reasoning: The paragraph's primary content is about the CISO as a person — their responsibility, years of experience, and tenure since 2018. The final sentence about executive leadership monthly reviews is subordinate. Two QV-eligible hard facts: 'over 20 years' (specific duration) and 'since 2018' (specific date).

thinking:
Let me analyze this paragraph.

The paragraph is about the CISO - their responsibility, experience, tenure, and oversight structure.

Content category: Management Role - the paragraph is about the person (CISO's experience, tenure since 2018). The last sentence about executive leadership providing oversight through monthly business reviews is subordinate.

Specific facts:
- CISO (cybersecurity-specific title) → named_role
- "over 20 years" of experience → quantified
- "since 2018" → specific_date
- "monthly business reviews" → this is a generic cadence, not a specific fact

QV check: "over 20 years" (years of experience as specific number) + "since 2018" (specific date) = 2 hard verifiable facts → Quantified-Verifiable

fact: CISO (cybersecurity-specific title)

fact: over 20 years of experience

fact: CISO since 2018


content_category: Risk Management Process

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the company's internal cybersecurity policies and procedures — how measures and controls are developed, implemented, and reviewed. This is squarely Risk Management Process. Despite naming an 'Information Security Policy' and 'Incident Response Plan,' these are generic program names without unique identifiers per the NOT list, and no named frameworks, roles, dates, tools, or other specific facts are present.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Classify this paragraph.

Content: Describes written policies and procedures - Information Security Policy and Incident Response Plan. Describes how cybersecurity measures are developed, implemented, reviewed. Describes security controls, appropriate use, user responsibilities.

Category: Risk Management Process - describes internal cybersecurity processes, policies, procedures.

Specificity: Let me check for specific facts.
- "Information Security Policy" - generic program name, no unique identifier
- "Incident Response Plan" - generic program name
- No named frameworks, no named roles, no dates, no numbers, no named tools/firms.

All items are generic program names per the NOT list. No named standards either.

This is generic boilerplate content with no specific identifiers, frameworks, or concrete details.


category_confidence: medium

reasoning: The paragraph's primary content describes cybersecurity program activities—implementing policies, overseeing protection/detection/response capabilities, managing incident response, coordinating with IT—with the DPIRC as the entity performing these functions. Applying the person-vs-function test, replacing 'The DPIRC' with 'The Company' leaves the process description intact, so this is Risk Management Process rather than Management Role. Contains multiple firm-specific facts (DPIRC, Enterprise Risk Committee, CIO) but none are QV-eligible (no dates, dollar amounts, headcounts, named third-party firms, or named tools).

thinking:
Let me analyze this paragraph.

Content: Describes the DPIRC committee's responsibilities for cybersecurity - implementing policies, overseeing protection/detection/response, promoting cybersecurity risk posture, reviewing best practices, strategic direction, training oversight, incident monitoring, coordination with IT. Also mentions Enterprise Risk Committee receiving updates from CIO.

Category: This is about a management committee (DPIRC) and its functions. The DPIRC is the grammatical subject performing actions. This is about internal cybersecurity processes managed by this committee. The last sentence mentions Enterprise Risk Committee and CIO.

The DPIRC seems to be a management-level committee (not board). The paragraph describes what this committee does - which is essentially risk management processes.

So the core question is whether this is fundamentally about the committee itself or the processes it manages. The DPIRC is clearly the subject driving the narrative, but the substance is really about the cybersecurity risk management functions it oversees. If I swap out the committee name, the processes remain the same - they're not dependent on who's running them. That suggests this belongs in Risk Management Process rather than Committee Structure.

As for specificity, DPIRC and Enterprise Risk Committee are both named, non-generic entities specific to this firm, while CIO is a recognized cybersecurity role that appears on the IS list.

fact: DPIRC (named management committee overseeing cybersecurity)

fact: Enterprise Risk Committee

fact: CIO (Vista CIO provides information security updates)


content_category: Strategy Integration

reasoning: The paragraph opens and closes with explicit materiality assessments ('have not encountered any risks... that have materially affected' and 'we do not presently believe... has materially affected'), framing the entire discussion around the business/financial impact of the Change Healthcare incident on Bioventus's claims processing and cash flows. While substantial incident narrative is present, it is a third-party incident described in service of the company's own materiality conclusion — the primary communicative purpose is strategic impact assessment, not incident reporting. Multiple QV-eligible hard facts (two named firms, named product, two specific dates) easily exceed the two-fact threshold.

thinking:
Let me analyze this paragraph carefully.

The paragraph discusses:
1. A materiality assessment ("have not encountered any risks from cybersecurity threats that have materially affected...")
2. A third-party incident (Change Healthcare/UnitedHealth Group) and its impact on the company
3. Operational disruption details (billing, collections, claims processing)
4. Specific dates and named entities
5. Another materiality conclusion at the end

This is primarily about the business/financial impact of a third-party cybersecurity incident on the company. It's not describing the company's own incident - it's describing how a vendor's incident affected them strategically/operationally.

The paragraph is fundamentally a strategic assessment wrapped in materiality language, examining how a third-party vendor's cybersecurity breach cascaded into operational and financial impacts for the company—delayed claims processing, cash remittance disruptions—while ultimately concluding these effects haven't materially affected the business. The paragraph's real focus is whether cybersecurity risks have materially impacted the company—the Change Healthcare incident serves as evidence for that assessment rather than being the main point. Since the opening and closing frame this around materiality and business impact, Strategy Integration is the right category. Looking at the specifics, I've got Change Healthcare, UnitedHealth Group, the Exogen device, and two concrete dates from March 2024, which easily clears the threshold for Quantified-Verifiable.

fact: Change Healthcare named as third-party vendor/intermediary

fact: UnitedHealth Group named as parent company

fact: Exogen device named as specific product

fact: March 7, 2024 — UnitedHealth Group issued statement

fact: March 18, 2024 — expected date to begin restoring service


reasoning: The paragraph contains an explicit materiality assessment ('these incidents have not had a material impact on our systems or business operations'), which per Rule 6 makes it Strategy Integration even though the surrounding text is generic risk language and a cross-reference to Risk Factors. No named frameworks, roles, dates, tools, or other specific facts are present — all language is boilerplate.

thinking:
Let me analyze this paragraph.

The paragraph discusses:
1. IT systems detecting attacks (generic)
2. "these incidents have not had a material impact" - materiality assessment
3. Generic risk language about disruptions
4. Cross-reference to Risk Factors

The materiality assessment ("these incidents have not had a material impact on our systems or business operations") makes this Strategy Integration per Rule 6. The rest is generic risk language and a cross-reference.

Specificity: No named frameworks, no specific facts from the IS list. Generic boilerplate language throughout. The materiality statement is boilerplate. → Generic Boilerplate.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes — ERM integration, cross-functional teams, escalation paths, and IT department coordination — making Risk Management Process the dominant category. No named frameworks, cybersecurity-specific roles, dates, tools, or other facts from the IS list are present; all references (board, management, IT department, cross-functional teams) are generic.

thinking:
Let me analyze this paragraph.

Content: Describes integration of cybersecurity into ERM, mentions cross-functional teams, escalation paths, IT department working with management. This is about internal processes.

Category: Risk Management Process - describes risk assessment methodology, ERM integration, cross-functional teams, escalation paths.

Specificity: Let me check for specific facts.
- "cross-functional teams" - generic
- "executive and senior management teams" - generic
- "board of directors" - generic
- "information technology department" - generic
- No named frameworks, no named roles from IS list, no dates, no numbers, no named tools

This is Generic Boilerplate.


content_category: Management Role

reasoning: The paragraph is about the person filling the cybersecurity leadership role — their title (CIO), years of experience, and career background across industries. The CIO is a cybersecurity-specific role per the IS list, and '25 years' is a specific quantified duration, giving two QV-eligible facts (named role is Firm-Specific, not QV-eligible; however, years of experience as a specific number IS QV-eligible). Re-checking: QV-eligible facts are specific dates, dollar amounts, headcounts/percentages, named third-party firms, named products/tools, named certifications, years of experience as a specific number, named universities. '25 years' counts as one QV fact. Named roles do NOT count toward QV. Only one QV-eligible fact remains, so this is Firm-Specific, not QV.

fact: CIO (cybersecurity-specific title)

fact: over 25 years of professional IT experience

type: quantified


reasoning: The paragraph's primary communicative purpose is a materiality assessment ('We do not believe these cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition'). While it briefly lists incident types (malware, phishing, account takeover, DoS), it provides no narrative detail about any specific event — no dates, scope, or response actions — making the materiality conclusion the dominant content per Rule 6 and the tiebreaker for 'brief mention of a past incident + materiality conclusion as the main point.' The remainder is a cross-reference to Risk Factors and generic forward-looking risk language. No specific facts from the IS list are present: incident types are common practices, the cross-reference is boilerplate, and no named roles, dates, firms, or tools appear.

thinking:
Let me analyze this paragraph.

Content: This paragraph discusses past cybersecurity incidents (malware, phishing, account takeover, DoS) and makes a materiality assessment ("We do not believe these cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition"). It also includes a cross-reference to Risk Factors and generic forward-looking risk language.

Category: The paragraph contains both incident references and a materiality assessment. Per Rule 6 and the tiebreakers: "Brief mention of a past incident + materiality conclusion as the main point → Strategy Integration." The incidents are listed but not described in detail (no dates, no scope, no response actions). The main point is the materiality assessment. → Strategy Integration.

The language here is entirely generic—just incident types with no specifics like dollar amounts, dates, affected parties, or named standards. This is boilerplate language.


content_category: Board Governance

reasoning: The paragraph's primary communicative purpose is the reporting and escalation structure to the Board and its committees — the Board oversees resilience, receives education, and the ISO periodically updates multiple named committees and the Board. While the first and last sentences touch on internal controls and IRP testing (Risk Management Process), the dominant thread is the governance oversight and briefing cadence. Multiple IS-list facts (ISO as a cybersecurity-specific role, Information Technology Committee and ARC Committee as named non-generic committees) establish Firm-Specific, but no QV-eligible hard facts (dates, dollar amounts, headcounts, named third-party firms, or named tools) appear.

thinking:
Let me analyze this paragraph.

Content: Describes internal controls for reporting security matters, board oversight, ISO reporting to committees, and IRP testing.

Category analysis:
- Internal controls/protocol for reporting → Risk Management Process
- Board oversees resilience, receives education → Board Governance
- ISO reports to IT Committee, ARC Committee, Board → could be Management Role or Board Governance
- IRP testing → Risk Management Process

The paragraph mixes several things. The primary actors shift: "The Company's internal controls" (RMP), "The Board oversees" (BG), "The ISO...updates" (could be Management Role or BG).

Looking at the dominant content, I'm weighing whether this is primarily about the oversight structure or the underlying processes. The board oversight and ISO reporting to committees suggests Board Governance is the main focus—it's really about how information flows to the board and the briefing cadence. But the internal controls and IRP testing pull toward Risk Management Process. Given the emphasis on board education and committee briefings, I think Board Governance edges out as the primary category here.

Now I'm checking the specificity of the terms mentioned. ISO is a named cybersecurity role that belongs on the Information Security list. The Information Technology Committee and ARC Committee are both named committees that should be flagged. IRP is just an abbreviation for incident response plan, so that's more generic. The Chief Risk Officer reporting line is a governance detail but not explicitly on the Information Security list, so I'll focus on the clearly specific terms—the ISO title and the two named committees.

fact: ISO (Information Security Officer)

fact: Information Technology Committee

fact: Audit and Risk Committee ("ARC Committee")

fact: Chief Risk Officer (ISO reporting line)


reasoning: The paragraph contains an explicit materiality assessment ('have not had a material impact nor, are they anticipated to significantly affect the Company, including our business strategy, results of operations or financial condition'), which per Rule 6 makes it Strategy Integration regardless of the appended cross-reference to Risk Factors. No firm-specific facts from the IS list are present — the company name, filing form type, and generic Risk Factors cross-reference are all on the NOT list.

thinking:
Materiality assessment + cross-reference. Per Rule 6, the materiality assessment makes this Strategy Integration.

Specificity: No named standards, no firm-specific facts from the IS list. The cross-reference to Risk Factors is generic. "To date" is vague. Company self-references don't count. → Generic Boilerplate.


specificity_confidence: medium

reasoning: The paragraph describes the process by which management monitors cybersecurity incidents — through service provider notifications and communications with specific departmental personnel (risk management, legal, IT, compliance). Although 'Management' is the grammatical subject, the person-vs-function test shows this is about the monitoring process, not about any individual's credentials or background. The specific departmental composition (risk management, legal, IT, compliance) qualifies as a firm-specific team composition per the IS list.

thinking:
Classify this paragraph.

The paragraph describes management's role in monitoring cybersecurity incidents through notifications and communications with various personnel. The grammatical subject is "Management" and it describes how management stays informed about cyber incidents.

Category: This is about management's role in monitoring/being informed about cybersecurity. The subject is "Management" and it describes their information flow. However, it doesn't describe WHO the person is (credentials, background, name). It describes what management does functionally.

But the grammatical subject is "Management" and the paragraph is about how management monitors and gets informed. It's not about a specific person's credentials - it's about management's functional role in the process. This is borderline between Management Role and Risk Management Process.

Applying the person-versus-function test: if I swap "Management" for "the Company," the sentence still works as a process description—"The Company is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents." This suggests it's leaning toward Risk Management Process rather than Management Role. The codebook is clear that Management Role focuses on the individual filling the position—their name, qualifications, career history, credentials, and reporting lines—none of which appear here. This paragraph is describing the oversight function itself, not the person performing it. The specific department composition—risk management, legal, IT, and compliance—actually does meet the threshold for a specific team listing, similar to the examples in the IS list. And since these are departments within the adviser and FS Investments, which functions as the company's management given the externally managed REIT structure, this specificity pushes toward Firm-Specific rather than the generic Risk Management Process classification.

fact: Communications with risk management, legal, information technology and/or compliance personnel


reasoning: The paragraph describes the company's internal cybersecurity risk management processes — risk assessments, incident detection, vulnerability management, access controls, monitoring, training, etc. — making it squarely Risk Management Process. Despite the lengthy bulleted list, every item is a common security practice (penetration testing, phishing tests, endpoint detection, firewalls, etc.) with no named frameworks, no named tools/products, no specific roles from the IS list, no dates, and no quantified facts. The reference to 'Item 106(a) of Regulation S-K' is a regulatory citation, not a cybersecurity standard. This could be pasted into any company's filing unchanged.

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity risk management program - risk assessments, incident detection, vulnerability management, etc. This is clearly about internal processes.

Category: Risk Management Process - describes the company's own internal cybersecurity processes, tools, and methodologies.

Specificity: Let me check for specific facts:
- No named frameworks (NIST, ISO, etc.)
- No named roles (just "IT, Security and other departments" - generic)
- No named tools or products
- No dates, dollar amounts, headcounts
- No named third-party firms
- References Item 106(a) of Regulation S-K - that's a regulatory reference, not a cybersecurity framework

- Lists common practices: risk assessments, incident detection, vulnerability management, etc. - all generic

Everything listed is common practice. No IS-list items. No named standards. → Generic Boilerplate.


reasoning: The paragraph describes the company's own internal cybersecurity processes — internal audits, engaging third-party experts, and incident response guidelines/plans. Third parties are mentioned as one component of the internal program, not as the central topic. No named frameworks, roles, firms, tools, dates, or specific numbers are present; all language is generic and could apply to any company.

thinking:
Let me classify this paragraph.

Content: Describes internal audits, engaging third-party experts, incident response guidelines, teams and plans for response.

Category: Risk Management Process - describes internal cybersecurity processes (audits, IR guidelines, teams). Third parties mentioned as one component, not central topic.

Specificity: No named frameworks, no named roles, no named firms, no specific dates, no numbers. "Third-party experts" is generic. "Cybersecurity incident response guidelines" is a generic program name. Everything here is generic practices.

→ Generic Boilerplate


reasoning: The paragraph contains an explicit materiality assessment ('have not experienced a material cybersecurity incident that has resulted in a material adverse impact to our business or operations'), making it Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. No specific facts from the IS list are present — the language is boilerplate materiality disclaimer found across thousands of filings.

thinking: Materiality assessment + cross-reference. Per Rule 6, the materiality assessment is the substantive content.


reasoning: The paragraph's primary content is about the person filling the cybersecurity leadership role — their experience (30+ years) and educational background — making it Management Role. The 'SVPF and Director of IT' title is generic IT leadership per the NOT list, and the degrees lack named universities, so the only IS-list fact is the specific duration of experience (one QV-eligible fact → Firm-Specific, not QV).

thinking:
Let me analyze this paragraph.

The paragraph describes two things: (1) the SVPF and Director of IT's qualifications and responsibilities, and (2) external support for the program.

Primary content: Who the person is - their title, experience, education, and responsibilities. This is about the person (Management Role).

Person-vs-function test: The paragraph tells us about the person's experience ("over thirty years"), degrees ("computer science and information science degree"), and their role. Remove the person details and you're left with "are responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Board of Directors. We support our information security program with external resources including cybersecurity software providers and advisors as needed." - which is somewhat about the function, but the dominant content is about who the person is.

Looking at the title more closely, "Director of IT" appears on the generic IT leadership list, not as a cybersecurity-specific role. The "SVPF" designation is also generic C-suite. Even with the extensive background in computer science and information science, the focus here is still on the individual's qualifications rather than the cybersecurity function itself.

fact: over thirty years of experience in information technology


reasoning: The grammatical subjects throughout are board-level entities (the Committee, the full Board, Board members) receiving reports and briefings on cybersecurity — classic Board Governance. The paragraph names a 'Director of Information Systems Security,' a cybersecurity-specific title on the IS list, making it Firm-Specific. No second QV-eligible hard fact prevents Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

The paragraph is about the Board receiving reports and briefings on cybersecurity. The grammatical subjects are "The Committee," "The full Board," and "Board members" - all board-level entities. This is Board Governance.

Specific facts:
- "Senior Vice President of Technology" - this is a specific title but is it cybersecurity-specific? It's more of a general tech title. Let me check... not on the IS list exactly.
- "Director of Information Systems Security" - this is a cybersecurity-specific title (similar to "Director of IT Security" on the IS list). This counts as firm-specific.

- No frameworks, dates, dollar amounts, or named firms appear here. The only substantive detail is that cybersecurity-specific role title, which makes this Firm-Specific rather than QV-eligible since named roles don't qualify for QV.


reasoning: The paragraph's primary content is about who the management team members are — their specific cybersecurity-related titles, their responsibilities, and their collective qualifications (20+ years across named industries). While it mentions they manage the program, the person-vs-function test shows the paragraph is fundamentally about the people and their credentials. Multiple cybersecurity-specific roles qualify as IS facts, and 'over 20 years' is one QV-eligible fact, but only one hard verifiable fact means Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph describes management roles and their qualifications. The grammatical subjects are management team members, their responsibilities, and their experience. It names specific cybersecurity-specific titles (SVP of Technology, Director of Information Systems Security, Director of Information Systems Governance Risk and Compliance), describes their responsibilities, and details their collective experience. The person-vs-function test: the paragraph tells us about WHO these people are (their titles, experience, industries). While it mentions they manage the program, the primary content is about the people and their qualifications. → Management Role

Specificity:
- "Senior Vice President of Technology" — this is a cybersecurity-adjacent title but not exactly on the IS list. Let me think... it's close to "VP of IT/Security"

- "Director of Information Systems Security" and "Director of Information Systems Governance Risk and Compliance" are both cybersecurity-specific titles that align with recognized roles
- "over 20 years" of experience is a specific, quantifiable duration that qualifies as QV-eligible
- The industries mentioned (energy, healthcare, pharmaceuticals, finance) provide context but aren't independently verifiable facts

So I'm identifying which claims here are actually verifiable and specific enough to count toward qualifications.

Looking at this more carefully, I have one clear QV-eligible fact: the 20+ years of experience. The named roles are firm-specific credentials but don't meet the QV threshold on their own. Since I need at least two QV-eligible facts and I'm only seeing one, this profile falls into the Firm-Specific category rather than QV.

fact: Senior Vice President of Technology

fact: over 20 years of experience


reasoning: This is a standard materiality disclaimer assessing that cybersecurity risks have not materially affected the company's business strategy or financial condition, which per Rule 6 is Strategy Integration. The language is boilerplate with no firm-specific facts.


content_category: Incident Disclosure

reasoning: The paragraph is primarily a narrative of an actual cybersecurity incident at Targus — discovery, unauthorized access, containment, response actions, and ongoing investigation — making Incident Disclosure the dominant category. Although a materiality assessment is included, it is subordinate to the incident narrative. Specificity is Firm-Specific: the specific date (April 5, 2024) is one QV-eligible hard fact, but 'Targus' is a subsidiary name (NOT list), 'external cybersecurity counsel and consultants' are unnamed, and 'law enforcement'/'regulatory authorities' are generic — so only one hard fact, not enough for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

This describes an actual cybersecurity incident at Targus (a subsidiary). Let me break it down:

- Specific date: April 5, 2024
- Named entity: Targus (subsidiary)
- Describes what happened: unauthorized access to file systems
- Response actions: activated IR and business continuity protocols
- Impact: temporary interruption of business operations
- Containment status
- Materiality assessment: does not believe it will materially impact financial condition
- Regulatory notification

Category: This is primarily describing what happened in an incident - the timeline, scope, response actions, containment. There's a materiality assessment embedded, but the dominant content is the incident narrative. → **Incident Disclosure**

Now I'm checking what counts as a specific fact here. The April 5, 2024 date is verifiable and qualifies, but the company name and references to external counsel, law enforcement, and regulatory authorities are all on the non-specific list. That leaves me with just one QV-eligible fact.


reasoning: The paragraph describes the company's internal incident documentation and cataloguing processes, with the CISO mentioned as incidental attribution for who reviews incidents. The substantive content is about process (documenting, recording, cataloguing, security incident register, vulnerability monitoring, incident response procedures), making this Risk Management Process. The CISO title is a cybersecurity-specific role triggering Firm-Specific, but there are no additional hard verifiable facts to reach Quantified-Verifiable.

thinking:
Classify this paragraph.

Content: Describes incident documentation, recording, cataloguing, review by CISO, security incident register, vulnerability monitoring and incident response procedures.

Category: This is about internal processes - how incidents are documented and managed. The CISO is mentioned as attribution ("review by the CISO"). The substance is about the process. → Risk Management Process

Specific facts:
- CISO mentioned → cybersecurity-specific title → Firm-Specific
- No other hard verifiable facts (no dates, amounts, named tools, named firms)

Specificity: One IS fact (CISO) → Firm-Specific

fact: CISO reviews documented incidents


reasoning: The paragraph contains an explicit materiality assessment ('not aware of any cybersecurity threats or incidents that have materially affected or are reasonably expected to materially affect our business'), which per Rule 6 makes it Strategy Integration regardless of the appended cross-reference to Risk Factors. No named frameworks, firm-specific facts, or verifiable details are present—the language is standard boilerplate.

thinking: Materiality assessment + cross-reference. Per Rule 6, the materiality assessment makes this Strategy Integration. Specificity: boilerplate language, no specific facts.


reasoning: The paragraph describes the company's internal incident escalation process — from detection through investigation, risk rating, and reporting. While multiple roles and committees are named, the primary communicative purpose is the workflow/process itself, not the people or the board. Multiple firm-specific facts exist (cybersecurity-specific role, two non-generic committees, specific 24-hour escalation window), but only the 24-hour timeframe is QV-eligible, falling short of the two-fact QV threshold.

thinking:
Let me analyze this paragraph.

Content: Describes the incident response escalation process - when a threat is identified, Senior Director of Information Security is notified, conducts investigation, escalates to Technology Risk Management Committee, then to leadership/legal, then to Materiality Committee and Audit Committee within 24 hours.

Category: This is primarily about the company's internal incident response process. The grammatical subjects are "our processes," "the cybersecurity program," etc. While it mentions several roles and committees, the paragraph is describing the escalation workflow/process, not the person or the board. → **Risk Management Process**

Specific facts:
- "Senior Director of Information Security" — cybersecurity-specific title → IS list ✓

- "Technology Risk Management Committee" — named non-generic committee → IS list ✓
- "Materiality Committee" — named non-generic committee → IS list ✓
- "within 24 hours" — specific timeframe/number → quantified
- "Audit Committee" — NOT list (generic)

For the quantified value check, "24 hours" is the only QV-eligible fact here since it's a specific number, while the named committees and the security director title are firm-specific but don't qualify as quantified values.

That gives me three IS-list facts total, making this Firm-Specific rather than QV.

fact: Senior Director of Information Security

fact: Technology Risk Management Committee

fact: Materiality Committee

fact: within 24 hours of designation as high-risk


reasoning: The paragraph describes the company's internal cyber training curriculum development across subsidiaries, which is a risk management activity. No named frameworks, specific roles, dates, tools, or other facts from the IS list are present — the training topics (phishing, cybersecurity awareness, email security) are common practices, and the language is aspirational/generic ('we will work', 'may encompass').

thinking:
Let me analyze this paragraph.

Content: Describes plans to develop cyber training curriculum across subsidiaries. Uses future tense ("we will work") and hedging ("may encompass"). Topics mentioned are generic (phishing, cybersecurity awareness, email security).

Category: Risk Management Process - describes internal cybersecurity processes (training program development).

Specificity: No named frameworks, no specific facts from the IS list. Generic practices (phishing, cybersecurity awareness, email security). No named roles, dates, tools, or firms. → Generic Boilerplate.


reasoning: The CISO is mentioned as attribution, but the paragraph's substantive content describes the company's internal cybersecurity processes: risk assessments, monitoring, audits, scans, vulnerability assessments, red/blue team testing, and threat intelligence. Removing the CISO reference, the paragraph still reads as a complete process description → Risk Management Process. Specificity is Firm-Specific: CISO is a cybersecurity-specific title on the IS list. Multiple named frameworks (ISO 27001/27017/27018/27701, SOC 2, PCI DSS, HIPAA) are present, but no QV-eligible hard facts (no dates, dollar amounts, headcounts, named third-party firms, or named tools) reach the two-fact threshold for Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: The CISO and information security team identify, assess, and manage cybersecurity threats through various methods including tools, audits, scans, assessments, etc. This is about what the program does - the processes and activities.

Category: The CISO is mentioned as attribution, but the paragraph is about the processes - risk assessments, monitoring, audits, scans, vulnerability assessments, red/blue team testing, etc. Using the person-vs-function test: remove "The CISO and the information security team" and replace with "The Company" - the paragraph still makes complete sense as a process description. → **Risk Management Process**

Now I'm checking the specificity markers. The CISO title is cybersecurity-specific, which points to firm-specific language, and the paragraph references multiple named compliance frameworks like ISO 27001, 27017, 27018, 27701, SOC 2, PCI DSS, and HIPAA. The language about "conducting compliance audits with respect to" these standards suggests the company is maintaining these certifications rather than just mentioning them generically.

For the QV check, the CISO role itself isn't quantifiable, the frameworks are named standards without specific dates or dollar amounts, and there are no named third-party auditors, individual certifications, or product names mentioned. This means none of the hard verifiable facts from the QV list are present.

So this lands as firm-specific based on the CISO role being on the IS list, even though the compliance frameworks are named.

fact: CISO (Chief Information Security Officer)

type: framework

fact: SOC 2 compliance audits

fact: PCI DSS compliance audits

fact: HIPAA compliance audits


reasoning: The paragraph describes what the ECS team does — overseeing compliance, facilitating risk management, reviewing policies, benchmarking, maintaining a risk register, and running a security awareness program. These are all internal cybersecurity processes and activities (the function), not descriptions of who the people are (the person). The named ECS team with its specific sub-team composition (security architecture/engineering, IAM, security operations) is a firm-specific organizational detail, but there are no QV-eligible hard facts (no dates, dollar amounts, named third-party firms, or named tools).

thinking:
Classify this paragraph.

Content: Describes what the ECS team does - internal processes, compliance, risk management activities, policies, benchmarking, risk register, security awareness. This is about the function/processes, not about who the people are.

Category: Risk Management Process - describes internal cybersecurity processes and activities.

Specificity: Let me check for specific facts.
- "ECS team" - this is a named internal team, but is it a unique identifier? It's "Enterprise Cybersecurity" presumably. It's a named team composition/structure.
- "security architecture and engineering, identity and access management and security operations" - specific team compositions

- "cyber risk register" and "security awareness program" are generic program names, but the specific team compositions listed - security architecture and engineering, identity and access management, and security operations - are unique to this company and represent firm-specific facts.

The ECS team's sub-teams constitute a firm-specific organizational structure. There are no named frameworks, dates, dollar amounts, tools, or third-party firms mentioned. With the team composition being the only specific fact, this is Firm-Specific.

fact: ECS team composed of support teams: security architecture and engineering, identity and access management, security operations


reasoning: The paragraph describes regulatory resolutions (FTC, AG Offices) as business consequences of a past data security incident, without narrating the incident itself. This is about the strategic/regulatory impact of a cyber event, fitting Strategy Integration per the tiebreaker that business consequences without event description → Strategy Integration. Contains a specific date and a named government agency (FTC), but only one QV-eligible hard fact (the date), so Firm-Specific.

thinking:
Classifying this paragraph about Marriott's resolution with FTC and AG Offices regarding a Data Security Incident.

Content: Describes regulatory resolutions (FTC, AG Offices) related to a past data security incident, with ongoing requirements for privacy/security programs.

Category: This is about the resolution/outcome of an incident - regulatory consequences. It's not describing what happened (Incident Disclosure narrative), but rather the regulatory/business consequence. This feels like Strategy Integration - business impact of a cyber incident. But it also has elements of incident disclosure (referencing the incident) and regulatory compliance.

The paragraph describes regulatory resolutions - final outcomes with FTC and AG Offices.

The core issue is whether this is about the regulatory consequence of an incident or the incident response process itself. The tiebreaker is clear: since the paragraph focuses on the business/regulatory outcome without describing the actual incident, this is Strategy Integration rather than Risk Management Process.

Now I'm checking the specificity of the facts mentioned. The "2024 fourth quarter" timing is a concrete date, and the FTC involvement is a named regulatory body—both are firm-specific verifiable facts that would support a higher confidence rating.

fact: 2024 fourth quarter

fact: FTC


reasoning: The paragraph's primary subject is a management-level committee (DPCSC) — its name, composition, meeting cadence, and oversight responsibility. While it mentions policies and an incident response plan, these are subordinate to the committee description. Management Role covers 'management committees responsible for cybersecurity.' The DPCSC is a named committee with a unique identifier, the department composition is specific, and CTO is a cybersecurity-specific title on the IS list — all firm-specific facts, but none are QV-eligible (no dates, dollar amounts, headcounts, named firms, or named tools), so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes a management-level committee (DPCSC), its composition, meeting cadence, and responsibilities including oversight of policies and an incident response plan.

Category: This is about a management committee structure. The DPCSC is a management-level committee. It describes who's on it, what it does, and mentions an IR plan. The primary subject is the committee and its role. This feels like Management Role (management committee responsible for cybersecurity) or Risk Management Process.

The person-vs-function test: The paragraph describes what the committee does - oversees policies and procedures, including an IR plan. But the primary content is about the committee's composition and structure, not the processes themselves.

The committee is definitely the main subject here, and it's a management-level one. Reading through again, the paragraph opens with the DPCSC's structure—its name, who sits on it, how often it meets—then moves into its responsibilities around policies and procedures, with the incident response plan being a supporting detail. The dominant focus is on the committee itself, its makeup, and its oversight role, which aligns with Management Role.

Looking at the specifics: the DPCSC is a named internal program with a unique identifier, the department composition is detailed and specific, and the CTO is a named role that appears on the IS list. None of these facts qualify as QV-eligible though—no dates, dollar amounts, third-party vendors, tools, headcounts, or certifications. So this lands as Firm-Specific (3) with multiple IS facts but nothing that reaches the QV threshold.

fact: Data Protection & Cybersecurity Steering Committee ("DPCSC")

fact: Representatives from communications, ethics and compliance, human resources, information technology, corporate audit, legal, risk, privacy, and sourcing

fact: Chief Technology Officer


reasoning: The paragraph contains an explicit materiality assessment ('not aware of any risks from cybersecurity threats... that have materially affected or are reasonably likely to materially affect us, including our overall business strategy, results of operations, or financial condition'), making it Strategy Integration per Rule 6. The appended cross-reference to Risk Factors does not change the classification. No specific facts from the IS list are present — the company name is a self-reference and the boilerplate materiality language is generic.

thinking: Materiality assessment paragraph with cross-reference.


reasoning: The paragraph's primary content is about the person filling the CISO/CIO role — their dual title, years of experience, and certification credentials. While the latter portion describes functions they oversee, the paragraph's communicative purpose is establishing this person's qualifications and expertise. Two QV-eligible hard facts: specific years of experience (25 years) and a named certification (CCISO).

thinking:
Let me analyze this paragraph.

The paragraph is about the CISO/CIO - their responsibilities, experience, certifications, and what they oversee. The primary content is about the person - their dual role, experience (25 years), certifications (CCISO), and expertise. There's also description of what they do (oversees programs, monitors threats, etc.), but the dominant focus is on who this person is and their qualifications.

Person-vs-function test: The paragraph spends significant text on the person's credentials (25 years experience, CCISO certification, dual CISO/CIO role). But it also describes functions. The balance tips toward Management Role since the credentials and qualifications are prominent.

Now I'm checking what makes this verifiable. The 25 years of experience is a specific number I can point to, and the CCISO certification is a named credential - those are my two hard facts that make this Quantified-Verifiable.

fact: CISO who also serves as CIO (dual cybersecurity-specific role)

fact: Over 25 years of experience in information security

fact: Certified Chief Information Security Officer (CCISO) certification


reasoning: The paragraph makes an explicit materiality assessment ('not had a major cyber incident... nor experienced significant data loss or any material financial losses related to cybersecurity attacks'), which per Rule 6 classifies it as Strategy Integration despite the appended cross-reference to Risk Factors. No named frameworks, firm-specific facts, or hard verifiable details are present — the language is boilerplate materiality disclaimer.

thinking: Materiality assessment + cross-reference. The paragraph makes a substantive claim about no major incidents/material losses, then points to Risk Factors.


reasoning: The paragraph describes the company's framework adoption for identifying, assessing, and managing cybersecurity risks — core Risk Management Process content. It names multiple recognized standards (CRI Profile/NIST CSF, FFIEC Handbook, PCI DSS), which trigger Sector-Adapted, but contains no firm-specific facts from the IS list (no named roles, dates, tools, headcounts, or other company-unique details) and the disclaimer further undercuts any specificity beyond naming the standards.

thinking:
Let me analyze this paragraph.

Content: Describes frameworks used to guide their cybersecurity risk management program - CRI Profile (based on NIST CSF), FFIEC IT Examination Handbook, and PCI DSS. Then a disclaimer that this doesn't imply meeting any standards.

Category: Risk Management Process - describes framework adoption and risk management methodology.

Specificity: Names multiple recognized standards/frameworks: CRI Profile (based on NIST CSF), FFIEC IT Examination Handbook, PCI DSS.

The CRI Profile is a named framework. NIST CSF is named. FFIEC IT Examination Handbook is named.

PCI DSS is named. These are all recognized standards → at least Sector-Adapted.

Is there anything firm-specific? The CRI Profile is a specific framework choice - but it's still a named standard, not unique to this company. No firm-specific facts from the IS list. No cybersecurity-specific titles, no named committees, no dates, no tools, no third-party firms, no headcounts.

Decision: Sector-Adapted (names multiple recognized standards but nothing unique to THIS company).

fact: Cyber Risk Institute Profile (based on NIST CSF)

fact: Federal Financial Institutions Examination Council Information Technology Examination Handbook

fact: Payment Card Industry Data Security Standards


reasoning: The entire paragraph is about the CISO as a person — their years of experience, prior roles (head of cybersecurity at a global public company, US government positions), education, and certifications. This is squarely Management Role under the person-vs-function test. QV is met with 20+ years of experience (specific number) plus named certifications (NSTISSI No. 4011, CNSSI No. 4014) providing at least two hard verifiable facts.

thinking:
Let me analyze this paragraph.

Content: About the CISO - their experience (20+ years), prior roles, education, certifications. This is clearly about the person, not the function.

Category: Management Role

Specificity: Let me count QV-eligible facts:
- "over 20 years of experience" - specific number ✓
- NSTISSI No. 4011 certification - named certification ✓
- CNSSI No. 4014 certification - named certification ✓
- undergraduate and graduate degrees in computer information systems and computer science

That's at least 2 hard verifiable facts → Quantified-Verifiable

fact: CISO (cybersecurity-specific title)

fact: over 20 years of experience in information security

fact: Information Systems Security Professional (NSTISSI No. 4011) certification

fact: Information Systems Security Officer (CNSSI No. 4014) certification


reasoning: The paragraph contains an explicit materiality assessment ('not aware of having experienced any cybersecurity threats or incidents that have materially affected... its business strategy, results of operation or financial condition'), which per Rule 6 is Strategy Integration regardless of the appended cross-reference to Risk Factors and forward-looking disclaimer. No firm-specific facts beyond company self-references, which are on the NOT list.

thinking:
Let me analyze this paragraph.

Content: Materiality assessment + cross-reference to Risk Factors + forward-looking disclaimer.

The paragraph contains an explicit materiality assessment: "Mattel is not aware of having experienced any cybersecurity threats or incidents to date that have materially affected or are reasonably likely to materially affect Mattel, its business strategy, results of operation or financial condition." Per Rule 6, this is Strategy Integration.

Specificity: No named frameworks, no firm-specific facts from the IS list. Company self-references don't count. This is boilerplate materiality language. → Generic Boilerplate.


reasoning: The Audit Committee is the grammatical subject of oversight, and the CTO's reporting relationship is framed as part of board-level oversight structure. The CTO is a cybersecurity-specific title on the IS list, making this Firm-Specific, but there is only one qualifying fact (no second hard verifiable fact for QV).

thinking:
Let me analyze this paragraph.

Content: The Audit Committee oversees cybersecurity risks. The CTO reports to the Audit Committee. The CTO escalates incidents.

Category: The Audit Committee is the primary subject of oversight, and the CTO's reporting TO the committee is described. The frame is board oversight. → Board Governance

Specific facts:
- CTO (cybersecurity-specific title on the IS list) → Firm-Specific
- "Audit Committee" is on the NOT list (generic)
- "at least annually" is generic cadence

So one IS fact (CTO). That's Firm-Specific (3).

The CTO is the only verifiable fact here, and it doesn't meet the threshold for QV since I need at least two hard verifiable facts.

fact: CTO reports to the Audit Committee on cybersecurity


reasoning: The paragraph describes the company's internal cybersecurity risk management processes and their integration into the overall ERM framework, with department leaders assessing risks — this is squarely Risk Management Process. No named frameworks, cybersecurity-specific roles, dates, tools, or other facts from the IS list are present; 'ERM' is a generic program name and 'department leaders' is generic, so this is Generic Boilerplate.

thinking:
Let me classify this paragraph.

Content: Describes cybersecurity risk management processes integrated into ERM, department leaders assessing risks, and acknowledges evolving threats.

Category: Risk Management Process - describes internal processes (ERM integration, risk assessment by department leaders).

Specificity: Let me check for specific facts.
- "Enterprise Risk Management ('ERM')" - generic program name, on the NOT list
- "department leaders" - generic
- No named frameworks, no named roles from IS list, no dates, no numbers, no named tools

No named standards either (no NIST, ISO, etc.).

→ Generic Boilerplate (1)


content_category: Third-Party Risk

reasoning: The paragraph's central topic is oversight of third-party service providers — vendor risk assessment, cybersecurity due diligence, and contractual security requirements imposed on vendors. This makes Third-Party Risk the dominant category. No named frameworks, specific roles, dates, tools, or other IS-list facts are present; 'at least annually' is a generic cadence.

thinking:
Classify this paragraph about vendor risk management.

Content: Central topic is vendor/third-party risk oversight - due diligence, contractual requirements, assessments. → Third-Party Risk

Specificity: No named frameworks, no named roles, no specific dates, no numbers. "at least annually" is generic cadence. No IS-list facts. → Generic Boilerplate


reasoning: The paragraph's primary subject is the Risk Committee — a management-level executive body — describing its composition, oversight responsibilities over the CISO and GIS teams, meeting cadence, and reporting relationship to the Audit Committee. This is management structure and roles, not board governance (the Audit Committee is mentioned only as a recipient of reports). Multiple IS-list facts (Risk Committee as a named non-generic committee, CISO, specific departmental composition) establish Firm-Specific, but no two QV-eligible hard facts (no dates, dollar amounts, headcounts, named third-party firms, or named tools) are present.

thinking:
Let me analyze this paragraph.

Content: Describes the Risk Committee composition, its role as executive oversight for risk management including cybersecurity, meeting cadence, and reporting to Audit Committee.

Category: This is about a management-level committee (Risk Committee) that oversees cybersecurity. The grammatical subject is the Risk Committee - an executive oversight body. This is Management Role since it's about management structure and oversight, not the board. The Risk Committee reports up to the Audit Committee (board level). The paragraph describes who sits on the committee, what it does, how often it meets.

Actually, let me reconsider. The Risk Committee is an executive committee (CFO, COO, General Counsel, Divisional Presidents). It's management-level oversight. The paragraph describes the committee's composition, meeting cadence, and responsibilities.

The Risk Committee serves as the primary management body for cybersecurity oversight, with specific named roles like the Divisional Presidents of CRH Americas and CRH International, making this clearly a Management Role category. I'm checking whether the specific team compositions and named positions qualify as a list, and they do—the Divisional Presidents are explicitly identified by their divisions.

Now I'm verifying whether this contains any hard facts like dates, dollar amounts, or certifications that would make it QV-eligible, but there aren't any. With multiple IS-list facts present, this falls under Firm-Specific.

fact: Risk Committee (named non-generic executive committee)

fact: CISO

fact: Committee composed of CFO, Group General Counsel, COO, Divisional Presidents of CRH Americas and CRH International

fact: GIS (named internal team)

fact: Head of ERM (named role)


reasoning: The paragraph primarily describes an actual cybersecurity incident — its timing (November 2023), nature (operational disruption, exfiltration of employee and patient data), financial consequences (significant remediation costs, lost revenues), and detailed remediation actions taken afterward (enhanced SOC visibility, new detection tools, expanded vulnerability management, AI-based protections). While it touches on Strategy Integration (costs/revenues) and Risk Management Process (post-incident improvements), the dominant communicative purpose is narrating what happened and how the company responded, which fits Incident Disclosure. Only one QV-eligible hard fact (November 2023) is present — no named firms, tools, or dollar amounts — so specificity is Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes a specific cybersecurity incident in November 2023, its impact (disruption, data exfiltration), costs, and remediation actions taken afterward. Also mentions ongoing risks.

Category: This is primarily about an actual incident - what happened, when, impact, and response/remediation actions. The paragraph describes the incident narrative and the remediation steps taken. While there's some forward-looking risk language at the end, the dominant content is incident description and response.

Wait - let me reconsider. The paragraph starts with the incident but then spends most of its text on remediation changes (enhanced SOC visibility, training, detection tools, vulnerability management, AI technologies).

The incident is referenced, but the bulk is about changes implemented post-incident (remediation actions) and ongoing risk. Since remediation actions taken in response to an incident are part of Incident Disclosure per the codebook - which includes incident narrative, incident response actions, and descriptions of affected data/systems scope or operational impact - this falls under Incident Disclosure.

Looking at specificity: "November 2023" gives us a specific date with month and year, which qualifies for QV eligibility. "Security Operations Center" is a generic term rather than a named product. The incident itself is capitalized as "Cybersecurity Incident"

—their specific incident name. There are no named third-party firms, tools, dollar amounts, or headcounts mentioned.

So I have one hard verifiable fact: the specific date "November 2023." That's not enough to reach QV threshold, making this Firm-Specific.

fact: November 2023 (specific date of the Cybersecurity Incident)


reasoning: The paragraph describes cybersecurity teams' activities—prevention, detection, mitigation, remediation, threat intelligence, risk management strategy reviews—all internal process descriptions. Although 'senior executive team' and 'cybersecurity teams' are the grammatical subjects, the person-vs-function test shows the content is about what the program does, not who the people are (no names, credentials, reporting lines, or backgrounds). No named frameworks, tools, firms, specific roles (CISO/CIO/CTO), dates, or numbers appear; 'appropriate professional certifications' is vague and unnamed, and third parties are generic ('specialists, consultants, auditors').

thinking:
Let me analyze this paragraph.

Content: Describes senior executive team responsibility, cybersecurity teams with certifications, their activities (prevention, detection, mitigation, remediation), technologies, threat intelligence, risk management strategies, and engagement of third parties.

Category: The paragraph starts with "senior executive team" and "cybersecurity teams" but describes what they DO - processes, activities, technologies. The person-vs-function test: remove the role attributions and the paragraph still describes processes. This is Risk Management Process.

Specificity: Let me check for specific facts:
- "senior executive team" - generic
- "appropriate professional certifications" - unnamed, vague

- "cybersecurity teams" - generic
- No named frameworks, no named tools, no named roles (CISO etc.), no dates, no numbers
- "specialists, consultants, auditors" - unnamed
- No named standards

Everything here is vague and unspecified—no actual frameworks, tools, roles, or standards are mentioned. This is Generic Boilerplate.


reasoning: The paragraph describes the CISO's reporting line to the Risk Committee and then focuses on the person's qualifications — years of experience (25+), tenure at the company (23 years), and certifications. This is about who the person is, not what the program does, making it Management Role. Two QV-eligible hard facts (specific years of experience and specific tenure) reach the Quantified-Verifiable threshold.

thinking:
Let me analyze this paragraph.

Content: The CISO reports to Risk Committee, and then describes the CISO's experience (25 years, 23 years at WSFS) and certifications.

Category: The paragraph is about the CISO - their reporting line and their qualifications/experience. This is Management Role. The person-vs-function test: the paragraph is about who the CISO is (experience, tenure, certifications), not about what the program does.

Specificity: Let me count facts.
- CISO (cybersecurity-specific title) → IS list
- Risk Committee (named non-generic committee) → IS list

- The experience metrics are concrete: 25 years total and 23 years at WSFS are both quantified and verifiable, while the mention of certifications lacks specificity. This gives me two hard facts that meet the Quantified-Verifiable standard.

fact: Risk Committee

fact: more than 25 years of experience in information security

fact: 23 years at WSFS


reasoning: Paragraph primarily describes the company's internal cybersecurity processes (risk assessments, monitoring, exercises, training) with CIO/CISO mentioned as program attribution rather than as the primary subject. Two cybersecurity-specific role titles (CIO, CISO) place this at Firm-Specific but no QV-eligible hard facts are present.

thinking:
Let me analyze this paragraph from CNH Industrial's 10-K filing.

The paragraph covers multiple topics: ERM integration, Audit Committee oversight, CIO and CISO roles, and what the cybersecurity program does (risk assessments, tools, exercises, training).

Category: The paragraph starts by describing the program structure, mentions board oversight briefly, names the CIO and CISO, then spends most of the text describing what the CISO's organization does - monitoring, managing, assessing risk, and the strategy (risk assessments, tools, exercises, training). The dominant content is about the company's internal cybersecurity processes. The CISO/CIO are mentioned as attribution. Applying the person-vs-function test: remove the role titles and the paragraph still describes the program. → Risk Management Process.

Now checking specificity: The CIO and CISO are both cybersecurity-specific titles that belong on the IS list, while the Audit Committee is too generic. The "Cybersecurity Program" itself is just a generic descriptor, not a named program, but the "Information Technology Security and Compliance organization" appears to be a specific team name. For the QV check, the named roles don't contribute to quantitative value since there are no dates, dollar amounts, or headcount mentioned.

fact: Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

fact: Information Technology Security and Compliance organization ('Cybersecurity Program')


reasoning: The paragraph describes TIAA's enterprise cybersecurity program including risk assessments, security measures, ongoing monitoring, and use of internal/external experts — all internal process descriptions pointing to Risk Management Process. No named frameworks, no cybersecurity-specific roles from the IS list, no dates, numbers, or named firms; 'TIAA' is a company self-reference, and 'cybersecurity assessors, consultants, and auditors' are unnamed entities, leaving no specific facts after filtering.

thinking:
Let me analyze this paragraph.

Content: Describes TIAA's enterprise cybersecurity program - risk assessments, security measures, monitoring, use of internal/external experts. This is about internal processes.

Category: Risk Management Process - describes the company's internal cybersecurity processes, methodology, monitoring, ERM integration.

Specificity: Let me check for specific facts.
- "TIAA" - company self-reference → NOT list
- "enterprise cybersecurity program" - generic program name → NOT list
- "risk assessments", "security measures", "ongoing monitoring" - common practices → NOT list
- "cybersecurity assessors, consultants, and auditors" - unnamed entities → NOT list

- No named frameworks, standards, roles from the IS list, dates, or numbers → Generic Boilerplate (1)


reasoning: The paragraph describes an actual cybersecurity attack — its date, scope, response actions, investigation, and outcome — making it clearly Incident Disclosure. It contains one hard verifiable date (January 31, 2022) and a firm-specific system reference (Aurora acquisition), but the forensics firm is unnamed and '2024' is only a year (not month+year), so it falls short of two QV-eligible facts, landing at Firm-Specific.

thinking:
Let me classify this paragraph.

Content: Describes a specific cybersecurity incident - date, what happened, response actions, investigation, outcome.

Category: Incident Disclosure - clearly describes an actual cybersecurity event with timeline, scope, response.

Specific facts:
- "January 31, 2022" - specific date
- "Aurora acquisition" - named system/context (this is firm-specific but not a QV-eligible fact - it's a company-specific reference)
- "2024" - specific date for completion
- "outside cybersecurity forensics firm" - unnamed, so NOT specific

QV check: "January 31, 2022" is a specific date (QV-eligible). "2024" is a year but somewhat vague (just a year). Let me think... "completed in 2024" - that's a specific year.

The codebook treats specific dates as verifiable facts, but a year alone like "2024" is less precise than a full date. Looking at the calibration examples, "December 2023" counts as one firm-specific fact, whereas "January 31, 2022" is clearly QV-eligible. The Aurora acquisition reference is firm-specific context but doesn't qualify as a verifiable fact on its own. So I'm looking at one solid verifiable date and some firm-specific context, which puts this in the Firm-Specific category with at least one specific fact, though it's borderline whether it reaches QV threshold. Looking at the forensics firm detail, that's firm-specific information rather than a verifiable fact with a concrete date.

fact: January 31, 2022

fact: Aurora acquisition systems

fact: completed integration in 2024


reasoning: The paragraph contains an explicit materiality assessment ('have not materially affected... business strategy, results of operations, or financial condition'), which per Rule 6 makes it Strategy Integration regardless of the appended cross-reference to Item 1A Risk Factors. No firm-specific facts are present — the risk factor title is generic boilerplate language, and the cross-reference is noise.

thinking: Materiality assessment + cross-reference. Per Rule 6, the materiality assessment makes this Strategy Integration.


reasoning: The paragraph describes the company's internal cybersecurity risk management processes, ERM integration, and framework approach — all hallmarks of Risk Management Process. It names NIST CSF as an informing standard but includes no firm-specific facts (no named roles, tools, dates, or quantified details), placing it at Sector-Adapted.

thinking:
Classify this paragraph.

Content: Describes internal processes for cybersecurity risk management, ERM integration, framework adoption informed by NIST CSF.

Category: Risk Management Process - describes internal processes, ERM integration, framework approach.

Specificity: Names NIST CSF framework → Sector-Adapted. No firm-specific facts from the IS list beyond that.

fact: Framework informed by NIST Cybersecurity Framework


reasoning: The paragraph describes the company's internal cybersecurity processes — risk-based approach, controls, security tools for identification and recovery. It names NIST CSF but provides no firm-specific details beyond that, making it Sector-Adapted.

fact: NIST Cybersecurity Framework


reasoning: The paragraph's dominant content is a narrative of an actual cybersecurity incident — the Change Healthcare breach — describing what happened (threat actor gained access to IT systems), operational impact on Bioventus (disrupted billing/collections, delayed claims submissions), and response actions (identified alternative claim processing intermediary). Materiality assessments bookend the narrative but are subordinate to the incident description, which occupies the majority of the text. Three QV-eligible hard verifiable facts are present: two named third-party firms (Change Healthcare, UnitedHealth Group) and one named product (EXOGEN device).

thinking:
Let me analyze this paragraph carefully.

The paragraph contains multiple elements:
1. A materiality assessment ("have not encountered any risks from cybersecurity threats that have materially affected...")
2. A description of an actual incident - the Change Healthcare incident
3. Impact on the company's operations (billing/collections disrupted, delays in claims)
4. Another materiality assessment specific to the Change Healthcare incident

This is a complex paragraph. Let me think about the dominant category.

The paragraph describes an actual cybersecurity incident (Change Healthcare) and its impact on Bioventus. It describes what happened, the operational disruption, the response (alternative claim processing intermediary), and then assesses materiality.

The key question is whether this is primarily an incident disclosure or a strategy discussion. The paragraph does describe what happened - a threat actor gained access to Change Healthcare's systems, which disrupted Bioventus's billing and claims processing. Even though it includes materiality assessments, the core content is describing the incident and its operational impact on the company. The incident narrative clearly dominates the paragraph—the Change Healthcare breach details and operational impact take up most of the space, while the materiality assessments just frame it at the beginning and end. So Incident Disclosure is the right call here, since the paragraph is fundamentally describing what happened and how it affected Bioventus's claims processing.

For the specificity check, I've got solid verifiable facts: Change Healthcare as a named third-party firm, UnitedHealth Group as the parent company, and EXOGEN as the named product. That's enough concrete detail to qualify this as Quantified-Verifiable.

fact: Change Healthcare named as third-party intermediary involved in the incident

fact: UnitedHealth Group named as parent company of Change Healthcare

fact: EXOGEN device named as product whose claims were affected


reasoning: The paragraph is framed by the Board of Directors' oversight of cybersecurity risk (sentences 1, 4, 5), with Management Role content about the IT Director's qualifications nested within. The Board sets the overarching frame and is the primary actor across the majority of sentences, making Board Governance the dominant category per the dual-category rule. Specificity is Firm-Specific: the IT Director title is a cybersecurity-specific role, and the Risk Management Committee is a non-generic committee, but only one QV-eligible hard fact (30 years) prevents reaching Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics:
1. Board oversight of risk management including cybersecurity
2. IT Director role, reporting line, qualifications
3. Risk Management Committee and Board discussions
4. KPIs for cybersecurity
5. Risk-based approach to cybersecurity

Let me determine the dominant category. The paragraph starts with the Board, then shifts to the IT Director (management role with qualifications), then back to Board/committee oversight, then KPIs.

The person-vs-function test: There's substantial content about the IT Director's qualifications (certifications, 30 years experience, tenure). But there's also substantial board governance content.

Looking at the distribution across sentences, the Board and its committees appear as the primary subject in about half the content, while the IT Director's role and qualifications take up the other half. The Board frames the opening and closing, but the management role details are equally prominent. This is fundamentally a mixed paragraph where both Board governance and management role content carry significant weight.

Comparing this to the dual-category example in the codebook, where board oversight framed the entire discussion, here the balance feels more even. The Board sets the initial frame, but then substantial space is devoted to describing the IT Director's qualifications and reporting structure before returning to board activities. Given how much real estate the management role occupies, I'm reconsidering whether Board Governance truly dominates, or if this should be classified differently based on the actual emphasis in the text.

Now I'm identifying the specific facts that qualify for coding. The IT Director title is a named role, the Risk Management Committee is a named committee, and the 30+ years of experience is a quantified metric. The university certifications are mentioned but lack specificity—no named institutions or credential types like CISSP or CISM, so they don't meet the threshold for QV eligibility.

With only one qualifying quantified fact and multiple IS-eligible facts present, this profile should be coded as Firm-Specific rather than QV.

fact: Executive Director of Information and Technology Services (IT Director)

fact: Risk Management Committee

fact: over 30 years' experience in cybersecurity and technology roles


reasoning: The paragraph establishes the governance chain from the board of directors through the Audit Committee down to the external Manager and ORIX USA team, framing overall risk oversight with the board as the primary subject and starting point. The cybersecurity-specific content about the Manager and ORIX USA CTO is subordinate to this governance structure. Named firm (ORIX USA), named team, and cybersecurity-specific title (CTO) make it Firm-Specific; only one QV-eligible fact (named firm) so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes board oversight (board of directors, audit committee) and then transitions to management/external manager responsibility. Let me determine the dominant category.

Content: Board directs risk management, Audit Committee oversees financial risk exposures, compliance, internal audit. Then the Manager (external) is responsible for cybersecurity threats, relying on ORIX USA and its IT/Cybersecurity Team including the CTO.

The paragraph starts with board oversight broadly, then narrows to the Audit Committee's role, then shifts to the Manager's cybersecurity responsibilities and the ORIX USA team/CTO. It's a mix of Board Governance and Management Role/Risk Management Process.

The structure splits fairly evenly between board governance in the opening sentences and the manager's cybersecurity responsibilities in the latter half, with the board serving as the grammatical subject for most of the text. The cybersecurity-specific details emerge in the final sentences about the Manager and ORIX USA's role. Looking at the specificity here—ORIX USA is a named firm that qualifies for QV eligibility, while the CTO title is cybersecurity-specific but not QV-eligible. That gives me one QV-eligible fact, which means this falls into the Firm-Specific category.

fact: ORIX USA

fact: ORIX USA Information Technology and Cybersecurity Team

fact: Chief Technology Officer (CTO)


reasoning: The CISO is mentioned as attribution for who leads the team, but the paragraph's substantive content describes the company's cybersecurity processes: cross-functional approach, training, audits by internal audit team, and third-party engagement. Removing the CISO reference, the paragraph still functions as a process description. The CISO title is the sole IS-list fact, reaching Firm-Specific but not QV.

thinking:
Let me analyze this paragraph.

Content: Describes IT security team led by CISO, cross-functional approach, training, audits, and third-party engagement.

Category: The paragraph starts by naming the CISO but then describes what the program does - cross-functional approach, training, reviews, tests, audits, third-party engagement. Applying the person-vs-function test: remove "led by our chief information security officer" and the paragraph still describes the program's processes. This is Risk Management Process.

Specificity:
- "chief information security officer" - CISO is on the IS list → Firm-Specific

- "internal audit team" and "consultants or other third parties" are generic references without names, and there are no frameworks, dates, amounts, or specific tools mentioned. With just the one IS-list item, this stays Firm-Specific.

fact: chief information security officer (CISO)


reasoning: The paragraph describes the company's internal cybersecurity program structure and what each functional area does (GRC, Security Operations, Security Engineering, Product Security, Enterprise Resiliency). While it names the GISO team, the content is overwhelmingly about processes and functions — not about individual people's credentials — making it Risk Management Process per the person-vs-function test. The named internal program 'Global Information Security Office (GISO)' with its unique abbreviation qualifies as a firm-specific fact, but it is the only IS-list fact, so specificity is Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the Global Information Security Office (GISO) team structure and their areas of expertise/responsibility. It details what each sub-team does (GRC, Security Operations, Security Engineering, Product Security, Enterprise Resiliency).

Category: This is about the company's internal cybersecurity processes and team structure. The GISO is named as implementing the program, and then it describes what each functional area does. This is primarily about the function/processes, not about individual people's credentials. → Risk Management Process

Specific facts:
- "Global Information Security Office (GISO)" — named internal program with unique identifier ✓ IS

- The sub-teams themselves are functional areas rather than specific facts, and the practices mentioned like monitoring and penetration testing are standard industry approaches, not unique to this firm. Only GISO qualifies as a firm-specific fact, so this doesn't meet the threshold for QV.


reasoning: The paragraph's primary communicative purpose is describing WHO manages cybersecurity (CEO), their experience ('significant prior business experience in compliance and risk management'), reporting/coordination structure (VP of Finance, senior leadership team, SOC consultant), making it about the person and management structure rather than processes. However, CEO is generic C-suite per the NOT list, VP of Finance is not a cybersecurity-specific title, the SOC consultant is unnamed, and no named frameworks, dates, tools, or specific numbers appear — all facts fail the IS-list filter, yielding Generic Boilerplate.

thinking:
Let me analyze this paragraph.

Content: The paragraph describes the CEO's role in cybersecurity oversight, their experience, and how they coordinate with a SOC consultant and keep leadership informed.

Category: This is about management's role in cybersecurity. The CEO is the grammatical subject performing actions. It describes the person's responsibilities, reporting structure, and background. But let me apply the person-vs-function test: if I remove the CEO reference, the paragraph describes operational oversight, working across departments, risk assessments - but actually, the paragraph is centered on WHO does what (CEO leads, CEO keeps leadership apprised, CEO has experience, CEO coordinates). The primary content is about the management structure and the CEO's role.

Now I'm reconsidering the categorization. The CEO appears on the exclusion list as a generic C-suite title, and the Vice President of Finance mentioned is also too generic and not cybersecurity-specific. So despite the paragraph focusing on management responsibilities, the people involved don't meet the specificity threshold. This means I should look for what specific cybersecurity facts or functions are actually described here, rather than categorizing it as a management role. The CEO is actually filling a cybersecurity leadership function here, even though it's not their primary title—but that's still describing the person rather than the process itself. The paragraph focuses on who's responsible and their background, not how risk management actually works, so this is Management Role. I'm fairly confident it's Management Role at around 0.7, though Risk Management Process is a possibility. The specificity is clearly Generic Boilerplate—no named frameworks, no dates, no concrete details, just standard corporate language about experience and oversight.


reasoning: The paragraph describes the company's internal cybersecurity risk management program and its integration into the ERM framework, listing activities such as risk assessments, personnel training, vulnerability scanning, and security control evaluation. Third-party oversight is mentioned as one bullet among seven, making Risk Management Process the dominant category. No named frameworks, roles, tools, dates, or other specific facts from the IS list are present — all activities described are generic practices applicable to any company.

thinking:
Let me analyze this paragraph from Spruce Power Holding Corp's 10-K filing, Item 1C.

The paragraph describes the company's cybersecurity risk management program integrated into ERM. It lists various activities: cybersecurity policy, risk assessments, training, risk analysis, third-party oversight, security controls, vulnerability scanning.

Content Category: Risk Management Process - describes internal processes, methodologies, ERM integration. Third-party risk is mentioned as one bullet among many, so it's a component of the internal program, not the central topic.

Specificity: Let me check for specific facts:
- No named frameworks (NIST, ISO, etc.)

- No named roles (CISO, CIO, etc.)
- No dates, numbers, named tools, named firms
- "ERM" is mentioned but that's generic
- The activities listed are all common practices (assessments, training, vulnerability scanning)
- No firm-specific facts from the IS list

This is Generic Boilerplate (1).


reasoning: The paragraph's framing and primary communicative purpose is board-level oversight: the Audit Committee oversees cybersecurity, and the Board/Audit Committee receives updates from the FRS Committee. While the FRS Committee composition and leader qualifications are detailed, these serve the governance narrative (who reports to the board and how). Per the borderline Case 5 pattern, when board oversight is the frame and management details are subordinate, assign Board Governance. Specificity is Firm-Specific due to the named FRS Committee (non-generic) and SVP of IT role, but no two QV-eligible hard facts (no dates, dollar amounts, headcounts, named firms, or named certifications).

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics - board oversight, a named committee (FRS Committee), and management roles. Let me determine the dominant category.

The paragraph starts with board-level oversight and Audit Committee, then describes the FRS Committee's role, its composition, and then describes the SVP of IT and CLO's experience.

Let me apply the decision rules:

- The first sentence: Board/Audit Committee oversight → Board Governance
- Second sentence: Audit Committee and Board receive updates from FRS Committee → Board Governance (board is receiving)
- Third sentence: FRS Committee composition → This is about management structure

- Fourth sentence: SVP of IT and CLO lead processes, their experience → Management Role

The paragraph opens with board oversight framing, but the bulk of the content focuses on the FRS Committee structure and the qualifications of its leadership. While the board provides the initial context, the paragraph really centers on describing this management committee and the experience of the executives running it.

Looking at the breakdown: the first two sentences establish board governance and Audit Committee oversight, but sentences three and four shift to detailing the FRS Committee's composition and the SVP of IT and CLO's qualifications. The board is the framing device, but the FRS Committee—a management entity—is what's actually being described. Since the paragraph's primary purpose is explaining the oversight structure where the board receives updates from this management committee, I'd categorize this as board governance overall. The management details are supporting information within that governance framework.

For specificity, I'm identifying firm-specific facts: the FRS Committee is a named, non-generic committee, and the SVP of IT aligns with the IS-list criteria. The Chief Legal Officer is generic C-suite, so that doesn't count. The Finance, Risk and Sustainability composition is specific to this firm. I don't see any quantifiable facts like dates, dollar amounts, or headcounts that would qualify for QV eligibility.

fact: FRS (Finance, Risk and Sustainability) Committee

fact: Senior Vice President of IT

fact: Committee comprised of CFO, Chief Legal Officer, COO, SVP of IT, and VP of Corporate Development


reasoning: The paragraph assesses the business impact of cybersecurity by explicitly stating no incidents have resulted in operational interruptions or system breaches — functionally a materiality/impact assessment, placing it in Strategy Integration. The specific fiscal year-end date (December 31, 2024) is one verifiable fact, reaching Firm-Specific but not Quantified-Verifiable.

thinking:
Classify this paragraph.

The paragraph states the company has not experienced any cybersecurity incidents. This is a materiality/impact assessment - stating no incidents have materially affected operations.

Wait - is this Strategy Integration or None/Other? Let me think. It's making a claim about incident history - no incidents resulted in interruptions or breaches. This is an explicit assessment that cyber incidents have not affected the business. Per Rule 6 and the codebook, materiality assessments → Strategy Integration. This is essentially saying "no incidents have affected our business operations."

Actually, let me reconsider. This doesn't use the "materially affected" language exactly. It says no incidents resulted in "interruptions to normal business operations or breaches of systems." This is more of a factual claim about incident history rather than a materiality assessment per se.

But it's still fundamentally assessing business impact from cybersecurity incidents. The example "We have not identified any cybersecurity incidents or threats that have materially affected us" maps directly to Strategy Integration, and this statement follows the same pattern - claiming no incidents have impacted operations. For specificity, the date "December 31, 2024" is a concrete fact, making this Firm-Specific, though there's only one verifiable detail so it doesn't reach Quantified.

fact: year ended December 31, 2024


reasoning: The paragraph primarily describes how cybersecurity risks are assessed and managed within the company's enterprise risk management processes — the Steering Committee's function, its evaluation of material risks, and its reporting of a risk register. While the Audit Committee and board are mentioned, they appear in a subordinate reporting-chain role; the central topic is the internal ERM process. The named 'Enterprise Risk Management Steering Committee' with its unique identifier qualifies as a firm-specific fact (named non-generic committee), but no second hard verifiable fact exists to reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes risk management processes integrated into ERM, mentions an Enterprise Risk Management Steering Committee ("Steering Committee"), led by CCO, meets quarterly, provides risk register to Audit Committee.

Category: This is about the company's internal risk management processes - ERM integration, how they assess and manage cyber risks. The Steering Committee is described in terms of what it does (process), not who the people are. The Audit Committee mention is subordinate. → Risk Management Process

Specificity: Let me check facts:
- "Enterprise Risk Management Steering Committee" with abbreviation "Steering Committee" - this is a named internal program/committee with a unique identifier

- The CCO leadership, quarterly cadence, and Audit Committee reporting are all standard governance structures without distinguishing details
- No specific dates, dollar amounts, headcounts, or named third-party vendors
- The one concrete element is the named committee itself, which appears on the IS list as ERM Committee → Firm-Specific


reasoning: The paragraph names CTO and CISO as attribution for who leads the team, but the substantive content describes internal processes: testing IT controls, vulnerability assessments, and penetration tests. Applying the person-vs-function test, removing the role titles leaves a coherent process description, making this Risk Management Process rather than Management Role.

thinking:
Let me analyze this paragraph.

Content: Describes a dedicated cybersecurity team led by CTO and supported by CISO, mentions testing IT controls, vulnerability assessments, and third-party penetration tests. This is about the company's internal cybersecurity processes and team structure.

Category: This is primarily about Risk Management Process. While CTO and CISO are mentioned, they're attributed as leaders of the program - the paragraph then describes what the program does (testing controls, vulnerability assessments, penetration tests). The person-vs-function test: remove the role titles and the paragraph still describes processes.

Specificity:
- CTO (cybersecurity-specific per IS list) ✓

- CISO (cybersecurity-specific per IS list) ✓
- "third-party penetration tests" - generic practice, not specific
- "vulnerability assessments" - generic practice

Both CTO and CISO are firm-specific titles on the IS list, but named roles don't qualify as QV-eligible facts. So I have firm-specific content but not the two QV facts needed. Specificity = Firm-Specific (3)

fact: Chief Technology Officer (CTO) directs cybersecurity team

fact: Chief Information Security Officer (CISO) supports cybersecurity team


reasoning: The CSO is mentioned once as attribution ('led by the CSO'), but the paragraph's substantive content describes the company's internal cybersecurity processes — proactive measures (access limitations, DLP, employee education) and reactive measures (logging, alerting, incident response). Removing the CSO reference leaves a complete process description, so this is Risk Management Process per the person-vs-function test. CSO is a cybersecurity-specific title on the IS list, yielding Firm-Specific, but no second hard verifiable fact exists to reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the cybersecurity team led by CSO, their strategy including proactive and reactive measures. The paragraph is about what the program does - processes, tools, controls. The CSO is mentioned as attribution but the bulk is about the program's activities.

Category: Risk Management Process. The CSO mention is incidental attribution. The paragraph describes internal processes (access limitations, DLP, logging, alerting, incident response). Person-vs-function test: remove "led by the CSO" and the paragraph still makes complete sense as a process description.

Specificity: CSO (Chief Security Officer) - this is a cybersecurity-specific title → Firm-Specific. No other hard verifiable facts (no dates, amounts, named tools, named firms). Just one IS-list fact.

This lands as Firm-Specific since the CSO reference is the only concrete identifier present.

fact: CSO (Chief Security Officer) leads the cybersecurity team


reasoning: The paragraph primarily describes an actual cybersecurity incident — what happened (unauthorized access/download of user data), when (October 2023), the affected platform (23andMe.com), and specific remediation actions taken (password resets, two-step verification, enhanced detection tools). The trailing materiality/risk language and cross-reference are subordinate to the incident narrative. Two QV-eligible hard facts: specific month/year and named platform.

thinking:
Let me analyze this paragraph.

Content: Describes a cybersecurity incident (October 2023, unauthorized access to user accounts on 23andMe.com), remediation actions taken, and a forward-looking risk statement with cross-reference.

Category: The dominant content is describing what happened in an incident and the response actions taken. This is Incident Disclosure.

Specificity:
- "October 2023" - specific date (month+year) → QV-eligible
- "23andMe.com" - named system/product → QV-eligible

That's two hard verifiable facts → Quantified-Verifiable.

fact: October 2023 — specific date of the cybersecurity incident

fact: 23andMe.com — named system/platform where unauthorized access occurred


reasoning: The paragraph describes the development of an internal policy and formation of a committee to manage cybersecurity incident materiality assessment and SEC disclosure procedures — these are internal processes for incident response and disclosure management. While materiality is mentioned, the paragraph describes the process/framework for making materiality determinations rather than making a materiality assessment itself, placing it in Risk Management Process. Multiple firm-specific facts (named policy with unique identifier, named non-generic committee, fiscal year) but only one QV-eligible fact (fiscal 2025), so Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes a Cybersecurity Incident Materiality Policy developed in fiscal 2025, and a Cyber Incident Disclosure Committee. The policy guides materiality decision-making, SEC reporting, disclosure controls, communication protocol to escalate to the Board, and supplements the IR plan. The committee includes key stakeholders to determine materiality.

Category: This is about internal processes - specifically incident response planning, materiality assessment procedures, and disclosure controls. The policy and committee are about how the company manages cybersecurity incident assessment internally. This is Risk Management Process - it describes internal processes for handling incidents (not an actual incident). The Board mention is brief (escalation protocol). The committee formed is about disclosure processes.

I'm reconsidering whether this leans more toward Strategy Integration given the focus on materiality assessments and business/financial impact, but the procedural nature of the policy and committee structure points back to Risk Management Process. The specificity around fiscal 2025 and the concrete mechanisms for determining materiality confirm this is about established internal procedures rather than strategic positioning.

For the QV eligibility assessment, I have the specific date from fiscal 2025 as one qualifying fact, but the named programs and committees don't count toward QV thresholds, leaving just that single date—making this Firm-Specific.

fact: fiscal 2025

fact: Cybersecurity Incident Materiality Policy (the "Policy")

fact: Cyber Incident Disclosure Committee


reasoning: The paragraph's primary content is about the CISO as a person — their reporting line to the CIO, their extensive personal credentials (CISSP, CEH, FINRA Series 99, OCP), and their team's qualifications. While board reporting and incident response procedures are mentioned, the CISO's identity and qualifications dominate. Multiple QV-eligible named certifications (CISSP, CEH, FINRA Series 99, OCP) easily exceed the two-fact threshold for Quantified-Verifiable.

thinking:
Let me analyze this paragraph carefully.

The paragraph covers multiple topics: CISO leadership, team credentials, CISO's own credentials, reporting to the board, and incident response procedures.

Primary content: The paragraph is heavily focused on the CISO - their reporting line, their team's qualifications, and especially their personal credentials (CISSP, CEH, FINRA Series 99, OCP). There's also reporting to the board and incident response mentioned.

Person-vs-function test: The paragraph names the CISO role, describes reporting line (to CIO), describes the CISO's personal credentials extensively. But it also describes what the program does (prevention, detection, mitigation, remediation) and incident response procedures.

The CISO's credentials dominate the content - I'm seeing the CISSP, CISM, CEH, and FINRA Series 99 certifications all listed out, along with the reporting structure to the CIO. This is clearly focused on the person holding the role rather than the function itself.

Looking at the additional certifications, the Oracle Cloud Certified Professional and the Sustainability and Risk Committee membership add more weight to the Management Role category. I count at least five QV-eligible certifications here - CISSP, CISM, CEH, FINRA Series 99, and OCP - which easily satisfies the 2+ QV facts threshold.

fact: CISO

fact: CIO

fact: CISSP certification held by CISO

fact: CEH certification held by CISO

fact: FINRA Series 99 license held by CISO

fact: Oracle Cloud Certified Professional (OCP) held by CISO

fact: CISM certification held by team members

fact: Sustainability and Risk Committee


reasoning: The paragraph's primary content describes a specific cybersecurity incident: a completed forensic investigation determined a threat actor gained unauthorized access during August 5-8, 2025 and may have acquired data. The trailing materiality language is secondary and itself inconclusive ('have not yet determined'). One QV-eligible hard fact (specific date range) yields Firm-Specific; no second hard fact (no named forensic firm, no dollar amounts, no headcounts) prevents Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes a completed forensic investigation of a specific incident (Aug 5-8, 2025), unauthorized access, data acquisition, and then discusses materiality assessment that's still pending, plus forward-looking risk language.

Category: The paragraph primarily describes what happened in an incident - forensic investigation complete, dates of access, threat actor gained access, data may have been acquired. Then it transitions to materiality assessment. The dominant content is the incident narrative (what happened, when, scope). The materiality portion is secondary - they say they haven't yet determined materiality. → Incident Disclosure.

Specificity:

The specific date range of August 5-8, 2025 is the only concrete fact that qualifies for QV eligibility, and since there's just one QV-eligible fact, this doesn't meet the QV threshold. The date itself makes this Firm-Specific though.

So: Incident Disclosure, Firm-Specific.

fact: August 5-8, 2025 — date range of unauthorized access