reasoning: The paragraph's primary content is about management-level oversight structure: the IT Steering Committee's composition, responsibilities, and reporting line to the Audit Committee. Management (the committee) is the grammatical subject performing the oversight actions. While it briefly mentions activities (monitoring, employee engagement), these are generic and subordinate to the structural description. The IT Steering Committee is a named non-generic committee (IS fact), but the individual members (CEO, CFO, General Counsel) are generic C-suite titles on the NOT list, yielding one IS fact and thus Firm-Specific.

thinking:
Let me analyze this paragraph.

The paragraph describes the IT Steering Committee (CEO, CFO, General Counsel) overseeing cybersecurity efforts, and senior management reporting to the Audit Committee.

Category: This is about management's role in cybersecurity oversight. The IT Steering Committee is the grammatical subject performing the primary action. But wait - is this Management Role or Risk Management Process?

The paragraph describes WHO oversees (the committee composition) and their reporting line to the Audit Committee. It's about the management structure - who the people are and what they're responsible for. The person-vs-function test: the paragraph tells us about the committee composition and reporting structure, not about specific processes/tools/methodologies.

I'm seeing two distinct elements here: the IT Steering Committee's composition and their oversight responsibilities, plus the reporting relationship to the Audit Committee. The activities mentioned are fairly generic, so this really comes down to whether "IT Steering Committee" is a named committee or just a generic C-suite grouping. I need to verify if that's on the exclusion list before finalizing the category. The composition itself—CEO, CFO, General Counsel—are generic C-suite titles that fall on the NOT list, so they don't add firm-specificity. The IT Steering Committee name is what counts as a named non-generic committee. There are no dates, dollar amounts, headcounts, named firms, tools, or certifications, so this isn't QV. The category is Management Role since the paragraph focuses on oversight structure and reporting lines to the Audit Committee.

fact: IT Steering Committee


content_category: Third-Party Risk

category_confidence: high

specificity_confidence: high

reasoning: The paragraph's central topic is oversight of vendors and third-party service providers — assessing their security practices, providing feedback, and performing reassessments. This is vendor oversight as the primary subject, not a component of an internal process description. The specific departmental composition (information security, compliance, procurement) is a firm-specific fact, but there are no second hard verifiable facts to reach QV.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph.

Content: Describes vendor risk management program, cross-functional teams, assessing suppliers/third-party providers, security assessments, feedback to vendors, periodic reassessments.

Category: The central topic is oversight of external parties (vendors, suppliers, third-party service providers). This is Third-Party Risk.

Specificity: Let me check for specific facts.
- "information security, compliance and procurement teams" - this is a specific team/department composition → IS list item
- No named frameworks, no dates, no dollar amounts, no named firms, no named tools
- No cybersecurity-specific titles like CISO

- The specific team composition is the only firm-specific detail here, so this gets categorized as Firm-Specific.

fact: Cross-functional program supported by information security, compliance and procurement teams


content_category: Risk Management Process

category_confidence: medium

reasoning: The paragraph describes TPG's overall cybersecurity risk management architecture — committees (ERC, ORC), team responsibilities (threat detection, control design, vulnerability mitigation), and reporting flows — with CISO/CIO credentials as subordinate detail. Applying the person-vs-function test: removing the role holders' experience and replacing titles with 'the Company' leaves a coherent process description, so Risk Management Process dominates over Management Role. Specificity is Firm-Specific: multiple IS-list facts (named non-generic committees, cybersecurity-specific titles, 20+ years quantified), but only one QV-eligible hard fact (years of experience) since 'industry standard certifications' are unnamed, falling short of the two-fact QV threshold.

thinking:
Let me analyze this paragraph carefully.

This is about TPG RE Finance Trust (TRTX), an externally managed company that relies on TPG's cybersecurity infrastructure.

Content: The paragraph covers multiple topics:
- Reliance on TPG's systems and processes
- TPG's Enterprise Risk Committee (ERC) and Operational Risk Committee (ORC) - named committees
- TPG's CISO role, reporting lines, responsibilities
- TPG's CIO role
- The cybersecurity team's responsibilities
- Experience of CISO and CIO (20+ years each)
- Industry standard certifications

Category analysis:

The paragraph is really describing TPG's cybersecurity governance structure—the committees overseeing risk, the key leadership roles with their experience and credentials, and the operational processes they manage. While it mentions specific people and their qualifications, the focus is on how the organization is structured to handle cybersecurity threats and controls. The key distinction is whether the paragraph emphasizes the organizational structure itself or the qualifications of the people in those roles. The credentials are mentioned but feel secondary to the main point about how risk management is architected through committees and reporting lines. I'm settling on Risk Management Process as the primary category since the structural and procedural elements dominate, even though Management Role components are clearly present.

Now I'm checking which specific details qualify as firm-specific versus quantifiable facts. The named committees—ERC and ORC—are clearly firm-specific, as are the CISO and CIO titles in this context. The "more than 20 years of experience" is a specific quantifiable fact that would be eligible for verification, though the reference to "industry standard certifications" without naming them doesn't meet that threshold. Looking at the certifications - they're described generically as "industry standard" rather than named specifically, so that doesn't qualify. I'm left with just one quantified fact: the 20+ years of experience. That means this falls into Firm-Specific rather than QV, and I can list out the supporting details: the CISO and CIO titles, the ERC and ORC committees, and that quantified experience metric.

fact: Enterprise Risk Committee (ERC)

fact: Operational Risk Committee (ORC)

fact: Chief Information Security Officer (CISO)

fact: Chief Information Officer (CIO)

fact: CISO and CIO each have more than 20 years of experience

type: quantified


content_category: Management Role

reasoning: The paragraph opens with a brief generic board oversight statement but its primary communicative purpose is identifying the management personnel responsible for cybersecurity — the Director of IT and the Director of IT Security and Compliance — along with their qualifications, experience, and career backgrounds. This is clearly about the persons, not the function. Two QV-eligible hard facts (20 years of experience, 10+ years of experience) reach the Quantified-Verifiable threshold.

thinking:
Let me analyze this paragraph carefully.

Content category: This paragraph covers both board governance and management roles. Let me check the dominant topic.

- First sentence: Board oversight (generic)
- Second sentence: Management responsible (generic)
- "IT Steering Committee" - management committee
- "Director of IT" - primary oversight role
- Director of IT's 20 years experience, background
- "Director of IT Security and Compliance" - another role with 10 years experience

The bulk of the paragraph is about management personnel - their roles, qualifications, experience, and backgrounds. The board mention is brief and generic. The primary communicative purpose is describing WHO manages cybersecurity - the person-vs-function test clearly points to the person(s). The paragraph tells us about credentials, experience, career history.

Now I'm checking whether the specific roles mentioned count as facts. The IT Steering Committee is a named entity, so that's concrete. The Director of IT title is more general IT leadership rather than cybersecurity-specific, though this person does have primary oversight of cybersecurity risks. The Director of IT Security and Compliance is clearly cybersecurity-focused, so that's definitely a specific fact.

Looking at the experience metrics, both "20 years" and "more than 10 years" are quantified durations that can be verified, which makes them QV-eligible. That gives me at least two hard facts to work with, so this qualifies as Quantified-Verifiable.

fact: Director of IT has primary oversight of cybersecurity threats

fact: Director of IT Security and Compliance

fact: 20 years of experience

fact: more than 10 years of experience in IT and IT security


reasoning: The paragraph describes what the cybersecurity teams do — assessing risks, defining policy, managing risks, supervising personnel, conducting assessments and exercises. The CISO is mentioned as attribution ('overseen by our CISO,' 'The CISO approves'), but the substantive content is about the program's functions and activities. Applying the person-vs-function test: removing the CISO references, the paragraph still reads as a complete process description. No credentials, name, background, or qualifications are provided. CISO is the sole IS-list fact (cybersecurity-specific title), yielding Firm-Specific; no second QV-eligible hard fact (no dates, dollar amounts, headcounts, named firms, or named tools) to reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph from PayPal's 10-K Item 1C filing.

The paragraph describes what the cybersecurity teams do, overseen by the CISO. Let me apply the person-vs-function test.

The CISO is mentioned as overseeing the teams, but the paragraph is primarily about what the teams DO - assessing risks, defining policy, managing risks, supervising personnel and consultants, incident response, security assessments, etc. This is about the function/program, not about the person.

If I remove "overseen by our CISO" and "The CISO approves all security policies and oversees," the paragraph still makes complete sense as a process description.

This is clearly a Risk Management Process disclosure. The CISO title is firm-specific and belongs on the list, but the Information Security Program and cybersecurity teams are generic descriptions. The external consultants are unnamed, so they don't qualify either.

fact: CISO


reasoning: The entire paragraph is about the person — Gertrude Van Horn's name, title, joining date, career history, and expertise areas. This is a textbook Management Role paragraph with no process or function description. Multiple QV-eligible hard facts: specific date (January 2024), specific experience duration (40 years), and numerous named prior employers.

thinking:
This is clearly a Management Role paragraph - it's entirely about the person (Gertrude Van Horn), her background, credentials, and experience.

For specificity, let me count QV-eligible hard facts:
1. Named individual: Gertrude Van Horn
2. CIO title (cybersecurity-specific? CIO is on the IS list)
3. "January 2024" - specific date
4. "over 40 years of experience" - specific number
5. Named firms: NCH Corporation, IntegraColor, Haggar Clothing Company, JOANN Stores, Office Depot, Victoria's Secret, American Express, J.P.

Morgan - that's a substantial list of verifiable third-party organizations. Combined with the specific date and quantified experience, this easily meets the threshold for Quantified-Verifiable status.

fact: Gertrude Van Horn named as CIO

fact: Joined in January 2024

fact: Over 40 years of experience

fact: Prior employers: NCH Corporation, IntegraColor, Haggar Clothing Company, JOANN Stores, Office Depot, Victoria's Secret, American Express, J.P. Morgan


content_category: Strategy Integration

reasoning: The paragraph's concluding statement — that a cybersecurity incident 'could materially adversely affect our operations, performance, and results of operations' — is a materiality-adjacent assessment of business impact, placing it in Strategy Integration per Rule 6. The preceding content (importance of cybersecurity, generic threat types, client/supplier risk) is introductory risk language with no process, governance, or incident detail. No named frameworks, firm-specific facts, or verifiable details are present; 'healthcare industry' is sector context, not an IS-list fact.

thinking:
Let me analyze this paragraph.

Content: General statement about cybersecurity importance, lists common threat types, mentions clients/suppliers face similar threats, and has a materiality statement about potential impact.

Category: This is mostly generic risk language. The materiality statement says an incident "could materially adversely affect" - this is hypothetical/forward-looking, not an actual materiality assessment of whether risks HAVE affected the company. Per the codebook, "could materially adversely affect" is different from "have not materially affected... business strategy, results of operations, or financial condition." This is more generic risk language.

Actually, let me reconsider. The last sentence says "could materially adversely affect our operations, performance, and results of operations" - this is a forward-looking risk statement, not a materiality assessment conclusion.

The paragraph doesn't actually say the threats have materially affected anything, and it lacks any description of actual processes, governance structures, management roles, or incidents. It's just acknowledging that cybersecurity threats exist and could be harmful. Since it doesn't disclose anything substantive about the company's cybersecurity program or how they're managing these risks, this looks like it should be categorized as None/Other. The paragraph mentions potential material adverse effects on operations and financial results, which points toward Strategy Integration. But it's really just generic risk language—saying incidents "could" happen without any actual materiality assessment or firm-specific details. I'm leaning toward Strategy Integration since it does connect cybersecurity to business consequences, though the boilerplate nature makes it borderline.

Actually, stepping back—this is fundamentally just introductory risk acknowledgment. It doesn't fit the substantive categories well because it's not describing governance, management, processes, oversight, incidents, or making a real strategic assessment. The "could materially adversely affect" language is hypothetical, not an actual materiality determination like the examples in the codebook. I'll categorize this as None/Other. The language about material adverse effects clinches it—this paragraph explicitly meets the materiality threshold the codebook specifies for Strategy Integration. I'll categorize it there with Generic Boilerplate as the specificity level, since it relies on standard risk language without any named standards or firm-specific details beyond the healthcare sector context.


content_category: Board Governance

reasoning: The Audit Committee is the grammatical subject overseeing cybersecurity risks, making this Board Governance. No firm-specific facts are present: 'Audit Committee' is on the NOT list as standard governance, and the listed expertise areas (risk management, technology, finance) are generic descriptors that could apply to any public company's audit committee.

thinking:
Classify this paragraph.

Board/Audit Committee is the subject performing oversight of cybersecurity risks. This is Board Governance.

Specific facts: "Audit Committee" is generic (on the NOT list). The expertise areas "risk management, technology, and finance" - this describes the composition of the committee's expertise. Is this a specific team/department composition? It's describing board member expertise areas, not a specific team composition. These are fairly generic expertise areas.

No named frameworks, no cybersecurity-specific titles, no dates, no named firms/tools. "Audit Committee" is on the NOT list. The expertise areas listed are generic.

Specificity: Generic Boilerplate.


content_category: Incident Disclosure

reasoning: The bulk of the paragraph describes an actual cybersecurity incident: its timing (November 2023), the disruption it caused, the investigation and remediation actions taken, data scope assessment, and notification of affected individuals and regulators. While materiality assessments bookend the paragraph and cross-references close it, the dominant communicative purpose is the incident narrative. Only one QV-eligible hard fact (specific month+year) is present — 'external cybersecurity experts' and 'law enforcement' are generic — so specificity is Firm-Specific, not Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph contains multiple elements:
1. A materiality assessment ("have not materially affected")
2. A description of an actual incident (November 2023, cybersecurity incident, disruption, investigation, remediation)
3. Forward-looking materiality statement
4. Cross-references

The dominant content is the incident narrative - it describes what happened, when, response actions, and resolution. The materiality framing bookends it, but the bulk of the paragraph is incident description.

Wait, let me re-read the tiebreakers:
- "Paragraph DESCRIBES what happened in an incident (dates, access, encryption, scope, response actions) → Incident Disclosure"

- "Brief mention of a past incident + materiality conclusion as the main point → Strategy Integration"

This is not a brief mention - the incident description takes up the majority of the paragraph. The materiality statements are the opening and closing sentences, but the middle (which is the bulk) describes the incident timeline, response, and remediation.

Category: Incident Disclosure (dominant content is the incident narrative)

Now for specificity: I have "November 2023" as a specific date that's QV-eligible, but no named firms, tools, or financial metrics. The only hard verifiable fact is the date itself.

fact: November 2023 cybersecurity incident


reasoning: The paragraph describes Peloton's internal cybersecurity program — its objectives (confidentiality, integrity, availability), framework alignment (NIST), cross-functional approach, and ERM integration. This is squarely Risk Management Process. NIST is a named standard triggering Sector-Adapted, but no firm-specific facts appear: 'Members' data, APIs and web and mobile applications' describe what is protected in general terms, 'Peloton' is a company self-reference (NOT list), and the listed risk categories (business, IT, privacy, legal, geopolitical) are generic descriptors, not a specific departmental composition.

thinking:
Let me analyze this paragraph.

Content: Describes Peloton's cybersecurity risk management program - its purpose, framework alignment (NIST), approach, and ERM integration.

Category: Risk Management Process - describes internal cybersecurity processes, framework adoption, ERM integration.

Specificity: Names NIST framework → Sector-Adapted at minimum. Any firm-specific facts? Mentions "Members' data, APIs and web and mobile applications" - these are somewhat specific to Peloton but are really just describing what they protect. "NIST" is a named framework. No cybersecurity-specific roles, no specific dates, no named tools, no headcounts. The company name "Peloton" is a self-reference (NOT list). "cross-functional approach" is generic. ERM integration mentioning "business, cybersecurity, information technology, privacy, legal, and geopolitical risks" - this is a team/department composition... actually no, these are risk categories, not departments.

So: Sector-Adapted (NIST framework named, nothing firm-specific beyond that).

fact: NIST (National Institute of Standards and Technology)

type: framework


specificity_confidence: medium

reasoning: The paragraph briefly mentions a phishing incident and remediation actions but its primary communicative purpose is the materiality assessment ('did not identify any cybersecurity threats that have materially affected... our business strategy, results of operations, or financial condition'). Per the tiebreaker rule, a brief mention of a past incident plus a materiality conclusion as the main point yields Strategy Integration. The year '2024' is a specific date reference (one IS-list fact), making it Firm-Specific but not Quantified-Verifiable (only one hard verifiable fact).

thinking:
Let me analyze this paragraph.

Content: Describes a phishing incident in 2024, mentions remediation actions, then provides a materiality assessment.

Category: This paragraph has both incident disclosure (phishing scam, loss, remediation) and strategy integration (materiality assessment). The incident description is brief but present - "phishing scam that resulted in a loss" + remediation actions. Then the materiality disclaimer follows. Let me apply the tiebreaker rules.

"Brief mention of a past incident + materiality conclusion as the main point → Strategy Integration"

Actually, looking more carefully - the first sentence describes what happened (phishing scam, loss, new procedures, new checking accounts).

The second sentence is a materiality assessment. The third is generic risk language. The incident description is relatively brief and the materiality conclusion seems to be the main point of the paragraph. → Strategy Integration.

Specificity:
- "2024" - specific date (year only, borderline but it's a date reference)
- "phishing scam" - generic incident type
- "new checking accounts" - this is a firm-specific remediation detail
- No named firms, no dollar amounts, no named tools

Specific facts: "2024" as a date. That's one fact from the IS list. → Firm-Specific.

Now I'm questioning whether "2024" alone is specific enough to qualify, or if I need more concrete details like dollar amounts or named entities to make this truly firm-specific.

fact: 2024 (year of phishing incident)


reasoning: The paragraph contains an explicit materiality assessment ('have not experienced a cybersecurity incident that resulted in a material adverse impact to our business or operations'), making it Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. No firm-specific facts, named standards, or verifiable details are present — pure boilerplate materiality language.

thinking:
Let me analyze this paragraph.

Content: Two parts - (1) a materiality assessment ("have not experienced a cybersecurity incident that resulted in a material adverse impact") and (2) a cross-reference to Risk Factors.

Per Rule 6 and the codebook: "Any paragraph that explicitly assesses whether cybersecurity risks or incidents have 'materially affected' the company... is Strategy Integration — even when the assessment is boilerplate. A cross-reference to Risk Factors appended to a materiality assessment does not change the classification."

This matches Case 7 almost exactly.

Specificity: No named standards, no firm-specific facts. Generic boilerplate materiality language.


reasoning: The paragraph opens with two sentences on Audit Committee/Board oversight, but the dominant content describes what the management team does — risk methodology, supervising personnel/consultants, prevention/detection/mitigation activities. Applying the person-vs-function test, 'our management team' is generic (no named roles, no credentials, no individuals), and the substantive content describes processes and activities. Replacing 'management team' with 'the Company' leaves the paragraph intact as a process description. No IS-list facts are present: 'Audit Committee' and 'management' are on the NOT list, no named frameworks, tools, dates, or specifics.

thinking:
Let me analyze this paragraph.

The paragraph starts with Audit Committee reporting to the Board, then shifts to management team's responsibilities for cybersecurity risk management. The dominant content is about what the management team does - assessing, managing, developing methodology, supervising personnel, preventing/detecting/mitigating risks.

Category: The first two sentences are about Board Governance (Audit Committee reports to Board, Board receives briefings). But the remaining bulk of the paragraph is about the management team's responsibilities - but it's describing the function, not the person. The management team is described generically ("our management team") with no named roles, no credentials, no specific people.

Actually, looking at this more carefully - "management team" is generic. The paragraph describes what the management team does (processes: risk assessment, methodology development, supervision of personnel, prevention/detection/mitigation). This is really about processes and functions, not about specific people.

The bulk of the text focuses on management's cybersecurity processes rather than specific individuals - if I swap "our management team" for "the Company," the description still works as a functional overview. The board governance portion is minimal compared to the extensive detail on risk methodology, prevention, detection, and monitoring activities, which points toward Risk Management Process. There are no named frameworks or specific facts mentioned, just generic process descriptions.


reasoning: The paragraph's central topic is oversight of external parties (third-party providers, vendors with data access), making it Third-Party Risk. The description is entirely generic — no named standards, frameworks, specific evaluation criteria, or firm-specific facts.


reasoning: The paragraph describes an actual cybersecurity incident — unauthorized access to an employee email account leading to fraudulent fund diversion, detection, and impact assessment. While it includes a materiality conclusion ('immaterial impact'), the dominant content is the incident narrative (what happened, how it was detected, what the threat actor did). The year '2024' is one specific date fact, but no second hard verifiable fact (no dollar amounts, named firms, or tools) prevents reaching Quantified-Verifiable.

thinking:
Classify this paragraph.

Content: Describes an actual cybersecurity incident - unauthorized access to employee email, fraudulent fund diversion, detection timeline, and impact assessment.

Category: This describes what happened (incident narrative) AND includes a materiality/impact assessment. The dominant content is the incident description - what happened, how it was detected, what the threat actor did. The materiality conclusion ("immaterial impact") is subordinate. → Incident Disclosure

Specificity: Let me check for facts:
- "2024" - specific date (year only, but it's a date reference)
- "unauthorized access of an employee's email account" - specific system

- "fraudulently divert Company funds to its bank account" - specific action

Looking at the IS list, I'm finding that while the incident details are concrete, the quantifiable facts are sparse - no named firms, no dollar amounts, no headcounts, and "2024" is just a year without a full date. The paragraph lacks the specific metrics or named entities that would strengthen the verifiability.

The year "2024" does count as one hard fact, which pushes this toward Firm-Specific classification. The unique nature of the incident itself - the employee email and fund diversion scheme - is particular to this company, even without additional corroborating details.

fact: 2024 (year of incident)


reasoning: The paragraph contains an explicit materiality assessment ('not currently aware of any risks from cybersecurity threats that have materially affected us') combined with forward-looking risk language about potential material adverse effects on business strategy, results of operations, or financial condition. Per Rule 6, any paragraph that assesses whether cybersecurity risks have 'materially affected' the company is Strategy Integration, even when boilerplate. No specific facts, named entities, frameworks, or dates are present — this is nearly identical language found across thousands of filings.

thinking:
Let me analyze this paragraph.

This is a materiality assessment - "not currently aware of any risks from cybersecurity threats that have materially affected us" plus forward-looking risk language. Per Rule 6 and the codebook, any paragraph that explicitly assesses whether cybersecurity risks have "materially affected" the company is Strategy Integration.

Specificity: Pure boilerplate materiality language. No named entities, frameworks, dates, or specific facts.


reasoning: The paragraph describes the company's own internal process of developing information security policies, an incident response plan, and pursuing SOC 2 certification — all core risk management activities. The outside contractor serves the company's program development (Rule 3). The specific expected certification date ('second quarter of 2025') is a firm-specific fact beyond merely naming the SOC 2 standard, but there is only one QV-eligible hard fact (the date), so it stays at Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes engaging an outside contractor for security policy, developing incident response plan, pursuing SOC 2 certification with expected timeline.

Category: This is about the company's own internal processes - developing security policies, obtaining SOC 2 compliance. The outside contractor is mentioned as serving the company's own program development. This is Risk Management Process.

Specificity: Let me check facts:
- "SOC 2" - named standard → Sector-Adapted at minimum
- "second quarter of 2025" - specific date → Firm-Specific
- "outside contractor" - unnamed, doesn't count

So we have a named standard (SOC 2) and a specific date. The specific date is one hard verifiable fact.

I'm counting the quantifiable facts here - "second quarter of 2025" gives me one concrete data point, and there's nothing else that qualifies like named organizations, financial figures, or employee counts. That single hard fact puts this at Firm-Specific.

fact: SOC 2 compliance certification being pursued

fact: Expects to achieve SOC 2 certification in the second quarter of 2025


reasoning: The paragraph introduces a cybersecurity oversight process but its primary communicative purpose is identifying the governance structure — the Board, the Science and Technology Committee (a non-generic named committee), and the committee chair's NACD cybersecurity certification. The board/committee is the dominant subject. Two IS-list facts (named non-generic committee + certification claim) establish Firm-Specific; however, only one QV-eligible fact (NACD certification) is present, falling short of the two needed for Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Discusses process for managing cybersecurity risks, supported by management and Board. Names "Science and Technology Committee" and mentions NACD certified cybersecurity expert.

Category: The paragraph mentions both the process and board oversight. The primary focus seems to be on governance - it mentions the Board, the Science and Technology Committee, and the chair's cybersecurity expertise. The board/committee is a significant subject here. But the opening is about having "a process" supported by management and the board. The last two sentences focus on the Science and Technology Committee and its chair's expertise.

The dominant focus: The paragraph sets up that there's a process, then explains WHO oversees it - the Board and Science and Technology Committee.

The key detail here is that the committee chair holds an NACD certification in cybersecurity, which establishes board-level expertise in this area. Looking at the specificity, the Science and Technology Committee is a named committee specific to this firm, and the NACD certification is a named credential - that's one QV-eligible fact. This points to a Firm-Specific classification.

fact: Science and Technology Committee

fact: NACD certified cybersecurity expert (committee chair)


reasoning: The paragraph blends generic risk management language with two Strategy Integration elements: investment prioritization ('continue to prioritize investments in cybersecurity') and a materiality-like assessment ('no impact on operations or data integrity'). The concluding claim that all incidents to date had no operational or data impact functions as a materiality conclusion, making Strategy Integration the dominant category. No named frameworks, roles, dates, tools, or other specific facts are present — entirely boilerplate language.

thinking:
Let me analyze this paragraph.

Content: Generic description of monitoring and adapting to cybersecurity landscape, acknowledges risk of breaches, mentions prioritizing investments, and claims successful detection/mitigation with no impact.

Category: This mentions monitoring/assessment (RMP), investment prioritization (Strategy Integration), and a claim about no impact (Strategy Integration). The paragraph seems to blend risk management language with a materiality-like claim. The last part "all known cases to date, the company's systems and protocols have successfully detected and mitigated these attempts with no impact on operations or data integrity" is a materiality/impact assessment. But the dominant content seems to be about their ongoing efforts and risk acknowledgment.

Actually, I'm seeing the core issue now—the "no impact" claim about incidents is really the key materiality assertion here, and combined with the investment prioritization language, this leans toward Strategy Integration rather than pure risk management.

Looking at the specificity though, there are no named frameworks, roles, dates, amounts, or tools—it's all generic language. That's a clear signal of boilerplate content.


reasoning: The paragraph describes the company's cybersecurity processes — reliance on an outside consultant, third-party monitoring/alerting services, redundant systems, and security control evaluation. The third parties are components of the company's own risk management program, not vendors being overseen for their security posture, so this is Risk Management Process rather than Third-Party Risk. 'President' is a generic C-suite title (NOT list), the consultant is unnamed, and no frameworks, dates, tools, or firm-specific facts appear.

thinking:
Let me analyze this paragraph.

Content: The President oversees risk processes including cybersecurity. They rely on outside third-party security consultant and third-party services. Outside consultant evaluates security controls and provides strategy. The consultant has IT and program management experience.

Category: This is primarily about risk management processes - how the company manages cybersecurity through consultants and monitoring services. The President is mentioned but is a generic C-suite title (NOT list). The consultant's experience is described but not named. This is about the function/processes, not about a specific person's credentials.

Could be Third-Party Risk since they rely heavily on third parties, but the paragraph describes how the company's overall cybersecurity program works - the third parties are components of their internal program rather than vendors being overseen. The focus is on what processes exist (monitoring, alerting, training, cloud, redundant systems, security controls evaluation).

Actually, looking at this more carefully - the third parties form the backbone of their cybersecurity program rather than being a separate oversight concern. The paragraph is fundamentally describing the company's risk management approach, where third-party consultants and services are the mechanism through which they execute that program. Since there are no named consultants, specific frameworks, or concrete details beyond the generic structure, this falls into generic boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity processes (threat detection, incident response, risk mitigation), making it Risk Management Process. It names no specific framework, no named tools, no roles, no dates — entirely generic language that could apply to any company.


reasoning: The paragraph describes the company's own internal cybersecurity processes — monitoring, penetration testing, vulnerability testing, audits, risk assessments, employee training, and insurance — making Risk Management Process the dominant category. Third-party vendor due diligence is mentioned as one component of the broader internal program, not the central topic. 'Head of IT' is a generic IT title (NOT list), no named frameworks/standards/tools/firms/dates appear, and all practices listed (pen testing, vulnerability scanning, training) are common practices that do not qualify as specific facts.

thinking:
Let me analyze this paragraph.

Content: Describes internal cybersecurity processes - monitoring, testing, audits, risk assessments, employee training, tools, insurance. Mentions "head of IT" and "dedicated information technology team." Also mentions third-party vendor due diligence as one component.

Category: This is primarily about the company's own internal processes. Third-party risk is mentioned as one component. The "head of IT" is mentioned as attribution. → Risk Management Process

Specificity: Let me check facts:
- "head of IT" — this is on the NOT list (generic IT leadership, not cybersecurity-specific)
- "dedicated information technology team" — generic

- "penetration and vulnerability testing" — standard industry practices
- "cybersecurity risk insurance policy" — generic mention with no specifics
- No named frameworks, standards, tools, dates, or metrics

This is generic boilerplate without any concrete details that would distinguish it.


reasoning: This is a truncated/fragmented paragraph listing components of the company's cybersecurity program — employee data handling controls, cybersecurity insurance, and engaging reputable service providers. While it touches third-party risk and insurance (Strategy Integration), the dominant purpose is enumerating elements of the company's internal risk management approach. No named frameworks, roles, firms, dates, or specific facts are present — entirely generic language.

thinking:
Analyzing this paragraph from Calidi Biotherapeutics' 10-K Item 1C filing.

This appears to be a fragment/truncated paragraph listing components of their cybersecurity program: employee training, third-party access controls, cybersecurity insurance, and engaging reputable service providers.

Content: mentions employees treating data with care, controls, cybersecurity risk insurance, engaging reputable service providers. This spans risk management process, third-party risk, and strategy integration (insurance). The dominant theme seems to be a list of risk management activities/components.

The paragraph describes internal processes (employee controls, data handling) with third-party and insurance mentions as components.

Looking at the specificity here, there are no named frameworks, roles, dates, firms, or numbers—it's all generic language. This reads like standard boilerplate disclosure material.


reasoning: The paragraph claims the company's cybersecurity measures align with regulatory requirements and names financial regulators (MFSA, FCA) and subsidiaries (Alchemy Markets Ltd., Alchemy Prime Limited), but subsidiary names are on the NOT list and MFSA/FCA are financial regulators, not recognized cybersecurity standards. The text is partly garbled and describes no actual cybersecurity process, tool, or framework — only a generic assertion that regulatory compliance necessitates cybersecurity protocols. This is borderline None/Other per Case 9 (generic regulatory compliance language), but the paragraph's primary communicative purpose is tying cybersecurity to the company's regulatory obligations, making it a thin Risk Management Process claim. No IS-list facts survive filtering, so specificity is Generic Boilerplate.

thinking:
This paragraph appears to have some text corruption ("suspected a developer of regulatory-grade financial technology" seems garbled) but overall discusses regulatory compliance and subsidiaries' regulatory oversight.

Let me analyze:

Content: Discusses collecting personal data, regulatory compliance, names subsidiaries (Alchemy Markets Ltd., Alchemy Prime Limited), regulatory bodies (MFSA, FCA), and general cybersecurity compliance language.

Category: This is about regulatory compliance requiring cybersecurity protocols. It's not really describing the company's own risk management processes in detail - it's more about regulatory context. Per the codebook, generic regulatory compliance language that doesn't describe what the company does to comply tends toward None/Other. However, it does mention specific regulatory bodies (MFSA, FCA) and states compliance necessitates cybersecurity protocols. But it doesn't describe any actual process, program, or framework. It's saying "we're regulated, so we have to do cybersecurity."

Looking at Case 9 in the codebook, naming specific regulatory bodies like MFSA and FCA functions similarly to naming specific regulations—this would suggest Risk Management Process, Specificity 2. The paragraph identifies the regulators and mentions that cybersecurity measures align with relevant standards, but it cuts off before naming any specific cybersecurity frameworks or describing actual processes the company implements. The subsidiary names don't count as specificity markers since they're company self-references, and MFSA and FCA are financial regulators rather than cybersecurity frameworks like NIST or ISO 27001. So there's no named cybersecurity standard here that would elevate the specificity level.

Looking at the actual content, this reads like generic regulatory compliance language—it acknowledges that regulations exist and require cybersecurity measures, but doesn't describe any actual process, program, or framework the company uses. That matches Case 9's pattern of boilerplate truisms that apply to every public company, so this falls into None/Other rather than Risk Management Process. The regulatory bodies themselves—MFSA and FCA—could be considered company-specific facts since not every organization is regulated by them, but they're financial regulators rather than cybersecurity standards, which makes them less relevant to the IS list criteria. Subsidiary names are explicitly excluded anyway, so this still lands as generic boilerplate without substantive cybersecurity-specific details. I'm reconsidering whether the garbled text and vague regulatory language might push this toward None/Other instead, since it lacks concrete cybersecurity process details. But the paragraph does make at least a minimal claim about aligning cybersecurity measures with regulations, so Risk Management Process with Generic Boilerplate seems more accurate than dismissing it entirely.


reasoning: The paragraph contains both generic ERM integration language and a materiality assessment ('have not encountered cybersecurity challenges that have materially impaired our operations or financial standing'). Per Rule 6, an explicit materiality conclusion makes this Strategy Integration despite the RMP-flavored opening. No named frameworks, roles, dates, or firm-specific facts appear — all language is boilerplate.

thinking:
Let me analyze this paragraph carefully.

The paragraph has two main parts:
1. Integration of cybersecurity risk management into broader risk management framework
2. A materiality statement: "have not encountered cybersecurity challenges that have materially impaired our operations or financial standing"

This looks like it has some extraction artifacts ("Material Risks & Integrated Overall Risk Management" seems like a header merged with text, "from Cybersecurity Threats" seems like another header fragment).

Category: The paragraph has both Risk Management Process elements (integrated into broader risk management framework) and Strategy Integration (materiality statement). The materiality assessment at the end is a key element. Per Rule 6, materiality disclaimers → Strategy Integration. But the dominant content seems split. The first part describes integration into ERM, the second part is a materiality conclusion.

The materiality statement is the concluding point and the key takeaway here, so despite the text being roughly split between ERM integration and the materiality assessment, the materiality conclusion appears to be driving the categorization. This should be Strategy Integration.

Looking at specificity, there's no mention of named frameworks, specific incidents from the IS list, or particular standards—just generic language about the management team and risk processes. That puts it at Generic Boilerplate.


reasoning: The grammatical subject is 'Our Executive Team,' which plays the primary role in monitoring cybersecurity risks and briefing the Audit Committee. Per Rule 2, management reporting TO the board signals Management Role. The paragraph describes management's oversight responsibilities rather than the person's credentials, but the dominant purpose is defining the Executive Team's role in the governance structure. No specific facts remain after filtering: 'Executive Team' and 'Audit Committee' are generic governance terms, 'outside consultants' are unnamed, and 'periodic basis' is a generic cadence.

thinking:
Let me analyze this paragraph.

Content: The paragraph describes the Executive Team's role in informing the Audit Committee on cybersecurity risks, monitoring activity, reviewing outside consultants' work, and providing briefings on various topics.

Category: The grammatical subject is "Our Executive Team" - management. They inform the Audit Committee and provide briefings. This is about management's role in the cybersecurity oversight structure. But it's describing what management does (function) rather than who the people are (person).

Actually, looking more carefully - this is about management's role in reporting to the board. The Executive Team monitors and briefs the Audit Committee. The primary actor is management ("Executive Team plays a primary role"), and the content describes their function of briefing the board.

The Executive Team is the grammatical subject performing the actions - they're monitoring and briefing the Audit Committee on cybersecurity matters. This is clearly about management's role in the oversight structure, not about individual credentials or expertise.

But looking at the specificity here, everything is generic: unnamed executives, a generic Audit Committee, vague "outside consultants," and no concrete frameworks or dates. This is textbook boilerplate language.


reasoning: The paragraph describes internal cybersecurity processes — a training program and an incident response plan with reporting procedures — which are the company's own risk management activities. No named frameworks, cybersecurity-specific roles, dates, tools, or other firm-specific facts are present; 'annual' is a generic cadence and both the training program and incident response plan are generic program names.

thinking:
Classify this paragraph.

Content: describes internal security practices - training program, incident response plan, reporting procedures. This is about the company's own internal processes.

Category: Risk Management Process

Specificity: Let me check for specific facts.
- "annual information security training" — generic cadence + common practice
- "cyber incident response plan" — generic program name
- No named frameworks, no named roles, no specific dates, no named tools, no firm-specific facts

All items are on the NOT list (common practices, generic program names, generic cadences).

Specificity: Generic Boilerplate


reasoning: The paragraph's central topic is oversight of third-party service providers — identifying risks associated with them, engaging them for testing/audits, and imposing contractual security requirements. No named frameworks, firms, tools, dates, roles, or quantified details appear; practices like penetration testing, audits, and contractual addendums are generic and appear on the NOT list.

thinking:
Let me analyze this paragraph.

Content: Discusses oversight of third-party service providers, mentions penetration testing, audits, consulting, and contractual security addendums. The central topic is oversight of external parties.

Category: Third-Party Risk — the paragraph is centrally about oversight of third-party service providers.

Specificity: No named frameworks, no named roles, no specific dates, no named firms/tools, no numbers. "Penetration testing", "independent audits", "consulting" are common practices. "Security and privacy addendums" is generic. → Generic Boilerplate (1).


reasoning: The paragraph describes future planned risk assessment activities ("will include"), which falls under Risk Management Process. However, the language is entirely generic — no frameworks, no named roles, no firm-specific details. The forward-looking nature ("future cybersecurity program") and lack of any current program suggest this could border on None/Other (similar to a SPAC/no-operations company), but it does describe intended cybersecurity processes rather than being a pure disclaimer or header.


content_category: None/Other

reasoning: This paragraph is general risk language acknowledging that the company faces cybersecurity risks that could affect its business. It lists generic threat categories (IP theft, fraud, extortion) but describes no cybersecurity program, governance structure, incident, or strategic response. It reads as introductory/contextual language rather than substantive disclosure under any Item 106 category.


reasoning: The paragraph describes the company's internal cybersecurity processes — layered controls, endpoint protection, intrusion detection, network segmentation, MFA, patch management, employee training, vendor diligence, and third-party audits. These are all common practices on the NOT list. It references 'industry standards' but names no specific framework (NIST, ISO, etc.), no named tools, no named firms, no dates, and no firm-specific facts, making it Generic Boilerplate.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity risk management approach - layered cybersecurity, technical controls, employee training, vendor diligence, third-party audits, infrastructure details. This is about internal processes.

Category: Risk Management Process - describes the company's own internal cybersecurity processes, tools, and methodologies.

Specificity: Let me check for specific facts:
- "aligned with industry standards" - no named standard
- Lists general practices: endpoint protection, intrusion detection, access control, network segmentation, employee training, vendor diligence, third-party audits, MFA, patch management

- All of these are standard industry practices with no named frameworks, roles, dates, tools, or firms mentioned

This is generic boilerplate language - everything here appears on the common list of vague security claims.


reasoning: The paragraph opens with an explicit materiality assessment ('have not materially affected or are reasonably likely to materially affect us, including our operations, business strategy, operating results, or financial condition'), which per Rule 6 makes it Strategy Integration regardless of the appended cross-reference to Risk Factors. No firm-specific facts are present — all language is boilerplate materiality disclaimer.

thinking: Materiality assessment paragraph with cross-reference.


reasoning: The paragraph describes the company's internal cybersecurity risk management approach—identifying, preventing, and mitigating threats using monitoring tools and a cross-functional process. While it references materiality, it describes the *process* of determining materiality rather than making a materiality *conclusion*, so it is Risk Management Process rather than Strategy Integration. No named frameworks, tools, roles, dates, or specific facts are present—'cross-functional approach' and 'various tools' are entirely generic.

thinking:
Let me analyze this paragraph.

Content: Describes internal cybersecurity risk management approach - cross-functional, tools to monitor/address threats, materiality determination process.

Category: Risk Management Process - describes internal processes (identify, prevent, mitigate threats; monitoring tools; materiality determination). The materiality language here is about the *process* of determining materiality, not a materiality *conclusion*. No actual materiality assessment is made.

Specificity: No named frameworks, no named roles, no named tools, no specific dates, no numbers. "Cross-functional approach" is generic (not naming specific departments). "Various tools" is unnamed. This is Generic Boilerplate.


reasoning: The entire paragraph describes the CISO as a person — years of experience, career trajectory through named employers (Microsoft, Netflix, Bridgewater Associates, Robinhood), education, and certification. This is squarely about who the person is, not what the program does. Multiple QV-eligible hard facts: specific years of experience plus four named third-party firms.

thinking:
Let me analyze this paragraph.

Content: About the CISO - experience, career history, prior employers, education, certification. This is clearly about the person.

Category: Management Role - the entire paragraph describes the CISO's background, experience, career history, and qualifications.

Specific facts:
- CISO (cybersecurity-specific title) → named_role
- "more than 20 years" → quantified (years of experience)
- Named prior employers: Microsoft, Netflix, Bridgewater Associates, Robinhood → named_firm (×4)
- "bachelor degree in management information systems" → not QV (generic degree without named university)

- "industry certification" → not specific (unnamed)

So I'm counting five hard verifiable facts: the 20 years of experience plus the four named companies, which puts this squarely in the Quantified-Verifiable category.

fact: Chief Information Security Officer

fact: more than 20 years of information security expertise

fact: Microsoft

fact: Netflix

fact: Bridgewater Associates

fact: Robinhood


reasoning: The paragraph frames the governance structure with the Board Audit and Risk Management Committee at the center: the board delegates oversight to this committee, and senior leadership (CTO, CRO, virtual ISO) present to it. While the final sentence describes the virtual ISO's qualifications (Management Role content), the dominant communicative purpose is the board-level oversight architecture. Per Rule 2, 'Board delegates responsibility to management' → Board Governance. Specificity is Firm-Specific: multiple IS-list facts (named non-generic committee, cybersecurity-specific titles CTO and virtual ISO, 30 years of experience), but only one QV-eligible hard fact (30 years), falling short of the two needed for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

This is a dense paragraph covering multiple categories. Let me break it down:

1. "Cybersecurity risks are constantly evolving..." - generic intro
2. "We use people, process, and technology controls..." - generic RMP
3. "The Company's Board of Directors delegates oversight... to the Board Audit and Risk Management Committee" - Board Governance
4. "Senior Leadership, including the CTO and CRO, managed third-party service providers..." - Management/Third-Party
5. "The CTO, CRO, and the Bank's third-party virtual ISO regularly present to the Board Audit and Risk Management Committee..." - Board Governance (reporting to board)

6. The virtual ISO brings substantial experience to the role with over 30 years in the field - Management Role

The paragraph structure weaves together board governance and management qualifications. The Board Audit and Risk Management Committee is the named oversight body, and management—particularly the virtual ISO with their extensive background—reports to it. The dominant category seems to be Board Governance since the committee is the central authority, but the virtual ISO's credentials are highlighted to establish credibility in that reporting relationship. Looking at the specifics here, the Board Audit and Risk Management Committee is explicitly named, which signals an IS fact. The CTO and virtual ISO are cybersecurity-specific roles that appear in the IS list, while the CRO isn't a standard security title. The virtual ISO's 30+ years of experience and multiple security certifications are concrete qualifications that support the governance structure being described. This all reinforces that the paragraph's core focus is the oversight framework with the board committee receiving reports from qualified management personnel.

fact: CTO

fact: CRO

fact: third-party virtual ISO

fact: over 30 years of experience (virtual ISO)


reasoning: The paragraph contains an explicit materiality assessment ('have to date not materially affected us, our business strategy, results of operations or financial condition'), which per Rule 6 makes it Strategy Integration regardless of the boilerplate nature. The mention of third-party vendors and past threats is incidental. No named standards, roles, dates, or firm-specific facts are present — purely generic materiality disclaimer language.

thinking:
Classify this paragraph.

The paragraph makes a materiality assessment ("have to date not materially affected us, our business strategy, results of operations or financial condition") — this is Strategy Integration per Rule 6.

Specificity: No named standards, no firm-specific facts. Boilerplate materiality language. → Generic Boilerplate.


reasoning: The paragraph's primary content concerns third-party relationships: a managed security services provider performing 24/7 monitoring and security requirements imposed on third-party service providers with access to sensitive data. The insurance sentence is a brief addendum. However, confidence is moderate because the managed security provider serves the company's own monitoring (Risk Management Process signal), making this a borderline RMP/Third-Party case. No named firms, tools, frameworks, roles, or other specific facts appear — all entities are generic ('managed security services provider,' 'third-party service providers,' 'insurance coverage').

thinking:
Let me analyze this paragraph carefully.

This paragraph covers multiple topics:
1. Third-party monitoring - managed security services provider for 24/7 monitoring
2. Requirements on third-party service providers regarding cybersecurity
3. Insurance coverage

The dominant topic: Two of the three sentences are about third-party relationships (managed security services provider + requirements on third-party service providers). The insurance sentence is brief.

Actually, let me reconsider. The first sentence is about a managed security services provider monitoring the company's network - this serves the company's internal security (Risk Management Process per Rule 3: "External assessor hired to test the company → Risk Management Process (they serve the company)").

The second sentence imposes requirements ON vendors → Third-Party Risk. The third is about insurance → Strategy Integration.

This is a mixed paragraph. The first two sentences deal with third-party service providers in different ways. The second sentence is clearly Third-Party Risk (requirements imposed ON vendors). The first sentence is about using a third party to monitor the company's own network - this is more Risk Management Process.

Given the mix, I need to pick the dominant category. Two sentences involve third parties (managed security provider + requirements on third-party providers), one is about insurance. The central thread seems to be about third-party relationships. But the first sentence is really about the company's own monitoring capability delivered through a third party. So I'm torn between categorizing this as Third-Party Risk or Risk Management Process. The first sentence leans toward Risk Management Process since it's about the company's own security posture, while the second clearly falls under Third-Party Risk since it's about imposing requirements on external vendors.

Looking at the paragraph header "Third-Party Monitoring" and the fact that two of the three substantive points explicitly involve third parties, Third-Party Risk seems like the stronger fit, especially since vendor oversight is central to most of the content. But then again, the managed security provider is fundamentally serving the company's internal monitoring needs, which is more about how the company manages its own risk program.

I think Risk Management Process is actually the better categorization here. The managed security services are a tool the company uses to execute its monitoring function. Looking at the structure more carefully, the section header "Third-Party Monitoring" and the fact that two out of three content areas focus on third-party relationships—the managed security services provider and requirements imposed on vendors—makes Third-Party Risk Management the stronger classification. The specificity check confirms this is generic boilerplate: unnamed providers, common practices like 24/7 monitoring, and no references to specific frameworks or firms.


reasoning: The paragraph contains an explicit materiality assessment ('we have not encountered a cybersecurity threat or incident that resulted in a material impact on our business, operations or financial condition'), which per Rule 6 makes this Strategy Integration regardless of the surrounding generic risk language. No named frameworks, roles, dates, or other specific facts are present.

thinking:
Let me analyze this paragraph.

Content: Generic risk language about cybersecurity threats, includes a materiality assessment ("we have not encountered a cybersecurity threat or incident that resulted in a material impact on our business, operations or financial condition"), and a generic commitment statement.

The materiality assessment triggers Strategy Integration per Rule 6.

Specificity: No named frameworks, no specific facts from the IS list. The materiality disclaimer is boilerplate. → Generic Boilerplate.


reasoning: The paragraph describes the company's own internal controls framework adoption (SOC2), the trust services criteria covered, and engagement of auditors to verify those controls — all core risk management process activities. Specificity is Firm-Specific because the company claims actual adoption/implementation of SOC2 for a specific service organization (a certification claim, which goes beyond merely naming the standard), but there are no two hard verifiable facts (no dates, dollar amounts, named auditor firms, headcounts) to reach Quantified-Verifiable.

thinking:
Classify this paragraph.

Content: Describes SOC2 adoption, trust services criteria, and independent auditors measuring controls. This is about the company's own internal processes/controls and framework adoption.

Category: Risk Management Process - describes framework adoption (SOC2), implemented controls, and external auditing of those controls.

The mention of independent service auditors is about auditing the company's own controls, not about vendor oversight. So this is RMP.

Specificity:
- Names SOC2 framework → Sector-Adapted
- "Crexendo Hosted product" - company self-reference, NOT list
- Trust services criteria listed (security, availability, processing integrity, confidentiality, privacy) - these are standard SOC2 criteria, not firm-specific

- "Independent service auditors" - unnamed, NOT list
- "Adopted SOC2" is a certification claim about the company itself, which makes it firm-specific rather than just naming the standard, similar to how "We maintain ISO 27001 certification" would be classified.

So: Firm-Specific (3). One fact: SOC2 certification for their service organization.

Now checking if this meets the QV threshold—there are no specific dates, financial figures, headcount numbers, or named external auditors mentioned. Just the single SOC2 certification claim, which doesn't give us the 2+ hard verifiable facts needed. This doesn't qualify as QV.

fact: Adopted SOC2 certification for the Crexendo Hosted product service organization


reasoning: This paragraph is generic risk acknowledgment language describing the threat landscape (bad actors, human errors, third-party vulnerabilities) without any substantive cybersecurity disclosure — no processes, governance structures, incidents, or materiality assessments are described. It could apply to virtually any public company.

thinking:
Classify this paragraph.

This is a generic statement about cybersecurity threats. No specific facts, no frameworks, no named roles. It's general risk language.

Category: This doesn't describe any process, governance, management, incident, or strategy. It's general risk acknowledgment language. None/Other.

Wait - let me reconsider. It mentions "third-party vulnerabilities" but only as part of a list of threat sources. It's not about vendor oversight. It's just generic threat landscape language. None/Other seems right.

Specificity: Generic Boilerplate.


reasoning: The paragraph contains an explicit materiality assessment ('have not been subject to any cyberattacks that, individually or in the aggregate, have been material to Crexendo's operations or financial condition'), which triggers Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. No facts from the IS list are present — the company's own name is on the NOT list, and all other language is boilerplate.

thinking:
Materiality assessment + cross-reference. The paragraph explicitly states cybersecurity threats "have not been material to Crexendo's operations or financial condition" — that's a materiality assessment → Strategy Integration per Rule 6.

Specificity: No named frameworks, no firm-specific facts from the IS list. The company name is on the NOT list. "Comprehensive cybersecurity and compliance program" is generic. This is boilerplate materiality language.

→ Strategy Integration, Generic Boilerplate


reasoning: The Bank Board is the grammatical subject throughout — overseeing programs, receiving reports, reviewing and approving policies. The CIO and ISO are mentioned in a subordinate reporting-to-board context. Two cybersecurity-specific roles (CIO, ISO) place this at Firm-Specific, but neither is QV-eligible so it stays at Level 3.

thinking:
Let me analyze this paragraph.

The paragraph describes the Bank Board's oversight of cybersecurity. The Board is the grammatical subject performing the primary actions (overseeing, reviewing, approving). The CIO and ISO are mentioned but in the context of reporting TO the board.

Category: Board Governance

Specific facts:
- CIO (cybersecurity-specific? CIO is on the IS list)
- Information Security Officer (on the IS list)
- "at least annually" - generic cadence
- "Bank Board" - this is just a board variant

CIO and Information Security Officer are both on the ✓ IS list as cybersecurity-specific titles. That gives firm-specific facts.

This doesn't qualify for QV since there are no named roles, dates, dollar amounts, headcounts, or specific firms and tools mentioned. The specificity level is firm-specific because the CIO and Information Security Officer titles are cybersecurity-focused roles.

fact: Chief Information Officer

fact: Information Security Officer


reasoning: The grammatical subject is the 'cybersecurity coordinator,' and the paragraph describes this role's responsibilities and reporting line (reports to CEO). While it touches on risk assessment activities, the primary communicative purpose is identifying who holds the cybersecurity leadership function and how they connect to senior management — fitting Management Role. 'Cybersecurity coordinator' is a cybersecurity-specific title (IS list), yielding Firm-Specific; CEO is generic C-suite (NOT list) and does not add a second fact.

thinking:
Classify this paragraph.

The paragraph describes a "cybersecurity coordinator" who assesses/manages risks, collaborates with IT team, reports to CEO. Let me apply the person-vs-function test.

The paragraph mentions the role "cybersecurity coordinator" and their reporting line (to CEO), and collaboration with IT team. It describes what the role does (assessing and managing risks) and the reporting structure.

Is this about the person or the function? There are no credentials, no name, no background. The paragraph describes the role's responsibilities and reporting line. The reporting line (reports to CEO) is about organizational structure. But the substantive content is about assessing and managing risks - that's process-like. However, the grammatical subject is the cybersecurity coordinator throughout.

The cybersecurity coordinator is the grammatical subject with reporting lines to the CEO and defined responsibilities, which matches the Management Role criteria, though I need to verify if this specific role appears on the IS list.

Looking at the approved titles, "cybersecurity coordinator" isn't explicitly listed, but it's clearly a cybersecurity-specific role that fits the pattern of similar titles like Cybersecurity Director. The reporting line goes to the CEO, which is generic C-suite, and the IT team reference is also generic. So I have one IS fact here—the cybersecurity coordinator role itself—making this Firm-Specific.

This is Management Role with Firm-Specific specificity.

fact: cybersecurity coordinator


reasoning: The paragraph contains an explicit materiality assessment ('not aware of any material cybersecurity incidents... that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition'), which per Rule 6 makes this Strategy Integration despite the cross-reference to Risk Factors. No specific facts are present — the language is standard boilerplate materiality disclaimer.

thinking:
Let me analyze this paragraph.

It has two parts:
1. A cross-reference to Risk Factors
2. A materiality assessment ("We are not aware of any material cybersecurity incidents... that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition")

Per Rule 6 and the codebook: a materiality assessment makes this Strategy Integration, even with the cross-reference. The cross-reference doesn't change the classification.

Specificity: Boilerplate materiality language, no specific facts.


reasoning: This is generic regulatory compliance language that acknowledges regulations exist and non-compliance would be bad — a truism for every public company. It describes no specific process, program, framework, or materiality assessment. Per Case 9 in the codebook, this is None/Other.

thinking: Exact match to Case 9 in the codebook.


reasoning: The paragraph describes an actual past cybersecurity incident — a ransomware attack that encrypted machines on the corporate network — including detection, containment, operational impact assessment, and remediation via backup restoration. This is a narrative of what happened, making it Incident Disclosure. Despite describing a real event, there are no specific dates (only 'in the last decade'), no named tools/firms, no dollar amounts, and no other IS-list facts, so it remains Generic Boilerplate.

thinking:
Let me analyze this paragraph.

Content: Describes a past ransomware incident - what happened, response, impact. This is clearly an incident narrative describing what occurred, how they responded, and the outcome.

Category: Incident Disclosure - describes an actual cybersecurity event (ransomware), detection, containment, impact, and remediation.

But wait - there's also impact assessment language ("did not affect business operations", "did not have a significant financial impact"). Let me check the tiebreaker: "Paragraph DESCRIBES what happened in an incident (dates, access, encryption, scope, response actions) → Incident Disclosure". The paragraph describes the ransomware, encryption of machines, isolation, backup restoration. The impact statements are subordinate to the incident narrative. → Incident Disclosure.

Now I'm checking the specificity - there are no concrete details here. No dates beyond a vague timeframe, no company names, no specific tools or standards mentioned, no financial figures or employee counts. The language is all generic: "ransomware virus," "corporate network." This reads like boilerplate language rather than a detailed incident account. → Generic Boilerplate.


reasoning: The paragraph describes the escalation/reporting chain to the Audit Committee and full Board of Directors in the event of a cybersecurity incident, making board-level oversight the primary communicative purpose. The CFO is merely the conduit for reporting upward. All entities mentioned (CFO, Audit Committee, Board, legal counsel) are on the IS-NOT list — CFO is generic C-suite, Audit Committee is standard governance — leaving no firm-specific facts.

thinking:
Let me analyze this paragraph.

Content: Describes what would happen in a cybersecurity event - CFO reports to Audit Committee and Board. This is about incident response reporting structure/governance.

Category: The paragraph describes a hypothetical incident response reporting chain. The grammatical subjects are "our incident response approach" and "our Chief Financial Officer." This is about governance/reporting structure in the event of an incident. The CFO reporting to the Audit Committee and Board - this is about the escalation path, which is a governance structure.

The primary actor performing the action is the CFO (management), reporting TO the board. But the paragraph is really about the incident response reporting chain.

I'm trying to pin down whether this is about management roles or board governance. The CFO is the one taking action—reporting up the chain—but the real focus is on how incidents escalate to the Audit Committee and Board. The tiebreaker suggests looking at whether board oversight is the main point or if management roles are, and here it feels like the board's oversight role is what's being emphasized. Looking at the IS list to confirm this categorization - yes, Board Governance is on there, so this classification holds up.


reasoning: The paragraph references actual past cyber incidents previously disclosed in specific quarterly reports, making it primarily about incident history. The mention of additional safeguards is subordinate to the incident reference. The specific quarter-end dates (June 30, 2023 and September 30, 2023) constitute one cluster of specific dates, giving one firm-specific fact but not two QV-eligible hard facts.

fact: Quarterly Report for quarters ended June 30, 2023 and September 30, 2023


reasoning: The paragraph describes an actual cybersecurity incident — a stolen company laptop — including the nature of the threat, response actions taken (locking device, credential changes, remote wipe, law enforcement notification), and impact assessment. While it includes a materiality-like statement ('did not affect business operations'), the dominant content is the incident narrative itself. No specific dates, named firms, named tools, named cybersecurity-specific roles, or quantified facts appear; 'cybersecurity experts,' 'law enforcement,' and 'last decade' are all generic/vague.

thinking:
Let me analyze this paragraph.

Content: Describes a specific cybersecurity incident - stolen laptop, response actions, impact assessment.

Category: This is primarily an Incident Disclosure - it describes what happened (stolen computer), when (last decade), scope (sensitive info on device), response actions (locked device, changed passwords, remote wipe, notified law enforcement), and impact (no business/financial impact). There's a materiality-like statement ("did not affect business operations and did not have a financial impact") but the dominant content is the incident narrative itself.

Specificity: Let me check for facts:
- No specific dates (just "last decade" - vague)

- No named firms
- No named tools/products
- No named roles (just "cybersecurity experts" - generic)
- No dollar amounts, headcounts, percentages
- No named frameworks

The paragraph describes specific response actions but uses generic language throughout. "Cybersecurity experts" is unnamed. "Law enforcement" is unnamed. No dates. No named tools. This is Generic Boilerplate - no items from the IS list.


reasoning: The paragraph contains an explicit materiality assessment ('not aware of any cybersecurity incidents that have materially affected... business strategy, results of operations, or financial condition'), which per Rule 6 makes it Strategy Integration regardless of the appended cross-reference to Risk Factors. No specific facts from the IS list are present — the company self-reference, filing form type, and page number are all on the NOT list.

thinking: Materiality assessment + cross-reference. Per Rule 6, the materiality assessment makes this Strategy Integration.


reasoning: The paragraph acknowledges actual cyber incidents ('has been subject to cyber related incidents') and describes the remediation response ('implemented additional safeguards'), which falls under Incident Disclosure's coverage of incident narrative and remediation actions. The incidents themselves are cross-referenced rather than described, but the paragraph's primary communicative purpose is disclosing that incidents occurred and what was done afterward. Specificity is Firm-Specific: the quarter-end dates (June 30, 2023 and September 30, 2023) reference when incidents were disclosed, providing firm-specific temporal context, but they are filing-period dates rather than independent hard verifiable cybersecurity facts, so they don't clearly reach the two-fact QV threshold.

thinking:
Let me analyze this paragraph.

Content: References past cyber incidents (previously disclosed), mentions implementing additional safeguards. The paragraph describes what happened (past incidents) and response (additional safeguards). But it's more about the strategic response - they've implemented safeguards after incidents.

Actually, let me reconsider. The paragraph references past incidents and then describes implementing additional safeguards. The incidents are referenced but not described in detail. The main point is about the response/safeguards implemented after incidents.

This is a borderline case. It references actual incidents (Incident Disclosure) but doesn't describe them - it just cross-references other filings.

The substantive content is about implementing safeguards (Risk Management Process) and the materiality language ("material adverse effect"). The paragraph references past incidents without describing them in detail, then discusses the safeguards implemented in response. This feels like it straddles Incident Disclosure and Risk Management Process, though the primary focus seems to be the company's strategic response to those incidents rather than the incidents themselves.

Looking more closely at the language—"has been subject to cyber related incidents, as previously disclosed" followed by "we have implemented additional safeguards designed to detect and prevent cybersecurity events"—the core narrative is incidents occurred, and we responded. Since the incidents aren't actually described here, just cross-referenced, and the substantive content centers on the safeguards and their purpose, I think Risk Management Process is the better classification. The incident reference provides context, but the real substance is about the controls and preventive measures.

On the dates—they're tied to the quarterly reporting periods (June 30, 2023 and September 30, 2023), not the incidents themselves, so they're specific filing dates rather than incident-specific dates.

Looking at what remains after filtering out the filing references and company self-references, I'm left with "additional safeguards designed to detect and prevent cybersecurity events," which is pretty generic language. The "material adverse effect" part doesn't add much specificity either.

The paragraph does mention specific quarters—June 30, 2023 and September 30, 2023—but these are filing dates, not direct cybersecurity event dates. The codebook excludes filing form types from being specific facts, and these dates are tied to the filings themselves rather than the incidents. Even though "previously disclosed" incidents implies something firm-specific happened, the codebook's IS list requires concrete details like named frameworks or specific incident types. Without those, this falls into Generic Boilerplate. The dates are really just filing metadata, not independent cybersecurity facts. So I'm settling on Firm-Specific for specificity since the quarter references tie to when incidents were disclosed. The core content here is about risk management—the company acknowledges past incidents and describes the safeguards they've implemented in response, which is the substantive part of what they're communicating.

fact: Quarterly Report for quarter ended June 30, 2023

fact: Quarterly Report for quarter ended September 30, 2023


reasoning: The paragraph opens with a generic IRP description (Risk Management Process) but the majority of content addresses materiality assessments — 'no material cybersecurity incidents in the last 24 months' and a physical break-in that 'did not result in a material impact on our operations, financial condition or results of operations.' These explicit materiality conclusions make Strategy Integration the dominant category per Rule 6. The specific fiscal year end date is one firm-specific fact, but no second QV-eligible hard fact is present, so specificity stays at Firm-Specific.

thinking:
Let me analyze this paragraph carefully.

The paragraph has two main parts:
1. Description of an incident response plan (generic - no named framework, no specific tools)
2. Description of a physical break-in incident and materiality assessment

Let me determine the dominant category. The first half describes an IRP in generic terms. The second half discloses a physical security incident and assesses its materiality.

The physical break-in is not really a cybersecurity incident - the company itself notes it was "an isolated physical security incident." However, it's disclosed in Item 1C, so the company is addressing it in a cybersecurity context.

Actually, looking more carefully: the paragraph says "We have had no material cybersecurity incidents in the last 24 months" - this is a materiality assessment.

The company then describes a physical break-in that didn't materially impact operations, and explicitly characterizes it as a physical security incident rather than a cybersecurity one. The materiality statements bookend the disclosure, suggesting the core purpose is establishing that no material incidents occurred, even though a physical security event did happen.

Looking at the structure, the IRP description occupies the opening sentences while the materiality assessments and incident details dominate the rest. That makes Strategy Integration the primary category here. The specificity is moderate—there's a concrete fiscal year date and details like "firemen's access conduit," though the 24-month timeframe is somewhat generic. The September 30, 2025 date gives it enough specificity to count.

Now I'm evaluating whether this qualifies as QV-eligible. The fiscal year end date is clearly a hard verifiable fact, and the 24-month lookback period is a quantified timeframe—both are concrete enough to meet the threshold. That gives me two QV-eligible facts rather than just one.

Actually, wait. Looking back at the QV criteria, "24 months" as a lookback window is different from specific dates or headcounts. It's more of a generic boilerplate phrase than a precise verifiable metric. The September 30, 2025 date is solid, but I'm not confident the 24-month window counts as a second QV fact. Without that second hard verifiable element, this falls into Firm-Specific territory.

fact: fiscal year ended September 30, 2025


reasoning: The paragraph's primary content is about the management-level Cybersecurity Board and the SVP who leads it — their composition, responsibilities, and especially the SVP's qualifications (25+ years experience, pharmaceutical industry background, CISSP). While some process language appears ('cybersecurity strategy, processes and governance'), it is subordinate to describing who these people are and how the management structure is organized. Two QV-eligible hard facts: specific years of experience (25+) and a named certification (CISSP).

thinking:
Let me analyze this paragraph carefully.

Content: Describes a cross-functional Cybersecurity Board led by SVP of IT Systems & Security, mentions CFO and General Counsel as members, describes responsibilities, and then describes the SVP's qualifications (25+ years experience, pharmaceutical industry, CISSP certification).

Category: This paragraph has dual content - it describes a management committee structure AND the person's qualifications. The primary actor is the SVP and the Cybersecurity Board (a management committee). The paragraph describes: (1) the composition of a management committee, (2) its responsibilities, and (3) the SVP's background and credentials. This is primarily about Management Role - the person leading cybersecurity and the management committee structure.

The Cybersecurity Board is a management committee rather than the Board of Directors, so I'm categorizing this as Management Role. I'm identifying the key facts here: the SVP's title is a named role specific to cybersecurity, the Cybersecurity Board itself is a named committee, and the SVP brings over 25 years of experience plus a CISSP certification—those are the quantifiable credentials worth noting.

fact: Senior Vice President, Information Technology Systems & Security

fact: Cybersecurity Board (named management committee)

fact: More than 25 years of experience in information technology

fact: CISSP certification


reasoning: The paragraph primarily describes Blue Owl's internal cybersecurity program — its ISG Policy, monitoring processes, vulnerability management, encryption, DLP, access controls, and NIST alignment. The CTO and Head of Technology Infrastructure are mentioned as attribution for who manages the program, but the substantive content is about what the program does (person-vs-function test: remove the roles and the paragraph still fully describes the program). Firm-Specific because it names cybersecurity-specific roles (CTO, Head of Technology Infrastructure) and a uniquely identified internal program (ISG Policy), but lacks two hard verifiable facts (no dates, dollar amounts, headcounts, named third-party firms, or named tools) needed for Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes Blue Owl's cybersecurity program - ISG Policy, managed by CTO and Head of Technology Infrastructure, their responsibilities, security measures, NIST framework alignment.

Category: This paragraph describes the company's internal cybersecurity processes, tools, and methodologies. The CTO and Head of Technology Infrastructure are mentioned as attribution for who manages the program, but the bulk of the paragraph is about what the program does - monitoring, vulnerability management, encryption, DLP, access control, etc. Using the person-vs-function test: remove the role mentions and the paragraph still describes the program. → Risk Management Process

Now I'm checking the specificity of the facts here. The CTO is a named cybersecurity role on the IS list, and "ISG Policy" is a firm-specific internal program identifier. NIST is a sector-adapted framework, but I don't have the hard verifiable facts needed for QV eligibility—no dates, dollar amounts, headcounts, or named third-party vendors.

This lands at Firm-Specific level 3 based on the CTO title and ISG Policy alone.

fact: Chief Technology Officer

fact: Head of Technology Infrastructure

fact: information security governance policy (the 'ISG Policy')

fact: NIST Cybersecurity Framework


reasoning: The paragraph's central topic is oversight of third-party service providers' information security programs — reviewing them before engagement, assessing risk levels, and conducting periodic reviews. This is vendor security oversight, squarely Third-Party Risk. No named frameworks, specific roles, dates, tools, or firm-specific facts are present; 'typically annual,' 'internally developed criteria,' and 'certain third-party service providers' are all generic/vague qualifiers on the NOT list.

thinking:
Let me analyze this paragraph.

Content: Describes how the company reviews third-party service providers' security programs before engagement, risk-based approach, periodic reviews. Central topic is vendor oversight.

Category: Third-Party Risk - the entire paragraph is about oversight of external parties' cybersecurity.

Specificity: No named frameworks, no named tools, no specific dates, no dollar amounts, no named firms, no cybersecurity-specific roles. "Typically annual" is a generic cadence. "Internally developed criteria" is generic. No IS-list facts present. → Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity processes — monitoring, detection, anti-malware, employee training, audits — which are all Risk Management Process activities. No named frameworks, specific roles, dates, tools, or firm-specific facts are present; all practices listed are common/generic.


reasoning: The paragraph identifies two roles (Head of IT, CFO) as grammatical subjects and assigns their cybersecurity responsibilities — this is about who is responsible for what, making it Management Role. However, 'Head of IT' is generic IT leadership (not cybersecurity-specific per the IS-NOT list) and CFO is generic C-suite, so neither triggers Firm-Specific. No frameworks, dates, numbers, or named entities are present.

thinking:
Let me analyze this paragraph.

Content: Describes two management roles - Head of IT and CFO - and their cybersecurity responsibilities.

Category: This is about management roles and their responsibilities. The Head of IT and CFO are the grammatical subjects. But let me apply the person-vs-function test. The paragraph describes what these roles are responsible for (hiring, integrating risk, approving budgets, etc.). It's about their responsibilities/functions rather than their personal credentials/background. However, the primary communicative purpose is to identify WHO is responsible for what - this is management role attribution.

Actually, looking more carefully: the paragraph tells us which roles handle cybersecurity responsibilities. It's not describing the persons' credentials but rather their functional responsibilities.

The codebook defines Management Role as covering "management committees responsible for cybersecurity" and reporting lines, and this paragraph is structured around roles as subjects performing actions. When I strip away the titles, I'm left with process descriptions, which could suggest Risk Management Process. But the core structure here is "Role X handles A, B, C. Role Y handles D, E, F." - that's organizational responsibility assignment, which points back to Management Role. The paragraph is fundamentally identifying which roles own which cybersecurity functions.

Now checking the specificity: "Head of IT" and "Chief Financial Officer" are both flagged in the IS-NOT list as generic leadership titles, not cybersecurity-specific roles. There are no frameworks named, no dates, no numbers, no specific organizations mentioned. This is Generic Boilerplate.


reasoning: The paragraph describes the company's internal threat identification processes — monitoring, scanning, vulnerability assessments, tabletop exercises. These are all common security practices with no named frameworks, tools, roles, or firm-specific details. Everything listed appears on the NOT list (common practices, generic descriptions).


reasoning: The entire paragraph is about oversight of third-party service providers — reviewing their cybersecurity practices, imposing contractual obligations, conducting security assessments and questionnaires, and periodic re-assessments. Vendor oversight is the central topic, making this Third-Party Risk. No named standards, firms, tools, dates, or other specific facts are present; the descriptions of vendor management activities (questionnaires, assessments, contractual obligations) are generic practices applicable to any company.

thinking:
Let me analyze this paragraph.

Content: Describes third-party vendor management processes - reviewing cybersecurity practices, contractual obligations, security assessments, questionnaires, periodic re-assessments. The central topic is oversight of external parties.

Category: Third-Party Risk - vendor oversight is the central topic.

Specificity: No named frameworks, no named tools, no specific dates, no numbers, no named firms, no cybersecurity-specific roles. "SaaS platforms, managed services, cloud-based infrastructure, encryption and authentication technology" are generic descriptions of service types, not named products. Everything here is generic vendor management language.

→ Generic Boilerplate (1)


reasoning: The paragraph makes an explicit materiality assessment—that no cybersecurity risks or incidents have materially affected or are reasonably likely to materially affect business strategy, operations, or financial condition—which is the hallmark of Strategy Integration per Rule 6. The specific reporting period ('year ended December 31, 2024') is a firm-specific date anchoring the assessment to this company's fiscal year, elevating it above Generic Boilerplate, though it remains largely boilerplate in substance with only one hard fact.

thinking: Materiality assessment paragraph.

fact: year ended December 31, 2024


reasoning: The paragraph opens with an explicit materiality assessment ('have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition'), which is Strategy Integration per Rule 6. The subsequent generic risk language and cross-reference to Item 1A do not change the classification. No firm-specific facts from the IS list are present — the materiality language is boilerplate.

thinking:
Let me analyze this paragraph.

The paragraph contains:
1. A materiality assessment: "we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition" → Strategy Integration per Rule 6
2. Generic risk language about not guaranteeing safeguards
3. A cross-reference to Item 1A Risk Factors

The dominant content is the materiality disclaimer. Per Rule 6 and the codebook, any paragraph with an explicit materiality assessment is Strategy Integration, even with a cross-reference appended.

Specificity: No named frameworks, no firm-specific facts from the IS list. The language is boilerplate materiality. → Generic Boilerplate.


reasoning: The Audit Committee is the grammatical subject throughout, overseeing cyber risk, reviewing programs, and receiving reports from management — classic Board Governance. Management roles (CTO, Senior Director of Information Security) are mentioned as reporting TO the committee, not as primary actors. Two cybersecurity-specific titles qualify as firm-specific facts, but named roles are not QV-eligible, so specificity stays at Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes board/committee oversight (Audit Committee), but also mentions management roles (CTO, Senior Director of Information Security). The primary actor is the Audit Committee - it's the grammatical subject throughout most of the paragraph. The management roles are mentioned in the context of reporting TO the committee.

Category: Board Governance - the Audit Committee is the primary actor overseeing cyber risk, receiving reports from management.

Specific facts:
- CTO (Chief Technology Officer) - cybersecurity-specific title? CTO is on the IS list
- "Senior Director of Information Security" - cybersecurity-specific title, IS list

- "Bi-annual meetings" is a generic cadence like quarterly or annual, so it doesn't count toward QV. The named roles themselves (CTO, Senior Director of Information Security) are firm-specific facts, but they're explicitly excluded from QV eligibility since named roles like CISO and CIO don't qualify.

So I'm left with firm-specific facts but no QV-eligible ones reaching the 2+ threshold needed.

Specificity: Firm-Specific (3)

fact: Senior Vice President and Chief Technology Officer (CTO)

fact: Senior Director of Information Security