor receiving reports and updating the Board.

Specificity: Let me check the facts:
- "Audit Committee" - NOT list (generic governance)
- "Board" - NOT list
- "established reporting thresholds" - generic
- No named frameworks, no specific facts from the IS list

- This is generic boilerplate language without specific details or named frameworks.


reasoning: The paragraph is about the person filling the cybersecurity leadership role — their title, years of experience, and background — making it Management Role. Two QV-eligible hard facts (30 years IT experience + 15 years cybersecurity experience) push specificity to Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the VP of IT's role, experience (30 years IT, 15 years cybersecurity), and team composition.

Category: This is about the person - their qualifications, experience, credentials. The person-vs-function test: the paragraph is primarily about WHO the person is (title, years of experience, background) and their team. Management Role.

Specificity:
- "Vice President of Information Technology" - this is a cybersecurity-adjacent role... actually looking at the IS list: "VP of IT/Security" is listed. So this counts.
- "over 30 years of experience" - specific number → QV-eligible

- "over 15 years of extensive experience in cybersecurity" - specific number → QV-eligible

So I've identified two quantified and verifiable facts here: the 30 years in IT and the 15 years in cybersecurity, both of which are hard numbers that can be checked.

fact: Vice President of Information Technology (cybersecurity-specific leadership role)

fact: over 30 years of experience in information technology


content_category: Third-Party Risk

reasoning: The paragraph's central topic is the security posture of third-party SaaS providers and the attestation standards they must meet (SSAE audits), making this Third-Party Risk. SSAE is a named attestation standard, triggering Sector-Adapted, but no firm-specific facts (no named vendors, no headcounts, no specific dates) are present.

thinking:
Let me analyze this paragraph.

Content: Describes cloud-first strategy using SaaS solutions, and that third-party providers conduct SSAE audits.

Category: The central topic is about third-party providers and their compliance (SSAE audits). This is about oversight/requirements of external parties. → Third-Party Risk

Specificity: SSAE is a named standard (similar to SOC 2). No firm-specific facts beyond that. → Sector-Adapted

fact: SSAE audits (Statement on Standards for Attestation Engagements)

type: framework


reasoning: The paragraph describes the company's internal cybersecurity program and its purpose (identify, assess, manage risks), which is Risk Management Process. It contains no named frameworks, roles, tools, or any firm-specific details — entirely boilerplate language that could appear in any filing.


reasoning: The paragraph describes the company's own internal cybersecurity processes — IT policies, annual security training, and phishing campaigns. These are all common practices (security awareness training, phishing simulations) with generic cadences ('annual', 'regular') and unnamed entities ('third-party'), placing this squarely at Generic Boilerplate.

thinking:
Classify this paragraph.

Content: describes internal IT policies, annual training, and phishing campaigns. This is about the company's own internal cybersecurity processes.

Category: Risk Management Process - describes internal security practices (policies, training, phishing campaigns).

Specificity: No named frameworks, no firm-specific facts from the IS list. "annual" is generic cadence, "third-party phishing campaigns" uses unnamed entities. Common practices (security awareness training, phishing simulations). → Generic Boilerplate.


reasoning: The paragraph's central topic is oversight of third-party service providers — evaluating them before engagement and reviewing their SOC reports — making Third-Party Risk the dominant category. It names SOC reports (a recognized standard) but contains no firm-specific facts (no named vendors, headcounts, or unique program identifiers), placing it at Sector-Adapted.

thinking:
Classify this paragraph.

Content: About oversight of third-party service providers, evaluating them, reviewing SOC reports. Central topic is vendor oversight → Third-Party Risk.

Specificity: "System and Organization Controls reports" = SOC reports = named standard. No firm-specific facts beyond that. → Sector-Adapted.

fact: System and Organization Controls (SOC) reports


reasoning: The paragraph describes the company's internal incident management process: a defined team for materiality determination and a detailed incident response playbook. While multiple roles are named, the paragraph is about the function (incident management process) not the persons — applying the person-vs-function test, removing the titles still leaves a process description. The specific team composition spanning both the Sponsor and the company itself is a firm-specific organizational detail, and CISO/CIO are cybersecurity-specific titles on the IS list, but no QV-eligible hard facts (dates, dollar amounts, named firms/tools) are present.

thinking:
Let me analyze this paragraph.

Content: Describes a cyber incident management team composition and incident response process.

Category: This describes internal processes - specifically incident response planning and a management team structure. The team composition is detailed. The primary content is about the company's internal process for handling incidents (materiality determination, incident response playbook). This is Risk Management Process - it describes IR planning and team structure.

Wait - could this be Management Role? The paragraph names specific roles. But the paragraph is about the team/process, not about individual persons' qualifications. The person-vs-function test: remove the role titles and the paragraph still describes an incident management process. → Risk Management Process.

Now I'm checking which roles mentioned are actually cybersecurity-specific. The CIO and CISO are clearly tied to cybersecurity, but the CFO, CLO, CEO, General Counsel, and Head of Marketing are generic executive positions without cybersecurity focus.

fact: CISO on cyber incident management team

fact: CIO (Sponsor's) on cyber incident management team

fact: Team composition: Sponsor's CIO, CISO, CFO, CLO and company's CEO, CFO, General Counsel and Head of Marketing


reasoning: This is an explicit materiality assessment stating that no cybersecurity incidents have materially affected the company's business strategy, results of operations, or financial condition. Per Rule 6, materiality disclaimers are Strategy Integration. The language is boilerplate with no firm-specific facts.


reasoning: The paragraph describes the company's own internal assessment processes using external assessors — penetration tests, scanning, QSA reviews, and maturity assessments. Per Rule 3, external assessors hired to test the company are Risk Management Process, not Third-Party Risk. The brief mention of cyber insurance premiums is subordinate to the dominant assessment/process content. Named standards (NIST, PCI DSS) trigger Sector-Adapted, but no firm-specific facts (no named firms, no specific dates, no headcounts, no named tools) appear to push to Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes third-party engagement - independent QSA, penetration tests, scanning, NIST categorization, cyber insurance premiums with maturity assessment.

Category: The central topic is oversight of external parties conducting assessments. But wait - these third parties are serving the company (conducting assessments OF the company). Per Rule 3: "External assessor hired to test the company → Risk Management Process (they serve the company)." However, the paragraph is heavily about third-party engagement. Let me re-read Rule 3 more carefully.

"External assessor hired to test the company → Risk Management Process (they serve the company)" - yes, this is about the company's own assessment processes using external parties. The third parties here are tools of the company's own risk management, not vendors whose cybersecurity the company oversees.

So the assessments and consultants evaluating the company's own security posture fall under Risk Management Process. There's a brief mention of cyber insurance that touches on strategy, but the dominant focus is clearly the assessment activities themselves. I'm also noting specific terminology like QSA as a PCI DSS designation and Payment Card Industry compliance references that could be firm-specific details worth tracking. I'm seeing that the frameworks themselves—NIST and PCI DSS—are what push this into Sector-Adapted territory, but there aren't any firm-specific facts beyond those named standards, so the overall classification lands on Sector-Adapted.

fact: Payment Card Industry compliance (PCI DSS)

fact: NIST categorization


category_confidence: medium

reasoning: While the paragraph opens with CIO reporting lines (Management Role) and mentions Board/Audit Committee reporting (Board Governance), the dominant content by volume describes the company's organizational processes for managing cybersecurity: ERM Committee integration, internal audit assessment, Architecture Review Board, and Project Management Office. Applying the person-vs-function test, removing the CIO title leaves a fully coherent process description. Multiple firm-specific facts (CIO title, named committees/teams with unique identifiers) but no QV-eligible hard facts (no dates, dollar amounts, headcounts, or named third-party firms).

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph covers multiple topics. Let me identify the primary focus:

1. "IT leadership team manages the global cybersecurity and IT compliance organization" - Management Role
2. "Senior Vice President, Chief Information Technology Officer directly reports updates to the Audit Committee... and the full Board" - This is about reporting lines, could be Management Role or Board Governance
3. "cybersecurity team periodically reports to our Global Leadership Team" - Management Role
4. "ERM Committee which ensures cybersecurity risks are integrated" - Risk Management Process
5. "internal audit team independently assesses the cybersecurity program" - Risk Management Process

6. "Architecture Review Board" and "Project Management Office" - Risk Management Process

The paragraph opens with the IT leadership and CIO reporting structure, then shifts to describing the various organizational mechanisms for managing cybersecurity—the ERM integration, internal audit assessments, and governance boards. The grammatical subjects keep changing across different teams and committees, but the core focus is really on the processes and structures themselves rather than any individual's background. Using the person-versus-function test, even without the CIO title, this paragraph would still convey the same organizational processes and oversight mechanisms.

Looking at what dominates by volume, the ERM Committee, internal audit, ARB, and PMO take up most of the space, while the CIO's reporting line is just one sentence. The paragraph is fundamentally describing how the company manages cybersecurity risk through layered organizational processes. The specificity markers—like "Senior Vice President, Chief Information Technology Officer" and references to named internal programs like the "Global Leadership Team"—indicate firm-specific details, but they're supporting the larger narrative about risk management structures rather than being the main point.

For the QV check, I'm looking for hard verifiable facts. The named roles and committees don't qualify, and the cadences mentioned ("at least twice annually," "at least annually") are too generic. There are no dates, dollar amounts, headcounts, or named third-party firms. So this lands as Firm-Specific with multiple firm-specific facts but no quantifiable verification points.

fact: Global Leadership Team (GLT)

fact: Enterprise Risk Management (ERM) Committee

fact: Architecture Review Board (ARB)

fact: Project Management Office (PMO)


reasoning: The paragraph describes the company's internal cybersecurity monitoring, risk assessment workflow, and a long list of security controls (anti-malware, MFA, encryption, vulnerability scans, etc.). The mentions of Director of IT, Head of Resource Management, and CCO are incidental attribution for a process description — none are cybersecurity-specific titles per the IS list. No named frameworks, no named tools/products, no specific dates or numbers, and the security measures listed are all common practices. The unnamed 'ISP' does not qualify as a named third-party firm.

thinking:
Let me analyze this paragraph.

Content: Describes how the ISP monitors threats, and when risks are detected, the Director of IT, Head of Resource Management, and CCO consult with the ISP. Then lists various security measures implemented.

Category: This is about the company's internal cybersecurity processes - risk monitoring, assessment, and security controls. The mention of Director of IT, Head of Resource Management, and CCO is incidental attribution. The bulk is about what the program does. → Risk Management Process

Specificity: Let me check for specific facts:
- "Director of IT" — this is on the NOT list (generic IT leadership, not cybersecurity-specific)

- "Head of Resource Management" — generic title
- "CCO" (Chief Compliance Officer) — on the NOT list
- "ISP" — this refers to their Information Security Provider, which is unnamed → generic
- The list of security measures (anti-malware, antivirus, etc.) — common practices
- "penetration testing", "vulnerability scans" — common practices

No named frameworks, no named tools/products, no specific dates, no specific numbers, no cybersecurity-specific titles (CISO, CIO, CTO). The "Director of IT" distinction matters here—the list includes "Director of IT Security" but NOT "Director of IT," so this doesn't qualify as a specific role.

No named standards either. This is generic boilerplate.


reasoning: The paragraph is about the person (VP of IT) and team — their responsibilities, experience, and credentials. The person-vs-function test confirms Management Role: the primary content is who holds the role and their qualifications, not what the program does. Two QV-eligible hard facts: 20+ years individual experience and 60+ years aggregate team experience.

thinking:
Let me analyze this paragraph.

Content: Describes the VP of IT's responsibilities and qualifications, plus team experience.

Category: This is about the person - their role, experience, and team. The VP of IT is the grammatical subject. It describes who they are (20 years experience) and team credentials (60 years aggregate). This is Management Role.

Specificity:
- "Vice President of Information Technology" - this is a cybersecurity-specific title (VP of IT/Security) → IS list ✓
- "over 20 years" - specific number of years → QV-eligible

- "more than 60 years of experience" - specific number → QV-eligible

I've identified two quantified facts here: the VP's individual experience and the team's aggregate experience. Both are specific numbers that can be verified, so this qualifies as Quantified-Verifiable.

fact: over 20 years of experience in IT and information security

fact: aggregate of more than 60 years of experience across the information security team


reasoning: The paragraph describes the company's internal cybersecurity program: framework alignment (NIST CSF), zero-trust strategy, ERM integration, penetration testing, incident response planning, and business continuity. Third-party risk is mentioned as one component of the broader program, not the central topic. No firm-specific facts from the IS list are present — the external auditing firm is unnamed, no cybersecurity-specific roles are named, and all practices described (pen testing, simulations, monitoring) are common. NIST CSF is the only named standard, placing this at Sector-Adapted.

thinking:
Let me analyze this paragraph from CF Industries Holdings' 10-K filing.

Content: This is a detailed description of the company's cybersecurity program - NIST CSF alignment, external auditing, zero-trust strategy, ERM integration, third-party risk management, incident response plan, business continuity. The primary topic is the company's internal cybersecurity processes and methodology.

Category: Risk Management Process - describes internal processes, framework adoption, monitoring, IR planning, ERM integration. Third-party risk is mentioned but as one component of the broader program.

Specificity: Let me check for facts:
- NIST CSF named → framework (Sector-Adapted baseline)

- "zero-trust strategy" → common practice, not a specific fact
- "external auditing firm" → unnamed, NOT list
- "ERM" integration → generic
- "third-party risk management program" → generic program name

IS list check:
- No cybersecurity-specific titles named
- No named committees
- No specific dates
- No named products/tools
- No named third-party firms
- No specific numbers
- No certifications held

The paragraph names NIST CSF (framework) but nothing firm-specific from the IS list. → Sector-Adapted (2).

fact: NIST Cybersecurity Framework (CSF)


reasoning: The paragraph describes an internal policy for business continuity and disaster recovery of IT assets, which falls under risk management processes. However, it focuses on unintentional disruptions (fire, power loss, hardware failures) rather than cybersecurity threats, lowering category confidence. No specific facts from the IS list are present — 'Business Resiliency Management Policy' is a generic program name, 'FHLBank' is a company self-reference, and no named frameworks, roles, dates, or numbers appear.

thinking:
Let me analyze this paragraph.

This is about a "Business Resiliency Management Policy" - it's about business continuity/disaster recovery, not specifically cybersecurity. It mentions "unintentional events like fire, power loss, and other technical incidents such as hardware failures" - these are operational resilience topics, not cyber threats.

Category: This is describing internal processes related to business continuity and disaster recovery. It's borderline between Risk Management Process and None/Other. The policy covers IT asset availability and disaster recovery, which tangentially relates to cybersecurity resilience. But the focus is on business disruptions from unintentional events (fire, power loss, hardware failures) - not cybersecurity threats. This feels more like general business continuity than cybersecurity disclosure.

However, since it appears in Item 1C where the company presents their cybersecurity disclosures, and business continuity is typically considered part of a broader cybersecurity program, I should classify this as Risk Management Process. The policy specifically addresses IT asset unavailability and recovery procedures, which fall under cybersecurity risk management. Now I need to assess the specificity - the "Business Resiliency Management Policy" is a named internal program, though I should check what concrete details are actually provided.

Looking at the facts here, there's no unique abbreviation, no named frameworks, no specific dates or roles, and no numbers. The policy name itself is generic - it's essentially a business continuity plan under a different name, which per the guidelines doesn't qualify as a specific fact. Without any IS-list facts, this falls into generic boilerplate.


reasoning: The paragraph's primary content is the composition and responsibilities of two management-level committees (SOMC and SRMC), identifying which officers sit on them and what each committee is responsible for — this is organizational structure and management roles, not a description of processes or tools. Multiple named non-generic committees (SOMC, SRMC, Technology Committee, ORC) and a cybersecurity-specific role (CIO) provide firm-specific facts, but no QV-eligible hard facts (dates, dollar amounts, named third-party firms, etc.) reach the two-fact threshold.

thinking:
Let me analyze this paragraph.

The paragraph describes two management committees (SOMC and SRMC) and their compositions and responsibilities. Let me classify it.

Content: Describes management committees (SOMC, SRMC), their composition (senior leadership, CRO, CIO), and responsibilities (receiving reports, managing operational risk, implementing cybersecurity risk management framework within ERM).

Category: This is about management-level committees and their roles. The grammatical subjects are SOMC and SRMC - management committees. This describes organizational structure and reporting, with some process elements. The primary focus is on who these committees are and what they're responsible for - this is Management Role (management committees responsible for cybersecurity).

I'm reconsidering whether this is primarily about structure or function. The committees themselves are the focus - their composition and what they oversee - so this is definitely about management roles and organizational structure rather than the processes they implement.

Now I'm checking which entities qualify as specific. The CIO is a cybersecurity-specific title that makes the list, and the Technology Committee is a named non-generic committee. The SOMC, SRMC, and ORC are all internal committees with unique identifiers, though the ERM Program is just a generic program name. Looking at the verifiable facts - there are no dates, dollar amounts, headcounts, or named third-party firms here, so this doesn't meet the QV threshold.

fact: CIO

fact: SOMC (Security Operations Management Committee)

fact: SRMC (Security Risk Management Committee)

fact: Technology Committee

fact: ORC


reasoning: The paragraph's primary content describes the company's own internal processes for assessing, identifying, and managing cybersecurity risks, making it Risk Management Process. The appended cross-reference to Risk Factors is secondary. No named frameworks, specific roles, dates, or other facts from the IS list are present — all language is generic boilerplate.

thinking:
Let me analyze this paragraph.

Content: Describes implemented processes for assessing/identifying/managing cyber risks, plus a cross-reference to Risk Factors.

Category: The first sentence describes risk management processes (assessing, identifying, managing risks). The second sentence is a cross-reference. The dominant content is about the company's internal processes. → Risk Management Process

Specificity: No named frameworks, no specific facts from the IS list. "The Bank" is a self-reference (NOT list). Generic language about "processes for assessing, identifying, and managing risks." The cross-reference is boilerplate. → Generic Boilerplate


reasoning: The paragraph describes the IT Infrastructure team's operational responsibilities — configuration and patch management — which are internal cybersecurity processes. The Director of Cloud Infrastructure is mentioned as attribution for who leads the team, but the substantive content is about the function (what the team does), not the person. 'Director of Cloud Infrastructure' is a general IT title, not a cybersecurity-specific title per the IS list, and 'various certifications' are unnamed, so no specific facts qualify for Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes an IT Infrastructure team led by the Director of Cloud Infrastructure, responsible for configuration and patch management. Team holds various certifications.

Category: This is about an internal team and their responsibilities (configuration, patch management). The Director of Cloud Infrastructure is mentioned but this is more about what the team does (function) than about the person. However, the person-vs-function test: the paragraph describes the team's responsibilities (configuration, patch management) which are operational processes. But it also describes who leads the team and team composition.

Actually, this is a borderline case. The paragraph tells us about the team composition and who leads it, but also describes what they do.

The core focus here is really on what the team does operationally—configuration and patch management—rather than on the Director as a person. The Director's title isn't even cybersecurity-specific; it's a general IT role that wouldn't appear on the list of security-focused titles. So this paragraph is fundamentally describing operational IT functions and risk management activities.

Looking at the specificity: "Director of Cloud Infrastructure" is a company-specific title but not a recognized cybersecurity role, "various certifications" are vague and unnamed, and "information system and cloud professionals" is generic language. There are no named frameworks, no concrete facts from the IS list, and no standards referenced. This reads as generic boilerplate—the kind of description that could apply to almost any organization's infrastructure team.


reasoning: The majority of the paragraph (3 of 4 sentences) describes vendor oversight: third-party service providers undergo financial, reputational, contractual, and informational security assessments to meet policy requirements. While the opening sentence mentions ERM integration, vendor risk management is the dominant topic. No named frameworks, specific roles, dates, or firm-specific facts are present — the language could apply to any large company.

thinking:
Let me analyze this paragraph.

Content: Discusses cybersecurity risk processes integrated into ERM, use of third-party service providers, and vendor risk management assessments.

Category: This mentions both internal processes (ERM integration) and third-party risk. The paragraph starts with internal process integration, then discusses using third-party providers, then describes vendor risk management assessments. The central topic shifts to vendor oversight - assessments of vendors, policy requirements for vendors. But the opening frames it as part of the company's own risk management. Let me apply Rule 3: Third parties mentioned as one component of internal program → Risk Management Process. Vendor oversight is the central topic → Third-Party Risk.

Actually, looking at the weight of the content, most of the paragraph focuses on third-party service providers and vendor assessments, so the dominant theme is really vendor and third-party oversight. As for specificity, I'm seeing generic terminology like "Enterprise Risk Management Program" and "vendor risk management process" without any named frameworks, specific roles, dates, or numbers. The assessment types mentioned—financial, reputational, contractual, and informational security—are described broadly without concrete details. This reads as generic boilerplate.


content_category: Incident Disclosure

reasoning: The paragraph is a narrative of an actual cybersecurity incident — discovery, investigation, containment measures, and resolution — squarely fitting Incident Disclosure. Two specific dates (November 19 and November 26, 2023) are independently verifiable hard facts, meeting the QV threshold. Note that 'leading experts' and 'law enforcement' are unnamed and do not count as specific facts.

thinking:
Let me analyze this paragraph.

Content: Describes a specific cybersecurity incident - dates, what happened, response actions, containment.

Category: Incident Disclosure - describes what happened in an actual incident.

Specific facts:
- "November 19, 2023" - specific date
- "November 26, 2023" - specific date

These are two hard verifiable facts (specific dates). No named firms ("leading experts" is unnamed), no named tools/products, no dollar amounts.

Two specific dates = two QV-eligible facts → Quantified-Verifiable.

fact: November 19, 2023 — date incident was discovered

fact: November 26, 2023 — date incident was contained


reasoning: The paragraph primarily describes incident response actions — scope analysis, customer notification, credit monitoring, law enforcement coordination, and litigation — making Incident Disclosure the dominant category. The closing materiality sentence is subordinate to the incident narrative. Specificity is Firm-Specific: the 1.3 million impacted consumers is one QV-eligible hard fact, but there are no additional hard verifiable facts (no specific dates, named firms, or dollar amounts) to reach the two-fact QV threshold.

thinking:
Let me analyze this paragraph from FNF's 10-K Item 1C filing.

Content: Describes aftermath of a cybersecurity incident - affected systems analysis, customer notifications, 1.3 million impacted consumers, credit monitoring services, law enforcement coordination, lawsuits, and a materiality assessment.

Category: This describes what happened in response to an incident - scope analysis, notifications, remediation actions, lawsuits. But it also ends with a materiality statement. The dominant content is incident response actions (notification, credit monitoring, coordination, lawsuits). The materiality statement is one sentence at the end. → Incident Disclosure.

Now I'm checking the specificity of the details provided. The 1.3 million consumer figure is quantified, but lawsuits lack specific names, and the remediation services mentioned are standard practices without named vendors or dates. The materiality statement reads as boilerplate language. Looking at what qualifies as a QV-eligible fact, I only have one hard number here - the 1.3 million consumers - which means I fall short of the two facts needed for QV eligibility. There are no named firms, specific dates, dollar amounts, or identified tools, so this remains a single firm-specific data point.

fact: approximately 1.3 million potentially impacted consumers


reasoning: The entire paragraph is about the CISO as a person — tenure, experience, credentials, and reporting line — making it clearly Management Role per the person-vs-function test. QV-eligible hard facts include 'over twenty years' of experience, 'since 2013' (specific date), and CISSP certification, yielding 3 verifiable facts well above the 2-fact QV threshold.

thinking:
Management Role - about the person's credentials, experience, reporting lines.

Specific facts:
- CISO (named_role)
- over twenty years experience (quantified)
- since 2013 (specific_date)
- MBA (not QV-eligible - generic degree without named university)
- CISSP certification (quantified - named certification)
- CTO reporting line (named_role)

QV-eligible: "over twenty years" (years of experience as specific number), "since 2013" (specific date), CISSP (named certification) → 3 QV facts → Quantified-Verifiable

fact: CISO

fact: over twenty years of experience in IT and information security

fact: at the Company since 2013

fact: Certified Information Systems Security Professional (CISSP) certification

fact: Chief Technology Officer (CTO) reporting line


reasoning: The paragraph is framed under 'Effects and Impacts of Cybersecurity Risks' and its primary communicative purpose is assessing the business and financial consequences of a cybersecurity incident — $1.5M in costs, operational disruption to shipping, and a concluding materiality assessment. While incident details are present (date, operational impact, recovery timeline), they serve to contextualize the strategic/financial impact discussion rather than narrate the incident itself. The materiality conclusion and cost disclosure are the core purpose. Multiple QV-eligible hard facts: specific announcement date (October 28, 2023) and dollar amount ($1.5M).

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics:
1. A specific cybersecurity incident (October 28, 2023, operational impact, mid-December recovery)
2. Financial impact ($1.5 million expenses)
3. Materiality assessment
4. Cross-references to risk factors

The paragraph starts with "Effects and Impacts of Cybersecurity Risks" and describes what happened with an incident, its financial cost, and then makes a materiality assessment.

Per the tiebreakers: "Paragraph DESCRIBES what happened in an incident (dates, access, encryption, scope, response actions) → Incident Disclosure" vs "Paragraph ONLY discusses financial cost, insurance, or materiality of an incident WITHOUT describing the event → Strategy Integration"

This paragraph does both—it narrates the incident with specific dates and operational impacts, then pivots to financial costs and materiality considerations. The incident details occupy the opening portion, but the analysis shifts toward financial and strategic implications. Given the balance between narrative and financial assessment, this leans toward Strategy Integration. Looking at the specifics now—October 28, 2023 is a concrete date that qualifies, and the $1.5 million cost is clearly quantified. The other dates are softer references like "mid-December" and "first quarter of fiscal 2024," so those don't carry the same weight for verification purposes.

fact: October 28, 2023 announcement date

fact: $1.5 million of expenses related to the cybersecurity incident

fact: mid-December 2023 return to operations

fact: first quarter of fiscal 2024


reasoning: The paragraph is about the people filling cybersecurity leadership roles — their degrees, years of experience, and tenure at the company. This is squarely Management Role (person-vs-function test: remove the credentials and there's no substantive content left). Multiple QV-eligible hard facts: over 20 years, over 5 years, and over 21 years of experience are specific quantified durations, giving at least two QV-eligible facts.

thinking:
Let me analyze this paragraph.

The paragraph describes two management roles: SVP of IT and Senior Director of Information Security, their qualifications, experience, and what they report on. The primary content is about the people - their degrees, years of experience, tenure.

Content category: Management Role - the paragraph is about who these people are, their credentials and background.

Specific facts:
- SVP of Information Technology (cybersecurity-adjacent role)
- Senior Director of Information Security (cybersecurity-specific role)
- undergraduate degree in Technology Management (Manufacturing Systems)
- over 20 years in IT
- over five years at Mueller
- undergraduate degree in Computer Engineering

- over 21 years in information security

Now I'm checking the quantified facts here. The specific durations—over 20 years, over 5 years, and over 21 years—all count as quantified-verifiable data. The roles themselves, SVP of IT and Senior Director of Information Security, are firm-specific titles that indicate cybersecurity expertise.

fact: Senior Vice President of Information Technology

fact: Senior Director of Information Security

fact: over 20 years in information technology

fact: over five years within Mueller

fact: over 21 years in information security and engineering


reasoning: The paragraph's heading is 'Effects and Impacts of Cybersecurity Risks' and its primary communicative purpose is assessing the business/financial consequences of a past incident — $1.5M in costs, ongoing investment commitments, and a materiality disclaimer — rather than narrating the incident itself. The incident is referenced briefly for context, but the dominant content is Strategy Integration (cost, investment posture, materiality assessment, risk-factor cross-references). Multiple QV-eligible hard facts (specific date October 28, 2023 + $1.5M dollar amount) satisfy the two-fact threshold.

thinking:
Let me analyze this paragraph from Mueller Water Products' 10-K filing.

The paragraph describes a cybersecurity incident's effects and impacts, including specific dates, costs, operational disruption, and a materiality assessment.

Content category: This paragraph mixes Incident Disclosure and Strategy Integration. Let me apply the tiebreakers:
- It describes what happened (incident impacting operations, timeline of restoration) → Incident Disclosure signals
- It discusses financial cost ($1.5M expenses), ongoing investment, and materiality assessment → Strategy Integration signals

The paragraph's primary focus is on the business/financial impact of the incident and materiality assessment. The incident narrative is brief (detected incident, facilities operational by mid-December). The bulk is about costs, investment plans, and materiality disclaimer. The heading itself is "Effects and Impacts of Cybersecurity Risks."

Now I'm breaking down the paragraph sentence by sentence to determine which category dominates. The first two sentences cover the incident itself—when it was detected and when operations resumed—while the remaining sentences focus on the financial consequences and strategic response. Given that the tiebreaker rule specifies Strategy Integration when the paragraph emphasizes financial cost and materiality without extensive event description, and this one does include both elements, I need to weigh whether the incident details or the financial/strategic discussion carries more weight in the overall narrative.

The heading "Effects and Impacts" signals that the focus is on consequences rather than the incident itself, which tips the balance toward Strategy Integration. For specificity, I've identified two hard verifiable facts: the October 28, 2023 date and the $1.5 million expense figure, both of which qualify as Quantified-Verifiable.

fact: October 28, 2023 — date incident was announced

fact: $1.5 million in incident-related expenses

fact: mid-December 2023 — facilities returned to operations


reasoning: The paragraph opens with management's role but its substantive content describes the company's internal cybersecurity processes: a dedicated technology services department, internal audit involvement, employee input solicitation, semi-annual training, and penetration testing. The CTO is mentioned as brief attribution for who leads the department, not as the paragraph's focus — removing the CTO reference, the paragraph still functions as a process description. Applying the person-vs-function test, this is about the function, not the person. The CTO title (a cybersecurity-specific role on the IS list) provides one firm-specific fact, but no second QV-eligible hard fact exists (semi-annual cadence and penetration testing are on the NOT list).

thinking:
Let me analyze this paragraph.

Content: Discusses management's role in cybersecurity, mentions CTO, technology services department, internal audit staff, employee training, penetration testing. The primary subject is management and what the company does for cybersecurity.

Category: The paragraph starts with "Management... plays an integral role" but then describes processes (training, pen testing, risk assessment). The CTO is mentioned but only as attribution for leading the tech department. Using the person-vs-function test: remove "led by the Company's Chief Technology Officer" and the paragraph still describes processes. The bulk is about what the company does (risk assessment, training, pen testing). But the grammatical subject for much of it is management/the company describing their process.

The opening establishes management's role in risk assessment, then details the organizational structure—a dedicated tech services department under the CTO and internal audit staff—before moving into specific activities like employee training and penetration testing. The paragraph blends organizational structure with operational processes, but the framing around management's role and who's involved suggests the primary focus is on how the company has organized its cybersecurity management function.

Looking at what qualifies as firm-specific: the CTO title is cybersecurity-specific and appears on the IS list, making this Firm-Specific. The cadence ("semi-annually") and practices ("penetration tests") are generic industry standards, not list items. There's only one IS fact here—the CTO—and no quantifiable hard facts like dates, budgets, headcounts, or named tools.

This lands at Firm-Specific, Level 3.

fact: Chief Technology Officer leads the technology services department


reasoning: The paragraph frames the company's overall risk management process across three categories (cybersecurity, vendor, compliance), with third-party compliance verification presented as one component of that broader internal process rather than the central standalone topic. Per Rule 3, third parties mentioned as one component of an internal program → Risk Management Process. Named standards SOX and PCI trigger Sector-Adapted, but no firm-specific facts from the IS list (no cybersecurity-specific titles, named tools, dates, or headcounts) are present to elevate further.

thinking:
Let me analyze this paragraph.

Content: Describes risk management in three categories, partnering with third parties for tooling, verifying third-party compliance using SOX and PCI standards.

Category: This mentions both internal risk management processes AND third-party risk. The paragraph describes three risk categories (internal process), then discusses partnering with third parties for tooling (internal process), then shifts to verifying third-party compliance with SOX and PCI. The central topic spans both, but the dominant theme seems to be the overall risk management process with third-party oversight as a component. Actually, looking more carefully - the second half focuses on third-party compliance verification. Let me apply Rule 3:

- "Third parties mentioned as ONE component of internal program → Risk Management Process"
- "Requirements imposed ON vendors → Third-Party Risk"

The paragraph opens by framing their overall risk management approach with three categories, one being vendor risk, then moves into imposing compliance standards on IT suppliers. The last two sentences specifically focus on verifying third-party compliance and enforcing SOX/PCI requirements on vendors. That's clearly requirements imposed ON vendors. But the opening context frames this as the company's broader process. It's a mixed paragraph, though the dominant purpose leans toward describing their risk management approach overall, with third-party compliance as one component. I'd categorize this as Risk Management Process since the framing is about "our process" overall.

Actually, wait—let me reconsider. The emphasis on imposing requirements and verifying compliance on vendors might tip this toward Third-Party Risk instead.

Looking at the specificity: SOX and PCI are named standards, which puts this at Sector-Adapted minimum. The three risk categories they mention—cybersecurity/technical, vendor, compliance/regulatory—could be firm-specific organizational details, but they're fairly generic categories. There are no cybersecurity-specific titles, named committees, specific dates, named tools or firms, or headcounts. PCI DSS is on the named standards list, and SOX is a regulatory standard. Both are sector-adapted standards.

fact: SOX compliance standard applied to IT suppliers

fact: PCI compliance standard applied to IT suppliers


reasoning: The paragraph is framed by 'Board of Directors has ultimate oversight of cybersecurity risk' and traces the governance chain downward—Audit Committee assists, management runs the program, escalation process reports back to the Board. The board/committee is the primary actor and the management details serve to explain the board's oversight mechanism. Specificity is Firm-Specific: the head of information security department is a cybersecurity-specific role (IS list) and CISSP is a named certification (IS list), but only one QV-eligible fact (CISSP) so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics: Board oversight, Audit Committee role, management reporting structure, and some process elements. Let me determine the dominant category.

The paragraph starts with Board oversight, mentions Audit Committee, then shifts to describing the management structure (head of information security department, reports to CFO, CFO monitors through team with certifications).

The grammatical subjects shift: Board of Directors → Audit Committee → cybersecurity program is run by head of info security → CFO is informed → We have escalation process.

This is a mixed paragraph. The first half is about Board/Audit Committee oversight. The second half describes management reporting lines and how the CFO stays informed. Let me assess dominance.

Looking at the structure more carefully, the opening establishes Board oversight as the framing context, and the management details that follow explain how that oversight actually functions through the reporting chain. The paragraph traces the full governance hierarchy from the Board down through the CFO to the security leadership, so the primary purpose is describing the complete governance structure rather than splitting between two separate topics. and "head of our information security department" is actually a cybersecurity-specific role that maps to titles on the IS list. CISSP is a named certification held by team members, which counts as a specific fact under certification claims. So I'm finding more IS-specific details than I initially thought—the head of information security department, the CISSP certifications, and the CFO reporting structure all contribute to the specificity here. "Head of information security department" matches the IS list items like "Information Security Officer" or "Director of IT Security," so that's a cybersecurity-specific title. With only one QV-eligible fact (CISSP) and one firm-specific role, this falls into Firm-Specific, not QV.

fact: Head of information security department (cybersecurity-specific leadership role)

fact: Certified Information Systems Security Professional (CISSP) certifications held by team members


reasoning: The paragraph's dominant content is a description of a specific ransomware incident — its timing, nature (ransomware on network), scope (briefly disrupted some systems), and outcome (no ransom paid, no fines, $100K costs). While the final sentence contains a materiality assessment, the incident narrative occupies the majority of the paragraph and is its primary communicative purpose. Two QV-eligible hard facts: specific date (June 2020) and dollar amount ($100,000).

thinking:
Let me analyze this paragraph carefully.

The paragraph describes a past incident (ransomware in June 2020) and then makes a materiality assessment. Let me apply the tiebreaker rules.

Content: Describes what happened (ransomware attack, June 2020, disrupted systems, didn't pay ransom, no fines/settlements, $100K costs) AND makes a materiality statement ("have not encountered any other cybersecurity challenges that have materially impaired").

Per the tiebreakers: "Paragraph DESCRIBES what happened in an incident (dates, access, encryption, scope, response actions) → Incident Disclosure" vs "Brief mention of a past incident + materiality conclusion as the main point → Strategy Integration"

The incident details dominate the paragraph—specific dates, the attack type, the company's response, and quantified costs. The materiality assessment is really just the closing sentence. This looks like Incident Disclosure.

For specificity, I've got "June 2020" as a concrete date and "$100,000" as a dollar figure—both are hard facts I can verify. That makes it Quantified-Verifiable.

fact: June 2020

fact: $100,000 in out-of-pocket expenses


reasoning: The paragraph describes the company's internal cybersecurity processes — risk assessments, security measures, monitoring — which maps to Risk Management Process. It contains no named frameworks, no firm-specific facts, and no verifiable details; the language could apply to any company unchanged.


reasoning: The paragraph describes the existence of policies and procedures to manage cyber risk, fitting Risk Management Process, but contains no named frameworks, specific roles, dates, or firm-specific facts beyond a cross-reference to related party notes — all generic boilerplate language.

thinking:
Let me analyze this paragraph.

Content: Discusses cyberattacks as a risk, mentions policies/procedures to manage risk, references affiliates of Cheniere through service agreements, and cross-references Note 14.

Category: This is about risk management processes (policies and procedures to manage cyber risk). The mention of affiliates/service agreements touches on third-party risk, but the dominant theme is the company's own risk management approach. Actually, it's quite generic - acknowledges risk and says they have policies. The cross-reference to related party transactions is notable but doesn't change the substance.

This is pretty generic. Let me check for specific facts:
- "affiliates of Cheniere" - this is a company self-reference

- The statement "We have implemented policies and procedures that are intended to manage and reduce this risk" is a substantive claim about having a risk management program, even if it lacks specifics like named frameworks, roles, or dates. That's enough to categorize this as Risk Management Process rather than generic boilerplate.

Specificity: Generic Boilerplate - no named frameworks, no specific facts, just a cross-reference to Note 14 on related party transactions.


reasoning: The paragraph describes the company's internal process for escalating and assessing potentially material cybersecurity incidents — the Security Incident Management Policy, escalation procedures, and materiality determination. The management roles are listed to define the team composition, not to describe individuals' qualifications or backgrounds (person-vs-function test → function/process). The specific enumeration of the response team members (EVP of Internal Operations, Chief Privacy Officer, Associate General Counsel (Corporate)) constitutes a firm-specific team composition, but no two QV-eligible hard facts are present.

thinking:
Let me analyze this paragraph.

Content: Describes the process for escalating potentially material cybersecurity incidents to a management response team. Lists specific team composition. Describes the Security Incident Management Policy's purpose.

Category: This is about the company's internal process for identifying and escalating material cybersecurity incidents. The management response team is described in terms of its function (escalation, materiality determination, reporting), not in terms of individual qualifications or backgrounds. This is Risk Management Process.

Wait - let me reconsider. The paragraph lists specific roles on the response team. But the person-vs-function test: the paragraph is about the process (escalation, policy, materiality determination), not about who these people are as individuals.

Now I'm checking whether the roles listed actually qualify as cybersecurity-specific. The EVP of Internal Operations, CFO, and Chief Accounting Officer are all generic executive titles. The General Counsel and Chief Privacy Officer are more specialized, but neither appears on the cybersecurity-specific roles list—that list includes CISO, CTO, CIO, and similar IT security positions, and Chief Privacy Officer doesn't fit that definition.

Looking at the Security Incident Management Policy, it's a named program but lacks a unique identifier like an abbreviation, so it's borderline on whether it meets the specificity threshold. However, the actual team composition itself—this specific grouping of Legal, Compliance, and Finance roles—does match the pattern the codebook identifies as firm-specific team compositions, which would qualify as an indicator of internal knowledge.

fact: Management response team comprising EVP of Internal Operations, CFO, Chief Accounting Officer, General Counsel, Chief Privacy Officer, and Associate General Counsel (Corporate)


content_category: None/Other

reasoning: Despite the 'Incident Management' header, the paragraph contains no description of an actual incident, no process details, and no materiality assessment. It is entirely hypothetical risk language ('if our security systems... are penetrated... we could be subject to significant liability') followed by a cross-reference to Risk Factors. This is generic cautionary language with no substantive cybersecurity disclosure content.

thinking:
Let me analyze this paragraph.

It's a hypothetical risk statement about what could happen if security systems are penetrated. It doesn't describe an actual incident, any specific process, or make a materiality assessment. It ends with a cross-reference to Risk Factors.

This is generic risk language - "if X happens, we could face Y consequences" - followed by a cross-reference. No materiality assessment is made (no "has not materially affected" language). No substantive disclosure content.

Category: None/Other - this is generic risk language plus a cross-reference, no substantive cybersecurity disclosure.

Specificity: Generic Boilerplate (always 1 for None/Other).


reasoning: The paragraph primarily describes the company's Cybersecurity Program — its policies, procedures, incident response plan, use of external advisors, and organizational administration. While multiple roles are named, they serve as attribution for how the program is structured rather than describing any individual's qualifications or background (person-vs-function test: remove the titles and the paragraph still describes the program). The IT Steering Committee is a named non-generic committee (analogous to Technology Committee on the IS list), and the named Cyber Incident Response Plan within the Crisis Management Plan provides firm-specific organizational detail. No QV-eligible hard facts (no dates, dollars, headcounts, named firms, or named tools) reach the two-fact threshold.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity program, its policies, the Cyber Incident Response Plan, who administers it (IT Manager, General Counsel/CCO, IT Steering Committee with CEO/CFO/COO), use of external advisors, and belief that individuals have necessary skills.

Category: This is primarily about Risk Management Process - it describes the company's internal cybersecurity program, policies, procedures, and how they're administered. There are management roles mentioned, but the paragraph is about the program/function, not about the persons' qualifications or backgrounds. The person-vs-function test: remove the role titles and the paragraph still describes the program structure. However, it does describe organizational structure and reporting lines extensively.

The core focus is on the program itself and its administration structure - the roles are secondary details explaining how the program operates. The Cyber Incident Response Plan is a named internal program, though "Cyber Incident Response Plan" is fairly generic as a title.

Looking at specificity: IT Manager and the C-suite roles are too generic to qualify, but IT Steering Committee is a specific, named committee similar to Technology Committee on the IS list, making it firm-specific. General Counsel is also generic per the NOT list.

For quantifiable verification, there are no hard facts like dates, dollar amounts, headcounts, or named tools—just structural roles and committee composition. So this doesn't meet the QV threshold.

The classification is Firm-Specific based on the named IT Steering Committee.

fact: IT Steering Committee consisting of CEO, CFO/COO, and General Counsel/CCO

fact: Cyber Incident Response Plan as part of Crisis Management Plan


reasoning: The paragraph identifies the CISO as the leader of the program, describes their experience (20+ years), and details the departmental team composition — all centered on who manages the cybersecurity function. While the team listing is organizational, the primary communicative purpose is identifying the person and structure responsible for the program. Only one QV-eligible hard fact (20 years of experience) so this is Firm-Specific, not Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes:
1. The program's organizational structure within the information security department
2. Lists specific teams: security operations, security architecture and engineering, technology governance, mergers and acquisitions information security, and advisor security
3. The CISO leads the department and manages the Program
4. The CISO has over 20 years of experience

Person-vs-function test: The paragraph describes both organizational structure (teams) and the person (CISO's experience). The first sentence is about departmental composition. The second and third sentences are about the CISO's role and qualifications.

The primary content is about who leads the program and their qualifications, plus the team structure. The team composition is organizational detail supporting the management role description. The CISO is the subject of 2 of 3 sentences. This is Management Role.

Now I'm identifying the specific facts that could be classified as quantified values. The CISO title is a named role, the team names are firm-specific organizational details, and the experience level is quantified in years. Looking at what qualifies as a QV-eligible fact, only the years of experience meets that threshold, making this Firm-Specific overall.

fact: Chief Information Security Officer (CISO)

fact: Teams: security operations, security architecture and engineering, technology governance, mergers and acquisitions information security, and advisor security

fact: Over 20 years of experience in information security


reasoning: The paragraph describes the company's internal information security policies, IT Department controls, executive management responsibilities for policy review, employee obligations, and customer audits — all internal cybersecurity processes. The executive roles mentioned (CEO, CFO, General Counsel) are generic C-suite titles on the NOT list, 'IT Department' is generic, and no named frameworks, tools, dates, or cybersecurity-specific roles appear.

thinking:
Let me analyze this paragraph.

Content: Describes information security policies, IT Department responsibilities, executive management team responsibilities, employee responsibilities, and customer audits. This is about the company's internal cybersecurity processes and policies.

Category: Risk Management Process - describes internal policies, controls, procedures, responsibilities. The executive management team mention (CEO, CFO, General Counsel) is about what they do in the process, not about their qualifications. The IT Department is the actor for implementation.

Specificity: Let me check for specific facts:
- CEO, CFO, General Counsel - these are on the ✗ NOT list (generic C-suite)

- "IT Department" - generic
- "information security policies" - generic
- "regularly audited by certain customers" - generic
- No named frameworks, no specific dates, no named tools, no CISO/CTO/CIO

This is Generic Boilerplate - no named standards, no firm-specific facts.


reasoning: The paragraph describes the company's own internal risk management approach—engaging assessors to test the company and using a defense-in-depth strategy with in-house and third-party resources. Per Rule 3, external assessors hired to test the company are Risk Management Process, not Third-Party Risk. No named frameworks, firms, tools, roles, dates, or specific numbers are present; all entities are unnamed ('reputable third-party assessors,' 'third-party service providers') and practices are generic.

thinking:
Let me analyze this paragraph.

Content: Describes engaging third-party assessors for risk assessments and using defense-in-depth strategy with in-house and third-party providers to manage risks.

Category: This mentions third parties but they serve the company's internal processes. The assessors are hired to test the company, and service providers help implement controls. Per Rule 3: "External assessor hired to test the company → Risk Management Process." The central topic is the company's own risk management approach, not vendor oversight. → Risk Management Process

Specificity: Let me check for specific facts:
- "third-party assessors" — unnamed, NOT list

- "maturity assessments" — common practice
- "defense-in-depth strategy" — general concept
- "in-house resources and third-party service providers" — generic
- No named frameworks, no named firms, no dates, no numbers, no specific roles

This is generic boilerplate with no concrete details or named entities.


reasoning: The paragraph describes the company engaging external assessors, consultants, and auditors to review its own cybersecurity program — these third parties serve the company's internal processes (Rule 3: external assessor hired to test the company → Risk Management Process, not Third-Party Risk). No named firms, frameworks, dates, roles, or other specific facts are present; 'annually' is a generic cadence and 'third-party' entities are unnamed, keeping this at Generic Boilerplate.

thinking:
Classify this paragraph.

Content: Describes engaging third parties (assessors, consultants, auditors) to review the company's cybersecurity program. The third parties serve the company's own program - they're hired to assess/improve it. Per Rule 3: "External assessor hired to test the company → Risk Management Process."

Specificity: No named frameworks, no named firms, no specific dates, no named roles. "annually" is a generic cadence. "third-party" is unnamed. Everything here is generic.

→ Risk Management Process, Generic Boilerplate


reasoning: The paragraph describes MSCI's internal cybersecurity processes: framework alignment (NIST, ISO), certification status, and monitoring activities. This is squarely Risk Management Process. Naming NIST and ISO would be Sector-Adapted, but the claim of having *achieved* ISO 27001:2022 certification is a firm-specific verifiable fact (certification held, not merely a standard named), elevating to Firm-Specific. Only one QV-eligible fact (certification is organizational, not individual), so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

Content: Describes cybersecurity policies, standards alignment (NIST, ISO), ISO 27001:2022 certification, and specific activities like 24/7 security monitoring.

Category: This is about the company's internal cybersecurity processes, frameworks, and monitoring. → Risk Management Process

Specificity: Let me check facts:
- NIST framework → named standard
- ISO standards → named standard
- ISO 27001:2022 certification → This is a certification claim ("has achieved ISO 27001:2022 certification"), which per the codebook is more than naming a standard → Firm-Specific fact

- 24x7x365 security operations monitoring → common practice, not a specific fact

So we have a certification claim (ISO 27001:2022 certification) which is one IS fact → Firm-Specific. The certification is held by the company rather than an individual, so while it qualifies as a Firm-Specific fact, it doesn't meet the QV-eligible criteria which requires specific dates, dollar amounts, headcounts, named third-party firms, named products, or individual certifications.

fact: ISO 27001:2022 certification achieved


reasoning: This lengthy paragraph spans multiple categories (materiality assessment, board committee mention, management credentials, ERM program description) but its dominant communicative purpose is describing the company's risk-based cybersecurity approach and ERM program structure — how the program is organized, what functions it encompasses, and how cybersecurity risks are identified and managed. The CRO background and CISO mention serve the process description rather than being the primary content. Two QV-eligible hard facts (9 years of experience + 20-year Army career) push specificity to Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

This is a long, dense paragraph covering multiple topics. Let me break down what it contains:

1. Materiality assessment: "to date none have materially affected us or our business strategy, results of operation or financial condition" → Strategy Integration signal
2. Cross-reference to Risk Factors
3. Risk-based approach, ERM integration → Risk Management Process
4. RACC (Risk and Compliance Committee) of the Board → Board Governance
5. CRO appointed by RACC, Enterprise Risk Oversight Committee including CISO → Management Role
6. CRO background: "over nine years of senior risk management experience at large technology organizations, following a 20-year career in the U.S.

Army" → Management Role
7. ERM team works with security, IT, compliance, internal audit, third-party risk management → Risk Management Process

The paragraph is really focused on describing the company's enterprise risk management structure and the people running it. The CRO's extensive background in both military and tech risk management, combined with the cross-functional ERM team spanning security, IT, compliance, and audit functions, shows this is a mature, well-resourced risk program. The materiality statement at the start frames this as effective so far, but the bulk of the content is establishing credibility and scope of the risk management operation. I'm identifying which facts here are specific and verifiable—the CISO title, the Risk and Compliance Committee name, the CRO role, plus concrete details like nine years of risk management experience and a twenty-year Army career. These specifics anchor the description of who's running the program and their qualifications.

fact: Risk and Compliance Committee (RACC) of the Board

fact: Chief Risk Officer (CRO)

fact: Enterprise Risk Oversight Committee

fact: CRO has over nine years of senior risk management experience

fact: CRO had a 20-year career in the U.S. Army


reasoning: The paragraph's primary content is an explicit materiality assessment ('has not identified risks from cybersecurity threats... that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition'), which per Rule 6 is Strategy Integration. The generic program mention, evolving-threats language, and cross-reference to Risk Factors are subordinate. No named standards, firm-specific facts, or verifiable details appear.

thinking:
Let me analyze this paragraph.

The paragraph contains:
1. A materiality assessment ("has not identified risks... that have materially affected or are reasonably likely to materially affect")
2. Generic language about cybersecurity program and evolving threats
3. A cross-reference to Risk Factors

Per Rule 6, the materiality assessment makes this Strategy Integration. The cross-reference doesn't change that.

Specificity: No named standards, no firm-specific facts. Generic boilerplate materiality language.


reasoning: The paragraph describes the company's own internal processes for identifying, evaluating, and managing cybersecurity risks, with third-party engagement mentioned as one component—making it Risk Management Process. No named frameworks, roles, dates, tools, or firms are present; 'consultants,' 'periodic basis,' and 'technology assets' are all generic language that could appear in any filing.

thinking:
Let me classify this paragraph.

Content: Describes internal processes for cybersecurity risk management, mentions third-party consultants as a component.

Category: Risk Management Process - describes the company's own internal processes for identifying, evaluating, managing cyber risks. Third parties mentioned as one component, not central topic.

Specificity: No named frameworks, no named roles, no dates, no specific facts. "consultants" is generic. "periodic basis" is generic. Everything here is boilerplate.

→ Generic Boilerplate


reasoning: This is a borderline case between Strategy Integration and None/Other. The paragraph references materiality language but does not itself make a materiality conclusion — it says 'We describe whether and how' risks have materially affected the company, pointing the reader to Item 1A Risk Factors for the actual assessment. The paragraph itself is a cross-reference that tells you where to find the materiality discussion rather than providing the materiality conclusion directly. Per the codebook: 'does the paragraph make a substantive claim about cybersecurity's impact on the business? If yes → Strategy Integration. If it only points elsewhere → None/Other.' This points elsewhere.


reasoning: The paragraph describes the company's adoption of NIST CSF 2.0 to frame its risk identification, assessment, and management processes — squarely Risk Management Process. It names a recognized standard (NIST CSF 2.0) but contains no firm-specific facts (no named roles, dates, tools, or unique program details), so it is Sector-Adapted.

thinking:
Classify this paragraph.

Content: Describes adoption of NIST CSF 2.0 as guiding principle for risk management processes. This is about the company's internal risk management methodology/framework adoption.

Category: Risk Management Process - describes framework adoption and risk assessment methodology.

Specificity: Names NIST CSF 2.0 (a recognized standard). Any firm-specific facts? The paragraph clarifies it's for "guidance purposes" not compliance - no firm-specific facts beyond the framework name. → Sector-Adapted (2).

fact: NIST CSF 2.0


reasoning: The paragraph describes the company's internal incident response escalation and remediation processes, with the CTO mentioned as part of the escalation path rather than as the primary subject. The person-vs-function test confirms this is about the process, not the person. Firm-Specific due to the CTO role (cybersecurity-specific title on IS list) and the named departmental composition (IT, product development, legal), but no QV-eligible hard facts to reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes incident response escalation policy, mentions CTO, names departments involved (IT, product development, legal).

Category: This describes internal processes - escalation procedures, incident response, remediation. The CTO is mentioned as part of the escalation path, not as the primary subject. The paragraph is about what the process does, not about who the person is. → Risk Management Process

Specificity:
- CTO is a cybersecurity-specific title on the IS list → Firm-Specific
- "information technology department, the product development department and the legal department" - this is a specific team composition → Firm-Specific

- There are no quantifiable facts like dates, dollar amounts, headcounts, named firms, tools, or certifications present → Firm-Specific (3)

fact: chief technology officer

fact: information technology department, product development department, and legal department


reasoning: The paragraph describes the company's internal cyber risk management program, its ERM integration, and framework alignment — all hallmarks of Risk Management Process. It names NIST CSF as the guiding standard but contains no firm-specific facts beyond that (no named roles, tools, dates, or headcounts), placing it at Sector-Adapted.

fact: NIST Cybersecurity Framework (CSF)


reasoning: The paragraph describes the company's internal cybersecurity processes — risk management, ERM integration, technical controls, monitoring, incident response plan, and employee training. The Information Security Officer is mentioned as attribution for who oversees the process, but the substantive content is about what the program does (person-vs-function test: remove the ISO reference and the paragraph still describes processes). The ISO title is a cybersecurity-specific role on the IS list, granting Firm-Specific, but there are no second QV-eligible hard facts to reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity strategy, risk management process, ERM integration, and key program elements. The ISO (Information Security Officer) is mentioned as overseeing the process, but the paragraph is about the process itself, not the person.

Category: Risk Management Process - the paragraph describes internal processes, controls, monitoring, ERM integration, incident response plan, training. The ISO is mentioned as attribution only.

Specificity: Let me check for facts:
- "Information Security Officer ("ISO")" - this is a cybersecurity-specific title → IS list item → Firm-Specific
- No named frameworks (NIST, ISO 27001, etc.)

- No specific dates, dollar amounts, or headcounts
- "annual data protection and cybersecurity awareness training" is a generic cadence and common practice
- "incident response plan" is a generic program name

So I have one IS fact (Information Security Officer title) but no QV facts (need 2+) → Firm-Specific.

fact: Information Security Officer ("ISO")


reasoning: The paragraph opens by describing the CIO's qualifications (20 years of experience) and their instrumental role, then describes the IT team's responsibilities. While the IT team's process activities occupy more text, the paragraph is framed around who manages cybersecurity — the CIO and the team under them — making Management Role the primary communicative purpose. Specificity is Firm-Specific: CIO is a cybersecurity-specific title (IS list) and '20 years' is a specific number, but only one QV-eligible hard fact (the years of experience; CIO is a named role, not QV-eligible), so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the CIO's experience and the IT team's responsibilities for cybersecurity.

Category: The first sentence is about the CIO's experience (person) - Management Role signal. But then the rest describes what the IT team does (processes). Let me apply the person-vs-function test: if I remove the CIO reference, the paragraph still describes processes. But the first sentence is squarely about the person's qualifications. The paragraph is mixed - first sentence about the person (CIO, 20 years experience), rest about the function.

The dominant content: The first sentence is about the CIO's credentials. The second and third sentences describe the IT team's day-to-day activities (implementation, testing, monitoring).

So I'm seeing the CIO's qualifications mentioned upfront, but the bulk of the paragraph focuses on what the IT team actually does. Rule 2b suggests that naming a CIO and then describing the cybersecurity program's activities points toward Risk Management rather than Management Role. The person element is there, but it's really just context for the process-focused content that follows. The codebook test suggests this could be about Risk Management Process since the IT team activities remain substantive even without the CIO's credentials. But those credentials aren't just window dressing — they're actively framing the paragraph as being about who leads cybersecurity rather than how it's done. The opening emphasizes the person's qualifications, and the IT team description functions as supporting detail about the management structure. I'm settling on Management Role because the CIO's experience is genuinely central to the paragraph's purpose, not incidental to it.

Looking at the specificity markers: the CIO title hits the IS list, and "over 20 years" is a specific number that qualifies for QV. That's only one QV-eligible fact though, and I need two to classify this as QV. So this lands as Firm-Specific.

fact: CIO (Chief Information Officer)

fact: over 20 years of experience in technology and security


reasoning: This is an early-stage company that explicitly acknowledges it lacks 'significant investments in data security protection' and cannot assure sufficient resources to protect against cyber incidents. The board mention is purely hypothetical ('In the event of a cybersecurity incident...will report'), not a description of an active oversight program. The remainder is generic risk language about digital technologies and third-party reliance that could apply to any company. Per the SPAC/no-operations rule, the absence of a program is not a program description, and perfunctory board references do not constitute substantive governance disclosure.

thinking:
Let me analyze this paragraph from Aldel Financial II Inc. (ALDF), a 10-K filing, Item 1C.

This is an early-stage company (likely a SPAC or similar). Let me check the content:

- Generic language about digital technologies and cyber risks
- Mentions third-party risks generically
- "management team will report to the board of directors" - generic, hypothetical
- "As an early-stage company without significant investments in data security protection" - acknowledges lack of program
- Generic risk language about adverse consequences

This reads like a company with no real cybersecurity program. The SPAC/no-operations rule applies: "Companies that explicitly state they have no operations, no cybersecurity program, or no formal processes receive None/Other."

The company explicitly states it lacks meaningful data security investments and the board reporting structure is purely hypothetical, confirming there's no substantive cybersecurity program in place. This falls squarely into the None/Other category with generic boilerplate language.


reasoning: The paragraph describes management's cybersecurity leadership structure — who the people are (CIO, VP of Infrastructure Services), the committee they formed (ISC with unique abbreviation), and their qualifications (50+ years combined IT experience, 20+ years cybersecurity oversight). The person-vs-function test favors Management Role: the primary content is organizational structure and credentials, not process descriptions. Two QV-eligible hard facts (50+ years experience, 20+ years cybersecurity oversight) reach the Quantified-Verifiable threshold.

thinking:
Let me analyze this paragraph.

Content: Describes management forming an ISC committee, names specific roles (CIO, VP of Infrastructure Services), describes their responsibilities and experience.

Category: This is about management roles and their qualifications. The paragraph tells us about who these people are (experience), the committee they formed (ISC), and their oversight responsibilities. The person-vs-function test: the paragraph describes the ISC composition, the roles involved, their responsibilities, and their experience/qualifications. The experience statement ("combined 50+ years") is about the persons. The ISC formation and responsibility description is about organizational structure. This is Management Role - it's about who manages cybersecurity and their qualifications.

Now I'm identifying the specific facts that qualify for verification. The CIO title and the ISC committee name are both named roles and programs. The experience metrics—50+ years combined and 20+ years individually—are specific numbers that can be verified. That gives me two quantifiable facts to work with.

fact: Information Security Council ("ISC")

fact: CIO

fact: Vice President of Infrastructure Services

fact: combined 50+ years of experience in information technology

fact: 20+ years of increasing oversight of cybersecurity responsibilities


reasoning: The paragraph describes the Board's Risk Committee oversight of cybersecurity risk and details individual directors' qualifications and expertise — the board/committee is the primary subject throughout. Specificity is Quantified-Verifiable with multiple hard verifiable facts: named individuals (Stickels, Skerritt, MacPherson, Knauss, Singh), named external firms (Oneida Financial Corp, Deutsche Bank Trust Company Americas, PAR Technology Corporation), and a named certification (NACD Cyber-Risk Oversight Certification).

thinking:
Let me analyze this paragraph carefully.

Content: This paragraph describes board-level oversight of cybersecurity risk, specifically the Risk Committee and individual directors' qualifications and expertise related to cybersecurity.

Category: Board Governance - The Risk Committee of the Board is the primary subject, and the paragraph describes board members' cybersecurity expertise and oversight roles.

Specific facts:
- Risk Committee (named non-generic committee) → IS list
- Eric E. Stickels (named individual) → specific
- President of Oneida Financial Corp (named firm, prior role)
- Susan E. Skerritt (named individual)
- CEO and President of Deutsche Bank Trust Company Americas (named firm)

- Kerrie D. MacPherson (named individual) with Cyber-Risk Oversight Certification from NACD (named certification)
- Directors Knauss and Singh (named individuals) serving on IT Steering Committee (named committee)
- PAR Technology Corporation (named firm)

QV-eligible facts: Multiple named individuals with specific roles, named third-party firms including Oneida Financial Corp, Deutsche Bank Trust Company Americas, and PAR Technology Corporation, plus the named Cyber-Risk Oversight Certification from NACD. That's well more than 2 hard verifiable facts.

Specificity: Quantified-Verifiable — the paragraph contains multiple named individuals, named firms, and named certifications demonstrating clear board expertise in cybersecurity oversight.

fact: Risk Committee of the Board

fact: Eric E. Stickels, Chair of the Board, former President of Oneida Financial Corp

fact: Susan E. Skerritt, former CEO and President of Deutsche Bank Trust Company Americas

fact: Kerrie D. MacPherson

fact: Cyber-Risk Oversight Certification issued by NACD

fact: Directors Knauss and Singh serve on IT Steering Committee

fact: PAR Technology Corporation


reasoning: The Technology and Operations Committee (a board-level committee) is the opening grammatical subject receiving cybersecurity information, making this primarily about governance oversight. The CISO's reporting to the Management Committee is subordinate detail describing the information flow chain. Multiple firm-specific facts (named non-generic committees, CISO role, named department) but no QV-eligible hard facts (no dates, dollar amounts, headcounts, or named third-party firms).

thinking:
Let me analyze this paragraph.

The paragraph describes reporting flows: Information Security Department → CISO → Management Committee, and also Technology and Operations Committee receives information from the Information Security Department via CISO.

Primary subject: The Technology and Operations Committee and the CISO's reporting structure.

Category: This is about reporting lines and information flow. The Technology and Operations Committee is a named non-generic committee. The CISO is mentioned. The Management Committee is also mentioned.

Who is the grammatical subject? "The Technology and Operations Committee receives..." - this is a committee (could be board-level or management-level). Then "the CISO... provides periodic, regular and prompt reporting to the Management Committee."

I'm trying to determine whether this is about board governance or the CISO's management role. The Technology and Operations Committee could be a board-level committee, which would suggest board governance, but the focus on reporting lines and information flow from the CISO upward points toward management structure. The paragraph really has two distinct reporting relationships here—one to the Technology and Operations Committee and another to the Management Committee—so I need to figure out which one is the primary focus. and Operations Committee is the opening subject, so Board Governance seems like the right classification. The CISO serves as the reporting bridge between the Information Security Department and these governance bodies—both the board-level committee and the management committee. Given the Federal Home Loan Bank context, the Technology and Operations Committee is almost certainly a board committee, which reinforces the Board Governance categorization.

Since there are no quantifiable metrics like dates, amounts, or headcounts, this doesn't qualify as QV. But with the specific department name and cybersecurity-focused reporting structure, I have at least one IS fact, so this lands in Firm-Specific.

fact: Technology and Operations Committee

fact: CISO

fact: Management Committee

fact: Information Security Department


reasoning: The Receiver functions as the board-level oversight authority for this partnership and is the primary grammatical subject ('oversees the Partnership's cybersecurity risk exposures'), with the briefing chain (specialist → CEO → Receiver) describing oversight structure. 'Highline' is a named firm providing cybersecurity specialist services, which is a firm-specific fact; however only one QV-eligible fact exists, so it stays at Firm-Specific.

thinking:
Let me analyze this paragraph.

The paragraph describes oversight structure: a Receiver oversees cybersecurity risk, and Highline's cybersecurity specialist briefs the CEO, who reports to the Receiver.

This is about governance/oversight structure. The Receiver functions like a board-level overseer. The paragraph describes the reporting chain: cybersecurity specialist → CEO → Receiver.

The primary actor is the Receiver (board-like oversight role). The paragraph describes oversight of cybersecurity risk and briefing structure flowing up to the Receiver.

This feels like Board Governance - the Receiver is functioning in a board-like oversight capacity, and the paragraph describes the oversight chain.

Now I'm identifying the specific facts here. Highline appears to be a named third-party firm providing cybersecurity services, which would make it the only QV-eligible fact in this passage.

Since there's only one named firm and it doesn't meet the threshold for QV classification, this falls under Firm-Specific instead. The Receiver's oversight of cybersecurity risk functions as a board-level governance responsibility, supported by the briefing structure.

fact: Highline (named firm whose cybersecurity specialist provides briefings)


reasoning: The paragraph describes the company's framework adoption approach — using NIST SP 800-171, CMMC Level 1, and NIST CSF as guides for identifying, assessing, and managing cybersecurity risks. This is squarely about internal risk management methodology. Multiple recognized standards are named (NIST 800-171, CMMC, NIST CSF), triggering Sector-Adapted, but no firm-specific operational facts (no named roles, tools, teams, dates, or headcounts) elevate it beyond that. Specifying 'CMMC Level 1' indicates which maturity tier they target, but this remains framework-level detail rather than a unique organizational fact.

thinking:
Classify this paragraph.

Content: Describes framework adoption (NIST SP 800-171, CMMC Level 1, NIST CSF) as guides for their cybersecurity program. This is about internal risk management processes.

Category: Risk Management Process - describes framework adoption and how they use it to identify, assess, manage cyber risks.

Specificity: Names NIST SP 800-171, CMMC Level 1, NIST CSF. These are named frameworks → Sector-Adapted. But "CMMC levels 1" is somewhat firm-specific since it indicates which level they target. Actually, naming a specific CMMC level could be firm-specific - it tells you something about THIS company's maturity target.

The codebook treats naming recognized standards as Sector-Adapted, and CMMC Level 1 is just indicating which standard they follow rather than revealing something operationally unique to this company. The language about designing and assessing their program based on these frameworks is standard adoption terminology, not a firm-specific operational detail.


reasoning: The paragraph contains an explicit materiality assessment ('have not identified any cybersecurity incidents that have materially affected... our business strategy, results of operations, or financial condition'), which per Rule 6 is Strategy Integration regardless of boilerplate phrasing. No named frameworks, firm-specific facts, or verifiable details are present.

thinking:
Classify this paragraph.

The paragraph contains a materiality assessment ("have not identified any cybersecurity incidents that have materially affected... our business strategy, results of operations, or financial condition"). Per Rule 6, this is Strategy Integration.

Specificity: No named standards, no firm-specific facts, boilerplate materiality language. → Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity program, framework adoption, and defense-in-depth approach — squarely Risk Management Process. While NIST and HITRUST are named standards (Sector-Adapted), the company claims actual PCI-DSS Level 1 certification, which is a firm-specific verifiable fact beyond merely naming a standard. Only one QV-eligible hard fact (the certification), so Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity risk management program, frameworks used, certification held, and defense-in-depth approach.

Category: Risk Management Process - describes internal processes, framework adoption, certification.

Specific facts:
- NIST CSF - framework
- HITRUST CSF - framework
- PCI-DSS Level 1 Service Provider certification - this is a certification claim, which per the codebook is firm-specific ("We maintain ISO 27001 certification" = firm-specific)

Decision test:
1. QV - need 2+ hard verifiable facts. PCI-DSS Level 1 certification is a verifiable fact. NIST and HITRUST are named standards.

The certification claim alone doesn't meet the QV threshold of two hard facts. Since the PCI-DSS Level 1 Service Provider certification is a firm-specific claim, this falls into the firm-specific category.

fact: NIST Cybersecurity Framework

fact: HITRUST Common Security Framework

fact: Certified as PCI-DSS Level 1 Service Provider