reasoning: The paragraph is primarily about who manages cybersecurity: the CTO's qualifications (25 years IT experience, 15 years security consulting) and the CIRC committee's composition. While one sentence describes the IT department's responsibilities, the dominant content is about the person and the management structure — passing the person-vs-function test for Management Role. Two QV-eligible hard facts (25 years experience + 15 years consulting) reach the Quantified-Verifiable threshold.

thinking:
Let me analyze this paragraph carefully.

The paragraph has three main parts:
1. CTO identification with credentials (25 years experience, 15 years security consulting)
2. CTO leads IT department responsible for cybersecurity
3. CIRC committee composition

The primary content is about WHO manages the program - the CTO's qualifications and the CIRC committee. The person-vs-function test: the paragraph tells us about the CTO (credentials, experience) and the committee composition. The middle sentence about what the IT department does is subordinate to establishing the CTO's role.

Category: Management Role - the paragraph is primarily about the person (CTO credentials) and the management committee (CIRC composition).

Now I'm identifying the specific verifiable facts: the CTO holds a cybersecurity-specific title, has over 25 years of professional experience and 15 years of security consulting experience—both quantified and verifiable. The CIRC is a named internal program, and I can see the specific team composition includes the CTO, CFO, General Counsel, SVP Financial Reporting, and VP Internal Audit. That gives me two hard verifiable facts tied to the experience numbers.

fact: Chief Technology Officer (CTO) manages information security program

fact: Over 25 years of professional experience in IT

fact: Cybersecurity Incident Response Committee (CIRC) — named internal program with unique identifier

fact: CIRC composed of CTO, CFO, General Counsel, SVP of Financial Reporting and Technical Accounting, VP of Internal Audit


content_category: Risk Management Process

category_confidence: high

specificity_confidence: high

reasoning: The paragraph describes the company's internal employee security training program, phishing awareness campaigns, and end-user testing — all internal cybersecurity processes. No named frameworks, cybersecurity-specific roles, specific dates, numbers, or named tools/firms are present. 'Cybersecurity Awareness eCourse' and 'Information Security policies' are generic program names without unique identifiers, and phishing simulations and security awareness training are on the NOT list as common practices.

provider: anthropic

generationId: agent-sdk

stage: benchmark

thinking:
Let me analyze this paragraph.

Content: Describes employee training program, phishing campaigns, cybersecurity awareness. This is about internal processes - Risk Management Process.

Specific facts check:
- "Cybersecurity Awareness eCourse" - named internal program? It has a specific name but is it unique enough? It's a generic program name essentially.
- "Information Security policies" - generic
- Phishing awareness campaigns - common practice (NOT list)
- Training program, internal communications, end-user testing - common practices

No named frameworks, no named roles, no specific dates, no numbers, no named tools/firms.

"Cybersecurity Awareness eCourse" - this is a named internal program but doesn't have a truly unique identifier/abbreviation. It's borderline. I'd say it's generic enough - many companies have a "cybersecurity awareness" course.

This falls into generic boilerplate territory.


content_category: Management Role

category_confidence: medium

reasoning: The CISO is the grammatical subject throughout, describing what the CISO reports on and to whom — this is Management Role per Rule 2 ('Management role reports TO the board' → Management Role). The paragraph does not describe the CISO's credentials or background (person-vs-function test), but the reporting activity and its content are framed around the CISO as the primary actor rather than the Board as overseer. Specificity is Firm-Specific: CISO (cybersecurity-specific role), Rocket Risk Council (named non-generic committee), and 'During 2023' (specific date) are all IS-list facts, but only one QV-eligible fact (the date), so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: The CISO provides reports to Board, Audit Committee, and senior leadership including Risk Council. Describes what updates include.

Category: The CISO is the grammatical subject providing reports to the Board. This is about the CISO's reporting activities - what they report on and to whom. The person-vs-function test: this is about what the CISO does (reporting to board), not about who the CISO is (credentials, background). But the primary action is reporting TO the board - is this Board Governance or Management Role?

Per Rule 2: "CISO reports quarterly to the Board on..." → Management Role (CISO is primary actor). The CISO is the grammatical subject performing the action throughout. But wait - this is about the flow of information to the board for oversight purposes.

Looking at the actual text again, the CISO is clearly the subject providing reports and presentations to the Board, Audit Committee, and senior leadership. The tiebreaker rule indicates this is a Management Role since the CISO is the primary actor performing the reporting action. The content focuses on what information flows upward—industry developments, vulnerability assessments, and similar updates—rather than on the CISO's background or credentials, so this is definitely about their functional responsibilities.

For specificity, I'm checking: CISO is a cybersecurity-specific title that qualifies for the IS list, "Rocket Risk Council" is a named non-generic committee that also qualifies, and "During 2023" is a specific date that qualifies. That gives me one QV-eligible fact with the date, while the CISO role and committee name are named entities that don't qualify for QV.

Since there's only one QV-eligible fact but multiple IS facts present, this falls into Firm-Specific classification.

fact: CISO provides reports and presentations

fact: During 2023


reasoning: While the opening sentence references board delegation to the Audit Committee, the dominant content describes management personnel — the SVP of IT & SCM's qualifications and experience, the Director of Corporate Security's experience and reporting line to the CLO, and the IT team's knowledge base. The paragraph is primarily about who these people are and what makes them qualified (person-vs-function test favors Management Role). Two QV-eligible hard facts: 'over 20 years of experience' for the SVP and 'over 20 years of experience' for the Director of Corporate Security.

thinking:
Let me analyze this paragraph carefully.

Content Category: This paragraph has multiple elements. Let me break it down:

1. "The Board has designated that the Audit Committee is responsible for overseeing cybersecurity risks" - Board Governance
2. "our Senior Vice President of Information Technology and Supply Chain Management ("SVP of IT & SCM") reports to the Audit Committee on cybersecurity matters" - could be Board Governance or Management Role
3. "The SVP of IT & SCM has over 20 years of experience..." - Management Role (person's qualifications)
4. "Our IT administration team supports the SVP of IT & SCM and has deep working knowledge of the NIST cybersecurity framework, the CMMC program, ISO 27001..." - Risk Management Process or Management Role

5. "our Director of Corporate Security reports to our Chief Legal Officer" - Management Role
6. "The Director of Corporate Security has over 20 years of experience..." - Management Role

The opening sentence establishes Board Governance, but the rest focuses on describing the people in these roles—their titles, experience, and reporting relationships. This is fundamentally about the individuals themselves rather than the governance structure or processes. The dominant category is **Management Role**.

Looking at the specificity markers: the SVP title is cybersecurity-focused, both executives have quantified experience (over 20 years each), and there are several frameworks mentioned (NIST, CMMC, ISO 27001). The CLO is a generic C-suite title without cybersecurity specificity.

For quantified-verifiable facts, I've got two instances of "over 20 years of experience"—one for each executive—which makes this **Quantified-Verifiable**.

fact: Senior Vice President of Information Technology and Supply Chain Management (SVP of IT & SCM)

type: quantified

fact: Director of Corporate Security

fact: NIST cybersecurity framework

type: framework

fact: Cybersecurity Maturity Model Certification (CMMC)


reasoning: The paragraph describes the company's incident response plan escalation process — who gets notified under what circumstances and reporting to the board committee. The primary content is about the internal IR process structure, not about the persons themselves or their qualifications, making this Risk Management Process. Multiple cybersecurity-specific roles (CISO, SVP Engineering, Chief Privacy Officer) are named as part of the escalation chain, providing firm-specific organizational detail, but only one QV-eligible hard fact exists so it stays at Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: Describes the incident response plan's escalation structure - who gets notified (CISO, SVP Engineering, General Counsel, Chief Privacy Officer) and reporting to Audit Committee.

Category: This is about the incident response plan's escalation process. The primary content is about the company's internal process for handling incidents. The roles are mentioned as part of the escalation structure, not describing the persons themselves. The Audit Committee mention is subordinate. → Risk Management Process

Specificity: Let me check for specific facts:
- CISO: cybersecurity-specific title → IS list ✓

- SVP Engineering: not on the IS list for cybersecurity-specific titles
- Chief Privacy Officer: borderline... not explicitly on the IS list. Let me check - the IS list includes "CISO, CTO, CIO, VP of IT/Security, Information Security Officer, Director of IT Security, HSE Director overseeing cybersecurity, Chief Digital Officer (when overseeing cyber), Cybersecurity Director". CPO isn't listed.
- General Counsel and Head of Global Affairs: General Counsel is on the NOT list
- Audit Committee: NOT list

So CISO is one IS fact → Firm-Specific. No named frameworks.

With just the CISO as a hard fact, this doesn't meet the threshold for Qualified Verification, so I'm rating it as Firm-Specific.

fact: CISO

fact: SVP Engineering

fact: Chief Privacy Officer


reasoning: The CIO is mentioned as attribution, but the paragraph's substantive content describes internal processes: ongoing education, monitoring, security measures, system audits, penetration testing, and incident response planning. Removing the CIO reference, the paragraph still reads as a process description. CIO is a cybersecurity-specific title on the IS list, triggering Firm-Specific, but no second QV-eligible fact exists to reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the CIO leading cybersecurity team, ongoing education, monitoring processes, security measures, audits, penetration testing, incident response plan.

Category: The CIO is mentioned as attribution, but the paragraph is about what the program does - education, monitoring, security measures, audits, penetration testing, incident response. This is Risk Management Process per the person-vs-function test.

Specificity: CIO is mentioned - but wait, is CIO a cybersecurity-specific title? Yes, it's on the IS list: "CISO, CTO, CIO, VP of IT/Security..." So CIO triggers Firm-Specific.

No quantifiable facts here—no dates, amounts, headcounts, or named tools—just the CIO role itself, which makes this Firm-Specific.

fact: Chief Information Officer leads cybersecurity team


content_category: Incident Disclosure

reasoning: The paragraph describes an actual ransomware attack — its timing, nature, and response actions — making it Incident Disclosure. The specific date (late May 2023) is the only fact from the IS list; engaged experts and law enforcement are unnamed/generic per the NOT list, so only one hard fact yields Firm-Specific rather than Quantified-Verifiable.

thinking:
Classify this paragraph.

Content: Describes a ransomware attack in late May 2023, response actions taken.

Category: Incident Disclosure - describes what happened (ransomware attack), when (late May 2023), and response actions (investigation, engaged experts, law enforcement).

Specificity:
- "late May 2023" - specific date (month+year) → 1 hard fact
- "ransomware attack" - describes the nature but not a named tool/firm
- "cyber-security experts and outside advisors" - unnamed entities (NOT list)
- "law enforcement" - generic

Only one hard verifiable fact (the date). So Firm-Specific.

fact: late May 2023


reasoning: The paragraph primarily describes what happened during a cybersecurity incident — systems were suspended, containment actions taken, systems restored over a week, and remediation concluded — making it Incident Disclosure. Although a $1.0M cost figure is included, the dominant content is the incident narrative (scope, response actions, restoration timeline), not a standalone financial impact discussion. Two hard verifiable facts (dollar amount + specific date) yield Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes impact of a cybersecurity incident - systems suspended, restored over a week, costs of $1.0 million net of insurance, remediation concluded by December 30, 2023.

Category: This describes what happened in an incident (systems affected, containment, restoration timeline) AND financial cost ($1.0M) AND remediation status. The paragraph describes both incident narrative (what happened, response actions, timeline) and financial impact ($1.0M cost). The dominant content is about the incident itself - what systems were affected, containment actions, restoration timeline, and remediation status. The cost is one detail within that. → Incident Disclosure.

The tiebreaker confirms this: the paragraph describes response actions (systems suspended, restored over a week, remediation concluded) alongside the cost, making the incident narrative the primary focus rather than just financial discussion. The specific details—$1.0 million cost, December 30, 2023 completion date, and the week-long restoration window—all support the incident disclosure classification.

fact: $1.0 million in incident-related costs net of insurance

fact: December 30, 2023 — remediation substantially concluded


reasoning: The paragraph describes an actual ransomware attack—its timing, nature, and response actions—making it clearly Incident Disclosure. Only one hard verifiable fact exists (the specific date 'late May 2023'); 'cybersecurity experts,' 'outside advisors,' and 'law enforcement authorities' are all unnamed/generic per the NOT list, so this reaches Firm-Specific but not Quantified-Verifiable.

thinking:
Classify this paragraph.

Content: Describes a ransomware attack in late May 2023, response actions taken.

Category: Incident Disclosure - describes what happened, when, and response actions.

Specificity:
- "late May 2023" - specific date (month+year) → one hard verifiable fact
- "ransomware attack" - describes the nature but not a named tool/firm
- "cybersecurity experts and outside advisors" - unnamed, generic
- "law enforcement authorities" - generic

Only one hard verifiable fact (the date). So Firm-Specific.


reasoning: The paragraph describes the scope and nature of a specific cybersecurity incident — unauthorized access to two servers via the MOVEit vulnerability — and the types of data affected, making it Incident Disclosure. It contains multiple hard verifiable facts: a specific count (two servers), a named product/vulnerability (MOVEit), and a named third-party entity (PBI), reaching the Quantified-Verifiable threshold.

thinking:
Incident Disclosure - describes what happened in a specific incident (MOVEit flaw, unauthorized access to two servers, scope of data affected).

Specific facts: "two servers" (quantified), "MOVEit" (named system/vulnerability), reference to "PBI" (named entity).

QV check: "two servers" (headcount/quantified), "MOVEit" (named product/tool), "PBI" (named firm). That's 3 hard verifiable facts → Quantified-Verifiable.

Wait - "two servers" is a quantified fact, "MOVEit" is a named system/product, "PBI" is a named firm.

So I've identified three facts that meet the QV criteria.

fact: two servers experienced unauthorized access

fact: MOVEit flaw (named vulnerability/product)

fact: PBI (named entity for comparison of impact)


reasoning: The paragraph describes the company's internal cybersecurity team composition and training program — it is about the function (staffing levels, certification rates, training practices), not about any individual person's background or credentials, making it Risk Management Process rather than Management Role. Multiple QV-eligible hard facts are present: a specific headcount (70+), a specific percentage (50%+), and named certifications (CISSP, CISM, CIPP).

thinking:
Let me analyze this paragraph.

Content: Describes the cybersecurity team composition (70+ positions, 50% certified with CISSP/CISM/CIPP) and training practices.

Category: This is about the team and their qualifications, plus training. The person-vs-function test: this isn't about a specific person's background - it's about the team composition and training program. This is describing internal processes/team structure. Risk Management Process seems right - it's about the company's internal cybersecurity capabilities and training.

Wait - could this be Management Role? Management Role is about specific persons, their credentials, reporting lines. This is about a team broadly. It's more about the program's staffing and training - Risk Management Process.

Now I'm checking the specificity of these claims. The headcount of over 70 positions, the 50% certification threshold, and the specific certifications like CISSP, CISM, and CIPP are all concrete, verifiable facts. That gives me at least two hard data points to work with, making this Quantified-Verifiable.

fact: Over 70 full-time positions on the Information Security and Privacy Team

fact: At least 50% of associates holding relevant industry certifications

fact: CISSP certification

fact: CISM certification

fact: CIPP certification


reasoning: Despite the 'Role of Management' header, the paragraph describes the company's cross-functional approach to identifying, preventing, and mitigating cybersecurity threats — these are internal processes, not information about a specific person's qualifications or credentials. Applying the person-vs-function test: there is no named role, no credentials, no reporting lines — the content is entirely about the function. No named frameworks, specific facts, or firm-specific details are present.


content_category: Strategy Integration

reasoning: The paragraph's primary substantive content is a materiality assessment ('not aware of any material cybersecurity incidents that impacted the Company in the last three years'), which triggers Strategy Integration per Rule 6. The remainder is generic risk language and a cross-reference to Risk Factors. The specific date 'December 31, 2024' is one hard verifiable fact, reaching Firm-Specific but not QV; 'Franklin Templeton' and 'the Adviser' are company self-references on the NOT list.

thinking:
Let me analyze this paragraph.

Content: States no material incidents in last 3 years, mentions routine risks, references Adviser and Franklin Templeton, cross-references Risk Factors. The key substantive content is the materiality assessment ("not aware of any material cybersecurity incidents").

Category: This contains an explicit materiality assessment ("not aware of any material cybersecurity incidents that impacted the Company in the last three years") → Strategy Integration per Rule 6. The rest is generic risk language and a cross-reference.

Specificity:
- "December 31, 2024" - specific date ✓
- "last three years" - vague quantifier

- Franklin Templeton is just a self-reference to the parent company, not a specific fact
- The Risk Factors cross-reference is boilerplate

So this really comes down to one concrete verifiable fact—the date—making it Firm-Specific overall.

fact: As of December 31, 2024


reasoning: The paragraph is about the person filling the cybersecurity leadership role — the Chief Digital Officer's experience, prior organizations (Nasdaq, TIAA), and expertise areas. This is the person, not the function. Three QV-eligible hard facts: specific years of experience (20+), and two named firms (Nasdaq, TIAA).

thinking:
Let me analyze this paragraph.

Content: About the Chief Digital Officer - their experience, background, expertise. This is about the person.

Category: Management Role - the paragraph is about who the person is (CDO), their experience (20+ years), prior organizations (Nasdaq, TIAA), and expertise areas.

Specific facts:
- Chief Digital Officer (cybersecurity-specific role per IS list)
- Over 20 years of experience (specific number → QV-eligible)
- Named firms: Nasdaq, TIAA (named third-party firms → QV-eligible)

QV count: "over 20 years" (specific duration) + Nasdaq (named firm) + TIAA (named firm) = 3 QV-eligible facts → Quantified-Verifiable

fact: Chief Digital Officer

fact: over 20 years of experience

fact: Nasdaq

fact: TIAA


reasoning: The paragraph's primary subject is the CIO — their responsibilities, what they supervise, and their qualifications (20+ years of experience). While it mentions what the CIO oversees (program, personnel, consultants), the grammatical subject throughout is the management team/CIO, and the final sentence is squarely about the person's credentials. Specificity is Firm-Specific: CIO is a cybersecurity-specific title (one IS-list fact) and '20 years' is one QV-eligible fact, but only one QV-eligible fact exists, falling short of the two needed for Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the CIO's responsibility and experience. The paragraph tells us about the person - their role, what they oversee, and their experience (20+ years). But it also describes what they're responsible for (the program, internal personnel, external consultants).

Person-vs-function test: The paragraph names CIO three times. It describes their responsibility (managing the program, supervising personnel and consultants) AND their experience (20+ years). The last sentence is clearly about the person's credentials. The first two sentences describe what the CIO does - but the grammatical subject is the CIO/management team, making this about the management role.

Overall, this leans toward the person rather than the role itself. Looking at what's actually verifiable: the "over 20 years" is a concrete fact I can check, but the CIO title is firm-specific and not independently verifiable. That gives me just one QV-eligible fact, so this falls into the Firm-Specific category.

fact: CIO (Chief Information Officer) — cybersecurity-specific leadership title

fact: over twenty (20) years of experience in cybersecurity program design, implementation, and management


reasoning: The paragraph primarily describes internal cybersecurity processes — defining work plans, setting improvement objectives, incorporating third-party assessment feedback, upgrading systems, and testing incident response plans. The Director of Information Technology is mentioned as attribution with a credential ('over 20 years'), but the substantive content is about what the program does. Removing the role reference, the paragraph still fully describes processes → Risk Management Process. 'Director of Information Technology' is a generic IT title (NOT list), but '20 years' is a specific quantified duration yielding one hard fact → Firm-Specific.

thinking:
Let me analyze this paragraph.

The paragraph describes the Advisor's technology team, led by the Director of Information Technology with 20+ years experience. It describes what this team does: maintains cybersecurity maturity, sets improvement objectives, implements investments, tests incident response plans, etc.

Category: This is a mix. The Director of IT is mentioned with experience (20 years). But then the paragraph describes processes - work plan, testing, investments, incident response planning.

Person-vs-function test: If I remove "under the leadership of the Director of Information Technology, who has over 20 years of technology management experience" - the paragraph still describes what the technology team does (processes). The bulk is about processes. But there's a meaningful portion about the person.

Actually, I'm realizing the core of this paragraph is really about the team's processes and responsibilities—defining work plans, setting objectives, implementing investments, testing incident response plans. The Director of IT is just providing attribution and context. Looking at the IS list, "Director of Information Technology" is a general IT title, not a cybersecurity-specific one like "Director of IT Security" would be. So that title doesn't qualify as a specific fact per the guidelines, and the experience credential alone isn't enough to make this person-focused.

The one concrete detail here is "over 20 years of technology management experience"—that's a specific number on the IS list. For QV purposes, that's just one hard verifiable fact, so it doesn't meet the threshold. But it does count as Firm-Specific since we have that one specific number.

The primary category is Risk Management Process, given how much of the content describes internal processes and third-party assessments.

fact: Director of Information Technology has over 20 years of technology management experience


reasoning: The paragraph describes the company's incident response plan process — steps from detection to mitigation, recovery, and notification — which is an internal cybersecurity process. All details are generic: 'incident response plan' is a generic program name, the steps listed are standard, and the notification targets ('legal,' 'senior leadership,' 'the board') are all generic governance entities on the NOT list.

thinking:
Classify this paragraph.

Content: Describes intent to follow an incident response plan with generic steps. No actual incident. This is about internal processes (IR planning).

Category: Risk Management Process - describes IR plan steps

Specificity: No named frameworks, no firm-specific facts. "incident response plan" is generic. The steps listed (detection, mitigation, recovery, notification) are generic. "legal", "senior leadership", "the board" are all generic.

Generic Boilerplate.


content_category: Board Governance

reasoning: The paragraph centers on the Cybersecurity Committee's oversight activities—receiving quarterly briefings, maintaining dialogue with the CISO, annually assessing cybersecurity posture, and relaying updates to the full board. While the CISO is a frequent subject, the primary communicative purpose is describing the committee's oversight mechanism. The Cybersecurity Committee (a non-generic named committee) and CISO (cybersecurity-specific title) are IS-list facts, but no QV-eligible hard facts (dates, amounts, named firms/tools) are present, so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph.

Content: CISO briefs the Cybersecurity Committee quarterly, topics covered, continuous dialogue, annual assessment, committee chair conveys updates to board.

Category: The primary actors are the CISO and the Cybersecurity Committee. The paragraph describes briefing cadence and content between CISO and a board-level committee. The Cybersecurity Committee is doing oversight (assessing posture, receiving briefings). The CISO is briefing them. Who is the primary subject? The paragraph starts with CISO as subject but the overall frame is about the committee's oversight mechanism. Multiple sentences have the Cybersecurity Committee as subject. I'd say Board Governance - the committee is the oversight body receiving briefings and assessing posture.

Now I'm checking what qualifies as firm-specific. The CISO is a cybersecurity-specific title and the Cybersecurity Committee is a named non-generic committee, so both count as IS facts. General Counsel would be generic C-suite and wouldn't qualify. There aren't any quantifiable facts here—no specific dates, dollar amounts, headcounts, named firms, tools, or certifications. That puts this in the Firm-Specific category since we have at least one IS fact but not two QV-eligible facts.

fact: CISO

fact: Cybersecurity Committee


reasoning: The paragraph contains an explicit materiality assessment ('has not identified risks from known cybersecurity threats... that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, financial condition, results of operations, or cash flows'), which per Rule 6 triggers Strategy Integration regardless of surrounding generic risk language, process mentions, or the appended cross-reference to Risk Factors. No named frameworks, roles, dates, tools, or other specific facts appear — all language is boilerplate.

thinking:
Let me analyze this paragraph carefully.

This is a long, multi-topic paragraph. Let me break down what it covers:

1. Generic risk acknowledgment ("We face risks from cybersecurity threats...")
2. Materiality assessment ("The Company has not identified risks from known cybersecurity threats... that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, financial condition, results of operations, or cash flows.")
3. Generic process description ("We proactively seek to detect and investigate...")
4. Regulatory compliance language
5. Brief mention of initiatives (risk assessment process, incident response plan)
6. Cross-reference to Risk Factors

The materiality assessment is explicit and substantive, which makes this Strategy Integration under Rule 6. The rest is generic boilerplate with no specific frameworks, facts, roles, committees, dates, or numbers—just a cross-reference to another risk factor section. So this falls into Strategy Integration with Generic Boilerplate language.


reasoning: The paragraph's primary frame is the Audit Committee's oversight of cybersecurity governance — reviewing effectiveness, receiving reports, and getting prompt incident notifications. The CISO reporting line is subordinate to the board oversight structure, making this Board Governance. Two IS-list facts (CISO as a cybersecurity-specific role; 'ISMS program' as a named internal program) push to Firm-Specific, but neither qualifies as QV-eligible.

thinking:
Let me analyze this paragraph from Vimeo's 10-K filing.

The paragraph describes the Audit Committee's oversight of cybersecurity, with the CISO reporting to the committee. The primary subject is the governance framework centered on the Audit Committee/Board.

Category: Board Governance - The Audit Committee is the primary actor overseeing cybersecurity. The CISO reporting to the committee is subordinate to the board oversight framing.

Specific facts:
- CISO (cybersecurity-specific role) → IS list
- "ISMS program" - named internal program with specific identifier
- CEO mentioned - generic C-suite, NOT list

- Audit Committee, regular review cadence, and external experts are all generic references without firm-specific details

I've identified two firm-specific facts: the CISO role and the ISMS program. However, neither qualifies as QV-eligible since the CISO is a named role and the ISMS program is a named internal program. This means the paragraph contains firm-specific information but doesn't reach the threshold of two QV-eligible facts.

fact: CISO reports to Audit Committee and CEO

fact: ISMS program (named internal program)


reasoning: The Board and Audit Committee are the grammatical subjects throughout—they assess threats, consult with management, request reports, and receive briefings. The CIO is mentioned as the person reporting to the board, but the paragraph frames this as the board's oversight activity. The CIO title is a cybersecurity-specific role (IS list), yielding Firm-Specific, but there is only one QV-eligible fact so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Board and Audit Committee oversight of cybersecurity, with reporting from management/CIO. The board and Audit Committee are the primary subjects performing oversight actions.

Category: Board Governance - the Board and Audit Committee are the grammatical subjects throughout. They assess, consult, request reports, and receive reports.

Specific facts:
- CIO is mentioned (cybersecurity-specific title per IS list)
- "no less than a quarterly basis" for Audit Committee - generic cadence
- "no less than an annual basis" for full Board - generic cadence
- "Audit Committee" - NOT specific (generic governance)

- "Board" - NOT specific

The CIO is the only firm-specific element here since it's a named cybersecurity role on the IS list, while the Board and Audit Committee references are generic governance structures. There are no quantifiable facts like dates, amounts, or headcounts that would qualify this as QV-eligible, so this lands as Firm-Specific based solely on the CIO mention.

fact: Chief Information Officer (CIO)


reasoning: The paragraph makes an explicit materiality assessment ('has not experienced a material cybersecurity incident'), which per Rule 6 is Strategy Integration regardless of the appended cross-reference to Risk Factors. The specific fiscal year-end date (December 31, 2023) is one hard verifiable fact, placing this at Firm-Specific rather than Generic Boilerplate, but only one QV-eligible fact prevents Quantified-Verifiable.

thinking:
Materiality assessment + cross-reference. The paragraph makes an explicit materiality conclusion ("has not experienced a material cybersecurity incident"), then cross-references Risk Factors. Per Rule 6 and the codebook, materiality assessments → Strategy Integration. The cross-reference doesn't change that.

Specificity: "December 31, 2023" is a specific date. That's one hard fact. No second hard fact. → Firm-Specific.

fact: December 31, 2023


reasoning: The management team is the grammatical subject throughout, and the paragraph includes a reporting line to 'the Committee,' placing it in Management Role territory. However, applying the person-vs-function test, the content largely describes monitoring processes (briefings, threat intelligence, security tools) rather than who the people are or their qualifications — making this borderline with Risk Management Process. No specific facts from the IS list: no named roles (just generic 'management team'), no named tools, no named firms, no dates, no frameworks.

thinking:
Let me analyze this paragraph.

The paragraph describes what the management team does regarding cybersecurity - staying informed, monitoring, and reporting to "the Committee."

Category: This is about management's role in cybersecurity oversight. The grammatical subject is "Our management team." However, the content describes processes (monitoring, briefings, threat intelligence, security tools) more than it describes who the people are. Let me apply the person-vs-function test: if I remove "Our management team" and replace with "the Company," does it still make sense as a process description? "The Company stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks..." - yes, it reads as process description.

The reporting structure and the focus on processes rather than people or qualifications suggests this is fundamentally about how the organization manages cybersecurity risks, with management serving as the operational mechanism for monitoring and escalation. The reporting line to the Committee pushes this toward Management Role since that's explicitly about governance structure, even though the subject could be swapped with "the Company." I'll classify it as Management Role with moderate confidence. Looking at the specificity, there are no named frameworks or particular details—just generic references to "management team," "internal security personnel," "the Committee," and unnamed consultants and tools. This is Generic Boilerplate at Specificity 1.


reasoning: The entire paragraph is about the CISO as a person — their experience, certifications, and prior role — making this clearly Management Role per the person-vs-function test. QV-eligible hard facts include 'over 20 years' (specific number), CISSP (named certification), and Federal Reserve's National Incident Response Team (named organization), yielding 3 verifiable facts.

thinking:
Classify this paragraph.

This is about the CISO's background, credentials, experience, and prior role. This is clearly about the person, not the function.

Content category: Management Role

Specific facts:
- CISO (cybersecurity-specific title)
- "over 20 years of experience" - specific number
- CISSP certification - named certification
- "Federal Reserve's National Incident Response Team" - named organization (prior employer)
- "Software Security" role at Federal Reserve

QV-eligible facts:
- "over 20 years" - specific number ✓
- CISSP certification - named certification ✓

- Federal Reserve's National Incident Response Team - named third-party organization ✓

That gives me three QV-eligible facts, so this qualifies as Quantified-Verifiable.

fact: CISO (cybersecurity-specific title)

fact: Over 20 years of experience in technology and cybersecurity

fact: CISSP certification

fact: Federal Reserve's National Incident Response Team (prior employer)


reasoning: The paragraph describes GXO's internal cybersecurity defenses and processes — protective controls, perimeter defenses, email/web filtering, MFA, employee training, 24/7 monitoring, and incident response planning. These are all the company's own internal activities, making this squarely Risk Management Process. The named 'Cyber Incident Response Plan (CIRP)' with its distinguishing abbreviation qualifies as a firm-specific named internal program per the IS list, but the remaining details (phishing simulations, tabletop exercises, dashboards, MFA) are common practices on the NOT list, yielding only one qualifying fact and thus Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes internal cybersecurity processes - multiple layers of protection, compliance controls, perimeter defenses, filtering, MFA, training, 24/7 monitoring, incident response plan, dashboards.

Category: Risk Management Process - describes the company's own internal cybersecurity processes, tools, and methodologies.

Specific facts:
- "Cyber Incident Response Plan ("CIRP")" - named internal program with unique identifier → IS list
- "24/7 monitoring" - common practice, not specific
- "multi-factor authentication" - common practice
- "phishing simulation" - common practice

- The CIRP abbreviation is the only firm-specific detail here, making it a single concrete fact rather than something that would qualify for QV status.

fact: Cyber Incident Response Plan ("CIRP") — named internal program with unique identifier


content_category: Third-Party Risk

reasoning: The paragraph's central topic is oversight of third-party service providers — governance, processes, and security requirements imposed on vendors/suppliers. No named frameworks, specific standards, dates, named firms, or other facts from the IS list are present; 'vendor risk management program' is a generic program name and 'KORE' is a company self-reference.

thinking:
Classify this paragraph.

Content: About vendor risk management program, oversight of third-party service providers, security requirements imposed on vendors.

Category: Third-Party Risk — central topic is vendor/supplier oversight.

Specificity: No named frameworks, no specific facts from the IS list. "vendor risk management program" is generic. No named standards, no specific requirements named. "KORE" is a company self-reference (NOT list).

Generic Boilerplate.


reasoning: The paragraph makes an explicit materiality assessment ('has not experienced any material cybersecurity breaches') and notes potential material adverse effect on financial results — this is a strategic judgment about cyber risk impact, triggering Strategy Integration per Rule 6. The hypothetical impact language is subordinate to the materiality conclusion. No specific facts: 'during the reporting period' is vague, and the rest is boilerplate materiality language.

thinking:
Let me analyze this paragraph.

Content: Materiality assessment ("not experienced any material cybersecurity breaches") + hypothetical impact language. The first clause is a materiality conclusion - "has not experienced any material cybersecurity breaches." Per Rule 6 and the codebook, materiality assessments → Strategy Integration.

Specificity: "during the reporting period" is vague, not a specific date. No named entities, no frameworks, no firm-specific facts. Generic Boilerplate.


reasoning: The paragraph centers on business/financial consequences of cyber risk: cybersecurity insurance, potential financial/reputational impacts, acknowledgment of past non-material incidents, and a forward-looking materiality assessment ('future incidents could have a material impact on our business strategy, results of operations, financial condition'). The cross-reference to Risk Factors is appended to a materiality discussion, keeping it Strategy Integration per Rule 6. No named frameworks, firm-specific facts, or verifiable details appear — all language is generic boilerplate.

thinking:
Strategy Integration - materiality assessment + insurance mention + cross-reference. The paragraph discusses cybersecurity insurance, acknowledges past non-material incidents, and assesses future materiality risk. The primary content is about business/financial impact and materiality.

Specificity: No named standards, no specific facts from the IS list. Generic boilerplate.


reasoning: The board and Audit Committee are the primary grammatical subjects throughout, performing oversight of cybersecurity risk, receiving briefings, and overseeing ERM integration. The CISO and VP of Internal Audit are mentioned subordinately as those who report TO the board, keeping this in Board Governance. The CISO title is a firm-specific fact, but no second QV-eligible hard fact exists (Audit Committee is generic, cadences like 'periodically' are vague), so specificity is Firm-Specific.

thinking:
Let me analyze this paragraph.

The paragraph is primarily about board oversight of cybersecurity. The board and Audit Committee are the primary subjects performing oversight actions. Let me check for specific facts.

Category: Board Governance - the board is the grammatical subject throughout, overseeing cyber risk, receiving briefings, etc.

Specific facts:
- CISO mentioned (cybersecurity-specific title) → IS list
- Vice President of Internal Audit → not cybersecurity-specific, generic
- Audit Committee → NOT list (generic)

The CISO is mentioned, which is a firm-specific fact. VP of Internal Audit is not on the IS list for cybersecurity-specific titles.

I'm checking the quantitative value here—there's only the CISO as a concrete fact, with no dates, financial figures, or headcount data, so this doesn't meet the QV threshold. The firm-specific element is limited to just that one title.

fact: Chief Information Security Officer (CISO)


reasoning: While the paragraph briefly describes the 2024 Cybersecurity Incident (unauthorized activity, operational disruptions, online ordering impact), its dominant communicative purpose is the business and financial impact: materiality assessment, specific dollar amounts for remediation ($3M), lost revenue ($11M), EBITDA impact ($10M), insurance coverage, and forward-looking cost expectations. Per the tiebreaker rules, a paragraph focused on financial cost, insurance, and materiality of an incident is Strategy Integration. Multiple QV-eligible hard facts (specific dates, three dollar amounts) easily meet the two-fact threshold.

thinking:
Let me analyze this paragraph from Krispy Kreme's 10-K filing.

This paragraph describes a cybersecurity incident but the dominant content is about financial/business impact - costs, lost revenue, insurance, materiality assessment. Let me think about the category tiebreaker rules.

The paragraph contains:
- Brief incident description (unauthorized activity, operational disruptions, online ordering affected)
- Materiality assessment ("materially affected the Company's business operations")
- Specific financial figures ($3M remediation, $11M lost revenue, $10M EBITDA impact)
- Insurance mention
- Forward-looking cost expectations
- Broader materiality disclaimer

The tiebreaker distinguishes between paragraphs that describe what happened in an incident versus those that only discuss financial costs and materiality. This one does both, but the incident details are minimal while the financial and strategic impact dominates. The brief incident description in the opening sentences gives way to extensive discussion of costs, revenue loss, insurance coverage, and materiality conclusions, which suggests this leans toward Strategy Integration rather than Incident Disclosure.

Let me reconsider the mixed nature here. The paragraph does include incident scope—unauthorized activity affecting online ordering in parts of the U.S.—and a status update that systems are now operational. But the bulk of the content is quantified financial impact: the $3M, $11M, and $10M figures, insurance considerations, and future cost implications. Since the dominant purpose is assessing business and financial impact rather than narrating the incident itself, Strategy Integration is the right classification.

For specificity, I'm seeing concrete dates like December 11, 2024 and "fourth quarter of fiscal 2024," plus multiple dollar amounts that are all verifiable. That makes this Quantified-Verifiable.

fact: Form 8-K filed December 11, 2024

fact: fourth quarter of fiscal 2024

fact: approximately $3 million of remediation expenses

fact: $11 million lost revenue in U.S. segment

fact: $10 million impact on Adjusted EBITDA


reasoning: The paragraph describes the company's own internal cybersecurity practices — continuous risk evaluation, employee awareness programs (phishing simulations, newsletters, training), and memberships in named cybersecurity networks. This is squarely Risk Management Process. H-ISAC and Domestic Security Alliance Council are named, verifiable organizations unique to this company's disclosure, making it Firm-Specific. However, these are industry membership groups rather than QV-eligible 'named third-party firms' (like Mandiant or Deloitte) or other QV-eligible fact types, so the paragraph does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the company's internal cybersecurity practices - risk evaluation, employee awareness programs (phishing simulations, newsletters, training), and membership in cybersecurity networks (H-ISAC, Domestic Security Alliance Council).

Category: This is about the company's own internal processes - risk evaluation, employee training, network memberships. → Risk Management Process

Specificity: Let me check for specific facts:
- H-ISAC: named organization/network → named_firm or other_specific
- Domestic Security Alliance Council: named organization → named_firm or other_specific

These are named external organizations, which count as specific facts. That's two named entities. Are they QV-eligible? Named third-party firms count toward QV.

Now I'm reconsidering whether these memberships actually qualify as QV-eligible facts. H-ISAC and DSAC are membership organizations the company participates in, not third-party firms they've hired like Mandiant or CrowdStrike would be. They're more like industry associations or information-sharing networks, which might not meet the same threshold for QV eligibility. H-ISAC and DSAC are membership organizations rather than third-party firms or vendors, so they don't fit the QV-eligible categories cleanly—I'll mark this as Firm-Specific instead.

fact: H-ISAC membership (global cybersecurity network for health care stakeholders)

fact: Domestic Security Alliance Council membership (U.S. government-private sector partnership)


reasoning: The paragraph primarily describes the company's internal cybersecurity risk management processes — policies, threat identification methods, monitoring, scanning, and vulnerability assessments. The CTO and IT team are mentioned as incidental attribution for who runs the program, not as the paragraph's focus (person-vs-function test: remove the CTO reference and the paragraph still describes processes). Third parties are mentioned as one component, not the central topic. The CTO is a cybersecurity-specific title on the IS list, making this Firm-Specific, but there is only one qualifying fact so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the company's risk management program, policies, threat identification processes, monitoring tools, and mentions the IT team under the CTO. Third parties mentioned briefly as component.

Category: Risk Management Process - describes internal processes, policies, monitoring, threat assessment. The CTO mention is incidental attribution. Third-party mention is a component, not central.

Specificity: Let me check for facts.
- "Incident Response Policy" and "Cybersecurity Incident Reporting Policy" - these are named internal programs but are they unique identifiers? They don't have distinguishing abbreviations beyond generic names.
- "Chief Technology Officer" (CTO) - this IS on the ✓ IS list as a cybersecurity-specific title

- No named frameworks, no dates, no dollar amounts, or named tools present, so the only concrete fact from the IS list is the CTO title, making this Firm-Specific rather than QV.

fact: Chief Technology Officer (CTO) oversees cybersecurity


reasoning: The paragraph describes the company's own internal cybersecurity processes: vulnerability management, 24/7 monitoring, and a detailed incident response plan aligned with NIST. The managed security service provider is a component of the internal program (not central vendor oversight), and the Board/Audit Committee mention is an incidental escalation path. NIST is the only named standard; no firm-specific facts (the MSSP is unnamed, 'incident response plan' is generic, Audit Committee is on the NOT list).

thinking:
Let me analyze this paragraph.

Content: Describes the company's cybersecurity program including vulnerability management, managed security service provider with 24/7 monitoring, incident response plan aligned with NIST framework, and roles/responsibilities including escalation to Audit Committee/Board.

Category: This is primarily about the company's internal cybersecurity processes - vulnerability management, monitoring, incident response plan, NIST framework alignment. The mention of a managed security service provider is a component of the internal program, not the central topic. The Board/Audit Committee mention is incidental (escalation path). → **Risk Management Process**

Specificity:
- "NIST framework" → named standard → Sector-Adapted

- "managed security service provider" → unnamed, generic → NOT list
- "24/7/365 monitoring" → common practice
- "Audit Committee" / "Board of Directors" → NOT list (generic governance)
- "incident response plan" → generic program name → NOT list
- No cybersecurity-specific titles (CISO, CIO, etc.)
- No named firms, tools, dates, or numbers

The only specific thing is the NIST framework reference. No IS-list facts beyond that. → **Sector-Adapted (2)**

fact: NIST framework


reasoning: The paragraph names management roles (CTO, Head of Technology Infrastructure) but the vast majority of content describes the cybersecurity program's processes, controls, and safeguards (monitoring, vulnerability management, encryption, DLP, access control, etc.). Applying the person-vs-function test, removing the role titles leaves a fully coherent process description — this is Risk Management Process. Specificity is Firm-Specific: multiple IS-list facts (cybersecurity-specific titles CTO and Head of Technology Infrastructure, named internal program 'ISG Policy'), but no two QV-eligible hard facts (no dates, dollar amounts, headcounts, named third-party firms, or named tools).

thinking:
Let me analyze this paragraph.

Content: Describes Blue Owl's ISG Policy, mentions CTO and Head of Technology Infrastructure as managers, describes their responsibilities (monitoring, vulnerability management, etc.), lists security controls (encryption, DLP, authentication, etc.), mentions NIST framework.

Category: This paragraph mentions management roles (CTO, Head of Technology Infrastructure) but the bulk is about the cybersecurity program's processes, tools, and controls. Applying the person-vs-function test: if you remove the role titles, the paragraph still describes the program. → Risk Management Process

Specific facts:
- "ISG Policy" - named internal program with unique identifier ✓

- CTO - cybersecurity-specific title ✓
- "Head of Technology Infrastructure" - cybersecurity-specific title ✓
- NIST - named framework (Sector-Adapted, but other facts push to Firm-Specific)

Now checking against the classification criteria. The paragraph has three firm-specific identifiers: the ISG Policy itself, the CTO role, and the Head of Technology Infrastructure position. There are no quantifiable metrics like dates, dollar amounts, or headcounts, so this doesn't meet the QV threshold. But with multiple named roles and a named internal program, this clearly qualifies as Firm-Specific.

fact: ISG Policy (named internal program with unique identifier)

fact: Chief Technology Officer

fact: Head of Technology Infrastructure

fact: NIST Cybersecurity Framework


reasoning: The paragraph contains an explicit materiality assessment ('have not materially affected our business strategy, results of operations or financial condition'), which per Rule 6 makes it Strategy Integration even though it includes a cross-reference to Risk Factors. No named entities, dates, dollar amounts, or firm-specific facts are present — this is boilerplate materiality language that could appear in any filing.

thinking: Materiality assessment paragraph with cross-reference.


reasoning: The paragraph describes the company's own internal cybersecurity processes — using an external firm for risk detection, conducting maturity assessments, and auditor inquiries. Third parties are mentioned as components serving the company's program (Rule 3: external assessors hired to test the company → RMP, not Third-Party Risk). No named frameworks, firms, roles, dates, or quantified facts appear; all entities are unnamed ('independent external firm,' 'auditors') and cadences are generic ('periodically,' 'annual').

thinking:
Let me analyze this paragraph.

Content: Describes use of an external firm for cybersecurity risk detection, periodic maturity assessments, and auditor inquiries. This is about the company's internal processes for managing cyber risk, with third-party involvement as a component of those processes.

Category: The paragraph describes the company's own risk management processes. Third parties are mentioned but as components serving the company's program (external firm providing services, auditors performing assessments). Per Rule 3, external assessors hired to test the company → Risk Management Process.

Specificity: Let me check for specific facts:
- "independent external firm" — unnamed, NOT list

- "periodically" — generic cadence, NOT list
- "annual" — generic cadence, NOT list
- "auditors" — unnamed, NOT list
- No named frameworks, no named firms, no specific dates, no numbers, no named roles

No IS-list facts. No named standards. → Generic Boilerplate.


reasoning: The paragraph's primary content describes the IT department's internal cybersecurity processes — employee training programs, phishing exercises, and reporting cadence — making it a Risk Management Process paragraph. The Risk Committee and executive officers are mentioned as recipients of reports, but the IT department and its activities are the dominant subject. The named 'Risk Committee' (a non-generic committee per the IS list) elevates specificity to Firm-Specific; however, 'head of IT' is generic IT leadership (NOT list), and practices like phishing exercises and annual training are common practices that don't count. Only one IS-list fact remains, so it does not reach Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: The IT department manages cybersecurity risks, conducts training, and reports to executive officers and the Risk Committee. The Risk Committee provides guidance.

Category: This describes internal processes - training, reporting, risk management. The grammatical subject is "Our IT department" and "The IT department." There's mention of the Risk Committee and executive officers receiving reports. The primary content is about what the IT department does (processes), not about a person's credentials or board oversight.

This is Risk Management Process - it describes internal cybersecurity processes (training, phishing exercises, reporting).

Wait - the Risk Committee is mentioned. Let me check: is this board governance or risk management? The IT department is the primary actor, conducting training and providing reports.

The Risk Committee receives reports and provides guidance, but the dominant focus remains on the IT department's activities and internal processes. Looking at the specifics: "Risk Committee" is a named committee that appears in the firm-specific list, while "head of IT" is generic leadership terminology. The paragraph emphasizes what the IT department does rather than governance structures, so this falls under Risk Management Process.

fact: Risk Committee (named non-generic committee receiving cybersecurity reports and providing guidance)


reasoning: The paragraph's central topic is evaluating and managing the cybersecurity posture of third-party providers — their integrity, security controls, and access to sensitive data — making Third-Party Risk the dominant category. No named frameworks, specific roles, dates, tools, or firm-specific facts are present; language like 'certain third parties' and 'as appropriate' is generic boilerplate.

thinking:
Classify this paragraph.

Content: About evaluating third-party technology infrastructure and cybersecurity controls. Central topic is vendor oversight.

Category: Third-Party Risk - the central topic is oversight of external parties' cybersecurity.

Specificity: No named frameworks, no specific facts from the IS list. "certain third parties", "as appropriate" - all generic language. Generic Boilerplate.


reasoning: The paragraph describes the company's internal risk assessment methodology, security control selection process, and framework alignment — all hallmarks of Risk Management Process. It names NIST CSF but provides no firm-specific details beyond that, making it Sector-Adapted.

thinking:
Classify this paragraph.

Content: Describes the company's cybersecurity program aligned with NIST CSF, risk assessment methodology, security controls selection process. This is about internal processes.

Category: Risk Management Process - describes risk assessment, framework adoption, security controls, internal processes.

Specificity: Names NIST CSF (a recognized standard). Nothing firm-specific beyond that. The rest is generic process description. → Sector-Adapted (2).

fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)


reasoning: The paragraph describes five key elements of Corebridge's internal cybersecurity program—network security, threat/vulnerability management, incident response, third-party oversight, and training—making Risk Management Process the dominant category. Third-party risk is one of five components, not the central topic. Despite the length and detail, the paragraph names no recognized frameworks, no specific tools/products, no named firms, no dates, no headcounts, and no cybersecurity-specific roles; all practices listed (firewalls, IDS/IPS, vulnerability scanning, penetration testing, phishing training) are common/generic, placing this at Generic Boilerplate.

thinking:
This is a detailed paragraph describing Corebridge's cybersecurity program elements.

Content: Describes internal processes - network security, threat/vulnerability management, incident monitoring, third-party oversight, training. This is primarily about the company's own internal cybersecurity processes and methodology.

Category: Risk Management Process - describes the company's internal cybersecurity program elements. Third-party risk is one component among five, not the central topic.

Specificity: Let me check for specific facts.
- No named frameworks (NIST, ISO, etc.)
- No named tools/products
- No named firms
- No dates, dollar amounts, headcounts

- No cybersecurity-specific titles (CISO, etc.)
- Practices mentioned are all generic: firewalls, IDS/IPS, vulnerability scanning, pen testing, etc.

This reads as generic boilerplate security language without any firm-specific details or named standards to anchor it.


reasoning: The paragraph describes the company's own internal risk assessment methodology, control analyses, and framework alignment — all hallmarks of Risk Management Process. It explicitly claims ISO 27001 certification ('as part of ISO 27001 ISMS requirements, framework and certification'), which per the codebook is a firm-specific fact beyond merely naming the standard. However, only one QV-eligible fact exists (certification claim is not QV-eligible — no dates, dollars, headcounts, named firms, or named tools), so specificity is Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes annual cybersecurity risk and threat assessments, control analyses, ISO 27001 ISMS requirements, NIST alignment, risk identification processes. The last sentence is a cross-reference.

Category: This is about the company's own internal risk assessment processes → Risk Management Process

Specific facts:
- ISO 27001 ISMS certification ("as part of ISO 27001 ISMS requirements, framework and certification") - this is a certification claim, which is Firm-Specific per the IS list
- NIST - named framework
- The cross-reference at the end is noise

- The ISO 27001 certification is a firm fact but not quantitatively verifiable since it's a certification claim rather than a measurable metric like a date, dollar amount, or headcount
- Named frameworks alone don't qualify for QV eligibility

So this lands at Firm-Specific (3) since we have the ISO 27001 certification claim, but it's not QV-eligible.

fact: ISO 27001 ISMS certification held

fact: NIST framework alignment


reasoning: The paragraph contains an explicit materiality assessment ('have not materially affected... business strategy, results of operations, or financial condition'), making it Strategy Integration per Rule 6. The cross-reference to Risk Factors does not change the classification. No specific facts from the IS list are present — the company name, filing form type, and quoted risk factor heading are all on the NOT list.


reasoning: The paragraph identifies the DPIRC management committee, its co-chairs (CCO and CIO), its members (including CISO and named departments), and the CISO's qualifications and appointment date. The primary content is about who the people are and how the management structure is composed — not what the program does — making this Management Role. Two QV-eligible hard facts: specific appointment date (2024) and specific years of experience (over 20 years).

thinking:
Let me analyze this paragraph.

Content category: This paragraph covers multiple topics. Let me break it down:
- Opening sentence: general statement about cyber being part of ERM
- DPIRC committee oversight
- DPIRC composition: co-chaired by CCO and CIO, members include CISO and departments
- CISO background and experience

The paragraph describes both a named committee (DPIRC) and management roles (CIO, CISO, CCO) with their composition and the CISO's qualifications. The primary focus seems split between the committee structure and the CISO's credentials.

The DPIRC is a named non-generic committee → this is firm-specific. The paragraph describes who chairs it, who the members are, and then describes the CISO's experience.

The grammatical focus shifts from the committee's oversight role to the CISO's qualifications, but the core content is really about the management structure—specifically the DPIRC committee and the CISO's background. This looks like a Management Role category, since it's explaining who manages cybersecurity and what credentials they bring to the table.

Looking at the specificity markers: the DPIRC is a named committee, the CISO has a specific appointment year and years of experience, and the team includes named departments. The "appointed in 2024" and "over 20 years" details are concrete enough to count as QV-eligible facts.

fact: Data Privacy and Information Risk Committee (DPIRC)

fact: CIO co-chairs the DPIRC

fact: CISO is a member of the DPIRC

fact: Members include Information Security, Legal, and Human Resources departments

fact: CISO appointed in 2024

fact: Over 20 years of cybersecurity experience


reasoning: The paragraph contains an explicit materiality assessment ('not aware of any previous cybersecurity threats or incidents that may have materially affected or are reasonably likely to materially affect the Company'), which per Rule 6 is Strategy Integration regardless of the appended cross-reference to Risk Factors and generic risk language. No named frameworks, roles, dates, tools, or other specific facts are present — all language is boilerplate.

thinking:
Let me analyze this paragraph.

Content: Materiality assessment ("not aware of any previous cybersecurity threats or incidents that may have materially affected or are reasonably likely to materially affect the Company"), plus generic risk language and a cross-reference to Risk Factors.

Category: Strategy Integration - contains explicit materiality assessment per Rule 6.

Specificity: The paragraph mentions "certain minor cybersecurity incidents" but no dates, names, amounts. No named frameworks, no specific roles. The cross-reference is noise. This is Generic Boilerplate.


specificity_confidence: medium

reasoning: The paragraph opens with a brief list of 2024 initiatives (data protection, threat intelligence, employee training, phishing enhancements), but the majority of the text—four of six sentences—details policies and processes governing third-party access: authorization requirements, formal agreements, and monitoring controls. These are requirements imposed ON external parties, making Third-Party Risk the dominant category by volume and communicative purpose. Specificity is Firm-Specific based on the temporal anchor 'In 2024'; all other content (phishing simulations, third-party access controls, employee education) consists of common practices on the NOT list, and no named frameworks, tools, or firms are present to reach QV.

thinking:
Let me analyze this paragraph.

Content: Describes 2024 initiatives (data protection, threat intelligence, third-party risk management, employee education, phishing simulations) and then details third-party access policies.

Category: Mix of Risk Management Process and Third-Party Risk. The first sentence lists internal initiatives (RMP) including third-party risk as one component. The second half focuses on third-party access policies. The third-party content is substantial - roughly half the paragraph. But the first sentence frames these as internal initiatives, and third-party risk is one of several. The second half details third-party access governance specifically.

This is a close call.

Looking at the actual distribution, the opening sentence mentions four initiatives with third-party risk as just one element, but then the remaining content shifts entirely to third-party access governance. The volume of text dedicated to third-party requirements and controls clearly dominates, so this should be categorized as Third-Party Risk.

On specificity, "In 2024" functions as a concrete date reference similar to the fiscal year examples in the guidelines, so that counts as one firm-specific fact. The mention of adding social engineering to phishing simulations is standard practice without named tools or frameworks. With just one verifiable fact, this lands in Firm-Specific territory.


reasoning: The paragraph describes the company's own internal cybersecurity processes — risk identification, penetration testing, and employee training programs. Third parties are mentioned as one component of internal processes, not as the central topic. All language is generic and future-tense ('will be managed', 'will conduct'), with no named frameworks, roles, tools, dates, or other specific facts from the IS list.

thinking:
Let me analyze this paragraph.

Content: Describes risk identification through IT programs, penetration testing with third parties, and employee training. All internal processes. Future tense ("will be managed", "will conduct", "will be used") suggests planned processes.

Category: Risk Management Process - describes internal cybersecurity processes (risk identification, pen testing, training). Third parties mentioned as a component, not the central topic.

Specificity: Let me check for specific facts.
- "Information Technology ("IT")" - generic
- "outside third-party cybersecurity experts" - unnamed, NOT list
- "penetration testing" - common practice, NOT list

- "employee training" - common practice
- No named frameworks, no named roles, no dates, no numbers

No IS-list facts. No named standards. → Generic Boilerplate.


reasoning: The paragraph is primarily general IT risk language about system upgrades/replacements, but the final sentence ('The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly') constitutes a minimal cybersecurity process disclosure, pulling it into Risk Management Process over None/Other per Rule 5. However, the disclosure is entirely generic with no named frameworks, roles, tools, dates, or any firm-specific detail.

thinking:
Let me analyze this paragraph from Knife River Corp's 10-K Item 1C filing.

The paragraph discusses potential adverse impacts from system upgrades/replacements, then ends with a generic statement about assessing cybersecurity risks. This is mostly general business/IT risk language with a brief generic cybersecurity mention at the end.

Content category: The first two sentences are about IT system upgrades and their potential business impact - general business language. The last sentence "The Company continually assesses risks from cybersecurity threats and adapts and enhances its controls accordingly" is a very generic risk management statement. This is borderline None/Other vs Risk Management Process. The last sentence does touch on cybersecurity risk assessment, but it's extremely generic. Per Rule 5, if a paragraph mentions cybersecurity even briefly in service of a disclosure obligation, assign the relevant category.

The bulk of this paragraph is really about IT system disruptions rather than cybersecurity threats specifically. The cybersecurity disclosure is just that final sentence, which is so generic it barely qualifies. I'm torn between categorizing this as Risk Management Process because of that last sentence, or treating it as general IT risk since the dominant content is about system upgrades and their business impact. The cybersecurity mention feels tacked on rather than integral to the paragraph's main point.

Looking at the specificity, there's nothing concrete here—no named frameworks, no actual risk assessment details, just boilerplate language about assessing and adapting controls. That's Generic Boilerplate territory. Given that thin cybersecurity disclosure at the end, I'll classify this as Risk Management Process, but I'm not confident about it.


reasoning: The paragraph describes CyROC, a management-level committee responsible for cybersecurity, including its chair (supervisor of cybersecurity), composition, and reporting relationship to the audit committee. The codebook explicitly includes 'management committees responsible for cybersecurity' under Management Role. The grammatical subjects throughout are the committee and its structure, not the board (which is only referenced as a recipient of CyROC's output). Multiple IS-list facts (named non-generic committee, cybersecurity-specific role, specific team composition) establish Firm-Specific, but no two QV-eligible hard facts are present.

thinking:
Let me analyze this paragraph.

Content: Describes a named committee (CyROC - Cyber Risk Oversight Committee), its purpose, responsibilities, composition, and chair.

Category: This is about a management-level committee. The CyROC provides info to the audit committee (board-level), but the paragraph is primarily about the committee itself - its composition, responsibilities, and chair. The grammatical subject is CyROC throughout. CyROC is an executive management committee, not a board committee. It reports TO the audit committee. This is Management Role.

Wait - let me reconsider. Is this Risk Management Process? The person-vs-function test: the paragraph describes the committee's structure and composition (who chairs it, who comprises it).

It's definitely organizational structure, not processes. Management Role is the right fit since it covers management committees responsible for cybersecurity. CyROC fits that definition perfectly. Looking at the specificity: the committee has a named title, a cybersecurity-specific supervisor role, and detailed team composition from financial, operations, and technology areas. That's concrete enough. Now I need to verify there are at least two hard verifiable facts like dates or dollar amounts to complete the QV check.

fact: Cyber Risk Oversight Committee (CyROC)

fact: supervisor of cybersecurity (chairs CyROC)

fact: members from financial and operations management, as well as technology leaders


reasoning: The paragraph describes the company's internal process for assessing and managing cybersecurity risks through its ERM program, making Risk Management Process the dominant category. The cross-reference to Risk Factors is secondary. No named frameworks, cybersecurity-specific roles, or other facts from the IS list are present—'ERM program' is a generic program name—so this is Generic Boilerplate.

thinking:
Classify this paragraph.

Content: Describes integrating cybersecurity into ERM program, then cross-references Risk Factors.

Category: The paragraph describes the company's internal risk management process (assessing, identifying, managing cyber risks through ERM). The cross-reference is secondary. → Risk Management Process

Specificity: Let me check facts:
- "Enterprise Risk Management (ERM) program" - this is a generic program name, not a unique identifier
- "Item 1A, Risk Factors" - cross-reference, not specific
- No named frameworks, no specific facts from the IS list

→ Generic Boilerplate


reasoning: The paragraph briefly mentions a past ransomware incident (October 2021) but does not describe what happened in detail — it names the event and then assesses its material adverse impact on business strategy, results of operations, and financial condition. Per the tiebreaker 'brief mention of a past incident + materiality conclusion as the main point → Strategy Integration.' The cross-reference to Risk Factors does not change the classification since a materiality assessment is present. One QV-eligible fact (specific month+year) yields Firm-Specific.

thinking:
Let me analyze this paragraph carefully.

The paragraph describes past cybersecurity incidents (including a specific ransomware attack in October 2021 with material impact), makes a materiality assessment, and cross-references Risk Factors.

Content category analysis:
- It mentions past incidents including a specific ransomware attack in October 2021
- It states this had "a material adverse impact on our business strategy, results of operations or financial condition"
- It cross-references Risk Factors

This is tricky. It references an actual incident (October 2021 ransomware) AND makes a materiality assessment about it. Per the tiebreakers: "Brief mention of a past incident + materiality conclusion as the main point → Strategy Integration." The paragraph doesn't describe what happened in the incident in detail - it just names it and assesses its material impact. The main communicative purpose seems to be acknowledging past incidents and their material impact, plus cross-referencing risk factors.

The October 2021 ransomware attack is the specific factual anchor here, with the materiality assessment being the key takeaway. The language around the impact is standard boilerplate, but the date itself provides concrete specificity that distinguishes this from generic risk discussion.

fact: ransomware attack in October 2021


reasoning: The paragraph describes the company's internal cybersecurity risk assessment processes, ERM integration, and risk identification methodology — all hallmarks of Risk Management Process. No named frameworks, specific roles, dates, tools, or other firm-specific facts are present; phrases like 'enterprise risk professionals,' 'subject matter specialists,' and 'tailored to the distinct businesses of our segments' are generic and could appear in any company's filing.

thinking:
Let me analyze this paragraph.

Content: Describes the company's approach to cybersecurity risk management - risk types, processes, ERM integration, collaboration with specialists, segment-tailored programs.

Category: Risk Management Process - describes internal processes, ERM integration, risk assessment methodology.

Specificity: No named frameworks, no named roles (just "enterprise risk professionals" and "subject matter specialists" which are generic), no specific dates, no named tools, no firm-specific facts. The mention of "tailored to the distinct businesses of our segments" is somewhat specific but doesn't name anything. This is Generic Boilerplate.


reasoning: The paragraph is primarily about the qualifications and background of the CISO/DPO and IT Compliance Committee members — their years of experience, career history (web portal/messenger companies, game developer), and general competencies. This is the person-vs-function test: the content is about who these people are and what makes them qualified, not about what the cybersecurity program does. Multiple IS-list facts are present (CISO, DPO, IT Compliance Committee, 20+ years), but only one QV-eligible fact (years of experience), so it remains Firm-Specific rather than Quantified-Verifiable.

thinking:
Let me analyze this paragraph.

Content: Describes the experience/qualifications of the CISO and DPO, and the IT Compliance Committee members' experience. The paragraph is about the people - their credentials and background.

Category: Management Role - it's about the person (CISO/DPO) and their qualifications, experience, background. The IT Compliance Committee members' qualifications are also discussed.

Specific facts:
- CISO (cybersecurity-specific role) ✓
- DPO (Data Protection Officer - cybersecurity-specific role) ✓
- IT Compliance Committee (named non-generic committee) ✓

- More than 20 years of experience (specific quantifiable fact) ✓
- Background includes work at public companies offering web portal and instant messenger services, plus a game developer company

Now I'm checking the QV eligibility: the 20+ years is a specific number that qualifies, but the company descriptions aren't named firms so they don't count. With only one QV-eligible fact and the named roles/committee already on the IS list, this falls into the Firm-Specific category.

fact: CISO

fact: DPO (Data Protection Officer)

fact: IT Compliance Committee

fact: more than 20 years of experience directing privacy policies


reasoning: The paragraph describes internal cybersecurity practices — patch/update deployment and contingent use of third-party experts for incident response — which are core risk management process activities. No named frameworks, tools, firms, roles, dates, or other specific facts are present; 'third-party security experts' is on the NOT list as an unnamed entity.

thinking:
Classify this paragraph.

This describes two practices: deploying updates/patches and using third-party experts if needed. These are internal security practices - patching and incident response. No named frameworks, no specific facts, no dates, no named firms.

Category: Risk Management Process - describes internal security practices (patch management, incident response approach)

Specificity: Generic Boilerplate - no named standards, no firm-specific facts. "Third-party security experts" is on the NOT list.


reasoning: The paragraph opens with and dedicates roughly half its content to requirements imposed ON subcontractors (DFARS contractual flow-downs) and SOC-2 review of third-party integrators, making Third-Party Risk the dominant category over the internal process descriptions (monitoring, data analytics, internal audit) in the second half. It names DFARS and SOC-2 as recognized standards but contains no firm-specific facts from the IS list — the third-party categories (payroll processor, managed solutions provider, SaaS providers) are generic types, not named firms.

thinking:
Let me analyze this paragraph.

Content: Discusses contractual flow-downs to subcontractors (DFARS), reviewing SOC-2 reports of third parties (payroll processor, managed solutions provider, SaaS providers), continuous improvement, data analytics for threat detection, and internal audit function.

Category: This paragraph covers both third-party risk (contractual requirements to subcontractors, SOC-2 reviews) and risk management process (continuous improvement, data analytics, internal audit). The first half is about vendor oversight - flowing requirements to subcontractors and reviewing SOC-2 reports. The second half shifts to internal processes. The dominant topic seems split, but the opening and substantial portion is about third-party oversight. Let me re-read...

The paragraph opens with contractual flow-downs to subcontractors and SOC-2 reviews of third parties, which takes up roughly the first half, then transitions into internal monitoring, data analytics, and audit functions. It's a close call between Third-Party Risk and Risk Management Process, but the vendor oversight content at the beginning gives Third-Party Risk a slight edge, even though the internal processes portion is also significant. I'm going back and forth on this, but I need to commit: the paragraph opens with contractual vendor requirements and SOC-2 reviews, which are distinctly third-party focused, so Third-Party Risk is the right call despite the other program elements mixed in. The fact that they're operating as a defense contractor and flowing down DFARS requirements to subcontractors is actually firm-specific context—that's a meaningful detail about their business model and regulatory posture. Combined with their review of SOC-2 reports and continuous improvement processes, this points to Sector-Adapted classification rather than just Generic.

fact: Defense Federal Acquisition Regulation Supplement (DFARS)

fact: SOC-2 reports


reasoning: The paragraph describes an actual cybersecurity incident at the company's advisor — the nature (security incident impacting computer systems), timing (January 2023), response actions (reported to law enforcement, restored systems), and impact assessment (no known misuse). This is an incident narrative. Specificity is Firm-Specific: the specific date (January 2023) is one hard verifiable fact, but there is no second QV-eligible fact (law enforcement and 'advisor' are unnamed entities).

thinking:
Let me analyze this paragraph.

Content: Describes a security incident at the company's advisor in January 2023, restoration, and no known data misuse.

Category: This describes an actual cybersecurity incident - what happened, when, response actions. The incident occurred at a third party (advisor), but the paragraph is describing the incident narrative. Incident Disclosure.

Specificity:
- "January 2023" = specific date (month+year) → one hard verifiable fact
- No named firms, no named tools, no dollar amounts, no headcounts
- One QV-eligible fact (date), need two for QV → Firm-Specific

fact: January 2023


reasoning: The paragraph describes the company's own internal cybersecurity measures (encryption, network controls, access controls, monitoring, training) making Risk Management Process the dominant category. The brief insurance mention at the end is subordinate. No named frameworks, tools, firms, roles, dates, or quantified facts are present — all measures listed are generic common practices — so this is Generic Boilerplate.

thinking:
Classify this paragraph.

Content: Describes internal cybersecurity measures - encryption, network controls, access controls, monitoring, training, plus mentions cybersecurity insurance.

Category: This is primarily about the company's internal processes and measures. The insurance mention is brief. Dominant category = Risk Management Process.

Wait - the insurance mention could pull toward Strategy Integration. But it's one sentence at the end of a paragraph dominated by process descriptions. Risk Management Process is dominant.

Specificity: Let me check for specific facts.
- "data encryption" - common practice
- "network security controls" - generic
- "access controls" - generic
- "physical security controls" - generic

- "monitoring" - generic
- "asset management and tracking" - generic
- "employee training" - generic
- "cybersecurity insurance" - generic mention, no specifics

No named frameworks, no named tools, no named roles, no specific dates, no numbers. Everything here is generic boilerplate.


reasoning: This paragraph spans multiple categories but Strategy Integration dominates: 5 of 7 sentences address materiality assessments ('materially affect... business strategy, operational results, and financial condition'), absence of breaches over three fiscal years, third-party breach impact assessment, cybersecurity insurance, and a no-material-incident conclusion for fiscal 2024. The two sentences about NIST CSF and SOC 2 assessments are subordinate Risk Management Process content. Two QV-eligible hard facts: specific date (December 31, 2024) and specific quantified duration (three fiscal years with no breach).

thinking:
Let me analyze this paragraph carefully.

This is a complex paragraph that touches multiple categories. Let me break it down:

1. "Management continuously assesses the potential impact of risks from cybersecurity threats..." - Risk management/Strategy Integration
2. "an assessment of the cybersecurity program leveraging the Cybersecurity Framework is completed annually by an independent and qualified external third-party cybersecurity assessor" - Risk Management Process (mentions Cybersecurity Framework = NIST CSF)
3. "Concentra receives a certified System and Organization Controls 2, Type 1 assessment" - Risk Management Process (SOC 2 Type 1)

4. The next section covers the company's track record with no material breaches over the past three years, mentions exposure to third-party breaches without material impact, maintains annual cybersecurity insurance, and confirms no material incidents in 2024 - all of which fall under Strategy Integration since they're assessing materiality and demonstrating risk mitigation through insurance and historical performance. Looking at the specificity of these details—the SOC 2 Type 1 certification is firm-specific since they actually received it, while the NIST CSF is just a named framework. The date December 31, 2024 is concrete, and "past three fiscal years" gives a quantified timeframe, though the SOC 2 claim itself wouldn't qualify as a QV-eligible fact under the rules. I'm reconsidering whether "three fiscal years" qualifies as a hard quantifier—it's a specific number, but it's more of a duration than the typical QV examples like dollar amounts or headcounts. The SOC 2 Type 1 certification and December 31, 2024 date are solid, so I'm leaning toward Quantified-Verifiable, though it's borderline enough that I could justify Firm-Specific instead.

fact: Cybersecurity Framework (NIST CSF) assessment

fact: SOC 2, Type 1 certified assessment

fact: No cybersecurity breach during the past three fiscal years

fact: December 31, 2024 (fiscal year end)