fact: The company has a Chief Security and Trust Officer

fact: The Chief Security and Trust Officer reports to the Executive Vice President, Operations

fact: The Chief Security and Trust Officer has served in information technology and information security roles for over 25 years

reasoning: This paragraph primarily describes management’s cybersecurity organization by identifying the Chief Security and Trust Officer’s reporting line, responsibilities, and qualifications, so it is best classified as Management Role. Specificity reaches Quantified-Verifiable because it includes firm-specific role details and the externally checkable claim that this officer has over 25 years of relevant experience.


content_category: Strategy Integration

category_confidence: high

specificity_confidence: high

reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of threats or incidents that had a material impact and that certain cyber risks could reasonably likely materially affect it, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the statements are generic and include a cross-reference to risk factors.

provider: openai

stage: benchmark


content_category: Third-Party Risk

fact: The Company has established a dedicated department within its Enterprise Risk Management division to manage third-party risks

fact: That department evaluates cybersecurity risks associated with the Company's third-party service providers together with the Bank's Information Technology Department

specificity_confidence: medium

reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and other external service providers, making Third-Party Risk the best fit. Its specificity rises above boilerplate because it describes a company-specific organizational structure—a dedicated department within Enterprise Risk Management working with the Bank's Information Technology Department—even though it provides no hard numbers or externally verifiable facts.


content_category: None/Other

reasoning: This paragraph is primarily forward-looking risk boilerplate about potential adverse consequences if systems fail or are breached, rather than a substantive description of governance, management, process, third-party oversight, or an actual incident. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts that elevate specificity above generic disclosure.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and business partners, making Third-Party Risk the best fit. Its language remains generic—e.g., third-party risk assessments, requesting security policies, and monitoring provider incidents—without domain-specific cyber terminology, firm-unique structures, or verifiable details.


fact: The company states it has experienced targeted and non-targeted cybersecurity incidents in the past.

fact: The paragraph references a specific cybersecurity incident in August 2023.

fact: The August 2023 incident affected certain of the company’s information systems and caused temporary disruptions to parts of operations.

reasoning: The paragraph primarily answers whether past cybersecurity incidents have materially affected the company, which makes it a Strategy Integration disclosure under the materiality-assessment rule. Specificity rises to Quantified-Verifiable because it includes a specific incident timing (August 2023), along with concrete incident details beyond generic boilerplate.


content_category: Management Role

fact: IT Security team leads enterprise-wide cybersecurity strategy, policy, standards and processes

fact: The team is led by the Director of IT Infrastructure and Security

fact: The Director of IT Infrastructure and Security brings over 30 years of experience

type: quantified

fact: The Director's experience includes implementing and verifying the effectiveness of cybersecurity controls in a Defense Industrial Base environment

fact: The Director maintains GIAC Security Essentials certification

type: framework

fact: The Director maintains GIAC Certified Enterprise Defender certification

fact: The Director maintains GIAC Certified Incident Handler Certification

fact: The Director maintains GIAC Certified Windows Security Administrator certification

fact: The Director maintains GIAC Critical Controls Certification

fact: The Director reports to the Vice President of Information Technology

fact: The Vice President of Information Technology receives continuous updates regarding prevention, detection, mitigation and remediation of cybersecurity incidents

fact: The Vice President of Information Technology has over 19 years of experience

fact: The Vice President of Information Technology is responsible for IT governance, technology strategy development, and cybersecurity

fact: The Vice President of Information Technology holds a Certified Information Systems Security Professional (CISSP) certification

fact: The Vice President of Information Technology holds a Master of Business Administration

reasoning: This paragraph primarily describes how management is organized to handle cybersecurity, emphasizing the IT Security team, the Director of IT Infrastructure and Security, the Vice President of Information Technology, their responsibilities, qualifications, and reporting line. Specificity is Quantified-Verifiable because it includes externally checkable claims such as over 30 years and over 19 years of experience and named certifications including multiple GIAC credentials and CISSP.


fact: The third-party risk assessment is a cross-functional effort involving the end-user, Legal, Privacy, and Information Security teams.

reasoning: The paragraph is primarily about how the company manages cybersecurity risk arising from third-party service providers, making Third-Party Risk the best fit. Specificity rises to Firm-Specific because it identifies the particular internal team composition involved in the third-party risk assessment process, while the rest of the language is largely generic process description.


fact: The cybersecurity team is led by the CISO.

fact: The CISO has over 20 years of information technology and cybersecurity experience.

fact: The team comprises security engineers, detection specialists, and business cybersecurity experts.

category_confidence: medium

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity by identifying the CISO as leader, describing the CISO’s qualifications, and outlining team composition; the brief reference to incident response supports but does not dominate the paragraph. Specificity is Quantified-Verifiable because it includes the externally checkable claim that the CISO has over 20 years of IT and cybersecurity experience, along with firm-specific management details.


content_category: Board Governance

fact: In 2022, the company developed an enhanced Employee Self Service portal

fact: The company has an enhanced Employee Self Service portal for employees to access IT solutions, tips, resources, and service request status

reasoning: The paragraph primarily describes how the Board of Directors and audit committee oversee cybersecurity- and IT-related risk, so Board Governance is the best fit. Its specificity rises to Quantified-Verifiable because it includes a dated, concrete claim about developing the Employee Self Service portal in 2022, along with a named internal system.


reasoning: The paragraph is a generic statement of potential cybersecurity harms and speculative consequences, not a description of governance, management, risk processes, third-party oversight, an actual incident, or a materiality assessment conclusion. It contains no domain-specific cybersecurity practices, firm-specific organizational details, or verifiable facts, so specificity is Generic Boilerplate.


reasoning: This paragraph is an executive biography describing Mr. Smith's business leadership roles and career history, with no substantive cybersecurity governance, management, process, incident, third-party risk, or strategy disclosure. Because it contains no qualifying cybersecurity-specific facts, its specificity is Generic Boilerplate.


fact: Chief Information Officer (CIO)

fact: CSO

fact: Zebra's current CIO was appointed to the role in March 2022

reasoning: This paragraph primarily describes management organization and responsibilities: the CIO’s reporting relationship, peer relationship to the CSO, and responsibility for executing cybersecurity risk mitigation plans. Specificity reaches Quantified-Verifiable because it includes firm-specific executive roles and the externally checkable claim that the current CIO was appointed in March 2022.


content_category: Risk Management Process

fact: The cybersecurity risk management program incorporates principles from the National Institute of Standards and Technology Cybersecurity Framework

fact: The program incorporates principles from the Center for Internet Security Top 18 Critical Security Controls Control Level Framework

fact: The program includes phishing tests conducted at least quarterly, with additional periodic phishing tests for high-risk employee groups

fact: The program includes cybersecurity tabletop exercises

reasoning: The paragraph primarily describes what the company’s cybersecurity program does—its controls, training, assessments, testing, response, and related operational practices—so it is best classified as Risk Management Process. Its specificity is Domain-Adapted because it uses cybersecurity-specific frameworks and practices (such as NIST CSF, CIS Controls, phishing tests, and cybersecurity tabletop exercises) but does not provide firm-unique organizational details or externally verifiable hard facts.


reasoning: The paragraph primarily describes how cybersecurity risk is incorporated into the company's broader risk management process, including annual assessment and evaluation activities, which makes Risk Management Process the best fit. Its language remains high-level and generic; the only potentially specific item is the Audit Committee, which does not count for specificity under the rules, so no qualifying specificity-elevating facts are present.


content_category: Incident Disclosure

fact: On June 21, 2023, Umpqua Bank was informed by a technology service provider about the incident

fact: The incident involved MOVEit file-sharing software

fact: The incident resulted in unauthorized acquisition of names and Social Security numbers or tax identification numbers of certain Umpqua Bank consumer and small business customers

fact: No Umpqua Bank account information was compromised in the Vendor Incident

fact: No information from Umpqua Bank commercial customers was involved in the Vendor Incident

fact: On June 22, 2023, Umpqua Bank emailed potentially affected consumer and small business customers

fact: In August 2023, notice was sent by U.S. mail to 429,252 Umpqua Bank customers

fact: Umpqua Bank is identified as a wholly-owned subsidiary involved in the incident

reasoning: This paragraph primarily describes a real cybersecurity event, including what happened, what data was affected, who was impacted, and the notification timeline, so it is Incident Disclosure. Its specificity is Quantified-Verifiable because it includes concrete dates, a named system (MOVEit), and a precise affected-customer count of 429,252.


reasoning: The paragraph primarily explains how the company evaluates and monitors cybersecurity risk from vendors and service providers, making Third-Party Risk the best fit. Its language is generic process description—due diligence, risk assessments, supplemental reviews, and monitoring of third parties—without domain-specific technical terms, firm-unique structures, or externally verifiable facts.


reasoning: This paragraph is a biographical description of a human resources executive and does not describe cybersecurity governance, management, risk processes, third-party risk, incidents, or strategy impacts. Because it contains no substantive cybersecurity disclosure, it is classified as None/Other and defaults to Generic Boilerplate.


fact: The management team includes a Chief Information Officer responsible for assessing and managing material cybersecurity risks

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on management responsibility and the Chief Information Officer’s role and experience rather than detailing specific program activities. Specificity is elevated to Firm-Specific because it names a senior cybersecurity/IT leadership role (Chief Information Officer), but it does not include hard verifiable numbers, dates, or named external firms.


fact: The company has an internal plan called the "Incident Management and Information Security Plan"

reasoning: The paragraph primarily describes oversight: the Risk Committee provides assurance to management and the Board regarding identification, evaluation, and mitigation of cybersecurity risks, which makes board-level governance the main focus. Specificity rises to Firm-Specific because it names a company-specific control artifact, the "Incident Management and Information Security Plan."


reasoning: The paragraph describes a general enterprise risk management role and does not provide substantive cybersecurity-specific governance, management, process, or incident information. It contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, so specificity remains generic boilerplate.


reasoning: The paragraph primarily gives a materiality assessment about whether cybersecurity threats or prior incidents have affected or are reasonably likely to affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts; the negative assertion, generic supplier/customer reference, and risk-factor cross-reference are boilerplate.


fact: ISC members include the CIO

fact: ISC members include the Director of IT Security, Risk and Compliance

fact: ISC is referenced as a specific internal committee/group

fact: The CIO and Director of IT Security, Risk and Compliance have a combined 20 years of risk management experience encompassing cybersecurity and technology security

fact: Experience includes threat assessments

fact: Experience includes cybersecurity insurance

fact: Experience includes incident response

fact: Experience includes end user awareness

fact: Experience includes vulnerability management

reasoning: This paragraph primarily describes how management is organized and qualified to handle cybersecurity, focusing on the roles and experience of ISC members rather than the operation of the cybersecurity program itself. Specificity is Quantified-Verifiable because it includes a checkable claim of a combined 20 years of relevant experience, along with firm-specific roles and several cybersecurity domain terms.


reasoning: The paragraph primarily provides a business-impact/materiality framing: it states that the company has not experienced recent material cybersecurity incidents and warns that future incidents could materially affect its business strategy, results of operations, or financial condition. It contains no qualifying domain-specific terminology, firm-specific organizational details, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors rather than providing substantive cybersecurity governance, management, process, third-party risk, incident, or strategy disclosure itself. Because it contains no qualifying specificity-relevant facts for annotation purposes, it is Generic Boilerplate.


fact: The Senior Vice President of Information Technology ("SVP IT") oversees cybersecurity-related monitoring processes

reasoning: The paragraph primarily describes what the cybersecurity program does—ongoing monitoring of information systems, vulnerability identification, and incident response—so it is best classified as Risk Management Process rather than Management Role. Its specificity is elevated to Firm-Specific by the named VP-level role, while the rest of the process language is mostly generic and does not add quantified or highly technical detail.


fact: The Cybersecurity Sub-Committee of the Board of Directors would be notified in the event of a material cybersecurity incident and would oversee the company's response and mitigation.

reasoning: This paragraph primarily describes board-level oversight of cybersecurity, including which board bodies receive updates and oversee incident response, so it is Board Governance. Its specificity is elevated by the firm-specific named board body, the Cybersecurity Sub-Committee of the Board of Directors; other details are largely generic governance language.


fact: The cybersecurity program is led by the Chief Information Officer (CIO).

fact: The CIO has more than 30 years of experience in information technology.

fact: The CIO previously served in chief information officer roles in the financial services, banking, healthcare, and hospitality sectors.

fact: The supporting cybersecurity team collectively holds a Master's in Cybersecurity.

fact: The supporting cybersecurity team collectively holds Certified Information Systems Security Professional (CISSP) certification.

fact: The supporting cybersecurity team collectively holds Certified Information Security Manager (CISM) certification.

fact: The supporting cybersecurity team collectively holds Microsoft Certified Cybersecurity Architect Expert certification.

fact: The supporting cybersecurity team collectively holds Graduate Certificates in Enterprise Cybersecurity and Data Science.

fact: The supporting cybersecurity team collectively holds Security+ certification.

fact: The supporting cybersecurity team collectively holds Certified Information Systems Auditor (CISA) certification.

reasoning: This paragraph primarily describes how management is organized and qualified to lead cybersecurity, centering on the CIO’s experience and the cybersecurity team’s credentials, so Management Role is the best fit. Specificity is Quantified-Verifiable because it includes externally checkable claims such as the CIO having more than 30 years of experience and the team holding named professional certifications.


fact: ransomware

fact: malware

fact: phishing attempts

reasoning: The paragraph primarily provides a business-risk/materiality-style assessment, including the statement that the company has not had material cybersecurity incidents and that it carries cyber insurance, which fits Strategy Integration more than incident description or process detail. Its specificity rises above boilerplate because it names concrete cyber threat types such as ransomware, malware, and phishing, but it does not include firm-specific organizational details or externally verifiable positive claims.


fact: On May 14, 2019, Retrieval-Masters Credit Bureau, Inc. d/b/a American Medical Collections Agency (AMCA) notified the Company about a security incident

fact: Retrieval-Masters Credit Bureau, Inc. d/b/a American Medical Collections Agency (AMCA) was the external collection agency involved

fact: The incident may have involved certain personal information of some of the Company's patients

fact: The Company is involved in pending and threatened litigation related to the AMCA Incident

fact: The Company is also subject to various government and regulatory inquiries and processes related to the AMCA Incident

reasoning: This paragraph primarily describes a real cybersecurity event, identifying when it was reported, who was involved, and the resulting litigation and regulatory inquiries, so it is best classified as Incident Disclosure. Specificity is Quantified-Verifiable because it includes a specific date and a named third party, both of which are externally checkable.


fact: managed services agreement with an external party for incident response

fact: assess our cyber maturity and readiness

fact: external parties assist with critical cyber-related infrastructure such as firewall maintenance and upgrade initiatives

reasoning: The paragraph primarily describes how the company’s cybersecurity program operates by using outside specialists to support incident response, assessments, and infrastructure security, so it is best classified as Risk Management Process rather than Third-Party Risk. Its specificity rises above boilerplate because it uses cybersecurity-specific concepts such as incident response, cyber maturity/readiness, and firewall maintenance, but it does not include named vendors, internal named roles, or verifiable quantified claims.


fact: The company has a global information security team called the IT Security Team.

fact: The IT Security Team is responsible for leading organization-wide cybersecurity strategy, policy, standards, and processes.

fact: The Head of Global IT and the IT Security Team perform due diligence on the IT security systems and processes of potential acquisition targets.

fact: Newly acquired companies are not permitted access to the company's IT networks or systems until they meet necessary security standards.

fact: The Head of Global IT's experience includes managing network and infrastructure security and a cyber security team.

fact: The IT Security Team includes employees with security certifications from organizations including CompTIA.

fact: The team has over 20 years of combined infrastructure architecture experience.

fact: The paragraph references PCI compliance.

fact: The paragraph references SOC1 compliance.

fact: The paragraph references SOC2 compliance.

reasoning: The paragraph primarily explains how management is organized and qualified to handle cybersecurity, focusing on the Head of Global IT, the IT Security Team, their responsibilities, and their experience. Specificity reaches Quantified-Verifiable because it includes a checkable numeric claim ('over 20 years of combined infrastructure architecture experience') along with several firm-specific team details and cybersecurity-specific terms.


reasoning: The paragraph primarily addresses how cybersecurity-related system failures or breaches could affect business operations, product sales, and financial reporting, and it includes a negative assertion that the company has not experienced material adverse cyber events to date. It does not provide qualifying domain-specific technical terms, firm-specific governance details, or externally verifiable facts, so the specificity remains generic boilerplate.


fact: System Organization and Control Reports (SOC Reports)

reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and external platforms, making third-party oversight the central topic. Its specificity rises above boilerplate because it references SOC Reports, a cybersecurity/compliance artifact that reflects domain-specific third-party assurance practices.


reasoning: The paragraph primarily explains how the company oversees cybersecurity risks posed by third-party service providers, making Third-Party Risk the best fit. Its language remains high-level and generic—annual evaluations, contractual safeguards, internal control report reviews, and incident response plan incorporation are described without cybersecurity-specific technical detail, firm-unique structures, or verifiable facts.


fact: The company is engaged with law enforcement and regulators and is defending litigation on an ongoing basis related to the incident.

fact: The company offered identity protection services, including credit monitoring, to all current and former customers for two years.

reasoning: The paragraph describes post-incident response and consequences, including regulatory/law-enforcement engagement, litigation, and customer remediation, so it is primarily an incident disclosure. Specificity is elevated to Quantified-Verifiable because it includes a concrete, checkable claim that identity protection and credit monitoring were offered for two years to all current and former customers.


fact: In July 2018, the Company experienced a ransomware incident.

fact: The incident was a ransomware incident.

fact: The incident affected certain Dx information technology systems.

fact: The incident temporarily affected certain other information technology systems involved in Company-wide operations.

fact: The investigation determined that the ransomware did not and could not transfer patient or client data outside Company systems.

fact: The investigation determined there was no theft or misuse of patient or client data.

reasoning: This paragraph primarily describes an actual cybersecurity event—its timing, affected systems, investigation findings, and impact—so it is Incident Disclosure. Specificity is Quantified-Verifiable because it includes a specific date ('July 2018') and other concrete incident details, with 'ransomware' also adding domain-specific terminology.


fact: Chief Technology Officer is part of the cybersecurity risk governance model's first line of defense

fact: Technology Leadership Centre supports the first line of defense

fact: Controlling Department is part of the third line of defense

reasoning: The paragraph primarily describes the company's cybersecurity oversight structure using a three-lines-of-defense governance model that includes board-level committees, so Board Governance is the best fit. Its specificity rises to Firm-Specific because it names internal roles and organizational units such as the Chief Technology Officer, Technology Leadership Centre, and Controlling Department.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity incidents have not had a material impact on the company’s business strategy, financial condition, or results of operations, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: The company has a committee known as the Cyber ERM (Enterprise Risk Management) Committee.

reasoning: The paragraph primarily explains the governance chain for cybersecurity incidents—specifically how the Cyber ERM Committee reports incidents to the Audit Committee and Board so they can assess materiality and disclosure obligations. Its specificity rises above boilerplate because it identifies a firm-specific named committee, but it does not include externally verifiable numbers, dates, or named external firms.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk from vendors and service providers, including due diligence, contractual requirements, and incident notification obligations, so Third-Party Risk is the best fit. Its language remains generic and process-level without cybersecurity-specific technical terms, firm-unique structures, or externally verifiable facts, so specificity is Generic Boilerplate.


fact: Uses threat intelligence services to respond to emerging cybersecurity threats

fact: Third parties are required to maintain certain security controls

reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from vendors and service providers, making Third-Party Risk the best fit. Its specificity is elevated by cybersecurity-specific terminology such as threat intelligence services and security controls, but it does not include firm-unique roles, committees, dates, numbers, or other externally verifiable facts.


fact: On October 11, 2023, the company announced disruptions in its Information Technology infrastructure and applications resulting from a cybersecurity incident.

fact: The company identified unauthorized activity in its IT systems and took steps to stop, remediate, and investigate the activity.

fact: The company notified relevant law enforcement about the incident.

fact: The incident disrupted business operations for approximately three days.

fact: The company restored operations within three days.

fact: The company fulfilled the backlog of orders caused by the disruption within one week.

reasoning: This paragraph primarily describes a real cybersecurity incident, including when it occurred, what happened, how the company responded, and the operational consequences, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a precise date and concrete, checkable timing details about the disruption and recovery.


fact: On February 16, 2022, the company became aware of a cybersecurity intrusion

fact: The intrusion caused a network disruption and impacted certain of the company's systems

reasoning: The paragraph is primarily about an actual cybersecurity event—when it was discovered, what happened, and the immediate response—so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a concrete, externally checkable event date tied to a real intrusion.


fact: The Information Security Program refers to the FFIEC framework

fact: The Information Security Program refers to guidance and best practices from NIST

fact: The paragraph references the confidentiality, integrity, and availability of sensitive information and systems

fact: The program uses risk mitigation controls and processes in its design

reasoning: The paragraph primarily explains how the company designs its cybersecurity program, especially by using external frameworks and controls, which makes it a risk management process disclosure rather than governance or strategy. Its specificity rises above boilerplate because it names cybersecurity frameworks (FFIEC and NIST) and uses domain concepts like confidentiality, integrity, and availability, but it does not include firm-unique organizational facts or externally verifiable quantified claims.


reasoning: This paragraph is primarily forward-looking cautionary language about potential cyber threats and a cross-reference to risk factors, rather than a substantive description of governance, management, risk processes, third-party risk, incident disclosure, or strategy assessment. Under the rules, such speculative and cross-referential language falls into None/Other, and None/Other paragraphs are classified as Generic Boilerplate.


reasoning: This paragraph is a high-level statement of commitment and shared responsibility, rather than a substantive description of board oversight, management organization, or cybersecurity processes. Because it is best classified as None/Other, it is treated as Generic Boilerplate under the annotation rules.


fact: penetration testing

fact: information security risk assessments

fact: security posture

reasoning: The paragraph is primarily about how the company manages cybersecurity risk from third-party service providers through assessments, monitoring, required safeguards, and contractual protections, so Third-Party Risk is the best fit. Its specificity rises above boilerplate because it uses cybersecurity-specific terminology such as penetration testing and security posture, but it does not include firm-unique roles, named programs, or externally verifiable facts.


fact: The company assigns cybersecurity oversight responsibilities to its CSO

fact: The CSO regularly informs the Chief Information Officer and other senior management members about cybersecurity risks and incidents

reasoning: The paragraph primarily describes management-level roles and reporting lines: the CSO’s oversight involvement and communication to the CIO and senior management. Its specificity is elevated by firm-specific leadership roles (CSO and Chief Information Officer), but it does not include externally verifiable numbers, dates, or named third-party firms.


fact: On February 16, 2022, the company became aware of a cybersecurity intrusion.

fact: The intrusion caused a network disruption and impacted certain of the company’s systems.

reasoning: The paragraph is primarily about a real cybersecurity event—when it was discovered, what happened, and how the company responded—so Incident Disclosure is the best fit. Its specificity reaches Quantified-Verifiable because it includes a concrete, externally checkable date tied to the incident.


fact: References continuity of our information systems and networks and operational technology as part of cybersecurity-related risk areas

reasoning: The paragraph primarily describes, at a high level, that the company develops and maintains systems and programs to mitigate cybersecurity incidents, which fits risk management process more than governance or incident disclosure. Specificity rises slightly above boilerplate because it includes the domain-specific concept of operational technology, but otherwise remains very general and non-firm-specific.


fact: The Custodian is contractually required to implement cybersecurity and data protection measures and to require its critical vendors to do the same.

fact: The contract requires the Custodian to inform MetLife, Inc. of any actual or reasonably suspected data security incident.

fact: The incident trigger includes loss, compromise, unauthorized use, access, or disclosure of information provided under the contract.

reasoning: The paragraph is primarily about how a third party (the Custodian) and its vendors are contractually required to manage cybersecurity risk and report incidents, so Third-Party Risk is the best fit. Specificity is elevated by the named firm MetLife, Inc. and the concrete contractual reporting obligation, along with specific incident terminology.


reasoning: The paragraph primarily provides management’s materiality assessment: it states that no known cybersecurity incidents have materially affected the company and that cyber threats are not reasonably likely in the near term to materially affect business strategy, results of operations, or financial condition. Its specificity remains generic because the dated statement is still a negative self-assertion about absence/materiality, which does not count as an externally verifiable fact under the rubric.


reasoning: The paragraph primarily provides a business-impact/materiality assessment, stating that the company has not experienced a cybersecurity threat or incident with a material adverse impact to date and discussing possible effects on business, financial condition, and results of operations. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily describes how cybersecurity risk is incorporated into the company’s ERM and audit planning process, which makes it about the risk management process rather than management organization or board oversight. It contains no qualifying domain-specific cybersecurity terminology, firm-specific cybersecurity roles/committees, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes the company’s cybersecurity program activities—enterprise processes, policies, standards, and regulatory monitoring—so it fits Risk Management Process. Its language remains high-level and generic, with no qualifying firm-specific or externally verifiable facts and no clearly elevating cybersecurity-domain detail under the ERM test.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks posed by third-party service providers, including review, contractual obligations, and reassessments. Its language remains generic and does not include cybersecurity domain terms that pass the ERM test, firm-specific structures, or verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk through reports, updates, and incident escalation, which is board-level oversight. It does not include qualifying domain-specific terminology, firm-unique governance structures, or externally verifiable facts beyond generic board reporting language.


fact: The CISO has more than 20 years of cybersecurity experience.

fact: The CIO has more than 30 years of experience.

fact: The CIO previously held business and technology leadership roles at Aegon N.V., Citigroup, Inc. and JP Morgan Chase & Company.

fact: Prior to joining the company, the CISO was Senior Vice President, Chief Information Security Officer at Brighthouse Financial.

fact: The CISO served as Technology Vice President & Chief Information Security Officer for GE Healthcare.

fact: The CISO started his career at Allstate Insurance Company.

fact: The company has a CISO role.

fact: The CISO holds security, privacy and risk certifications including Certified Information Systems Auditor (CISA), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP).

reasoning: This paragraph primarily describes management organization through the qualifications and prior experience of the CIO and CISO, so it fits Management Role rather than a process category. Specificity is Quantified-Verifiable because it includes externally checkable facts such as years of experience, prior employers and titles, and named certifications.


fact: Chief Information Security Officer oversees the Company's Trust, Security and Reliability department

fact: Cybersecurity Risk Management Team

reasoning: The paragraph primarily explains how management is organized to carry out cybersecurity responsibilities—identifying the CISO, the department the CISO oversees, and the Cybersecurity Risk Management Team—rather than describing the substantive cybersecurity program itself. Specificity is Firm-Specific because it includes company-specific organizational elements such as the CISO role and named internal teams/departments, but no externally verifiable dates, quantities, or certifications.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks posed by vendors, including due diligence, risk assessments, and contractual requirements, so Third-Party Risk is the best fit. Its language is generic and does not include qualifying domain-specific technical terms, firm-unique organizational details, or externally verifiable facts.


fact: The Audit and Compliance Committee supports the Board’s oversight of cybersecurity risk management.

fact: The Director - Information Systems serves as the Company’s chief information officer.

reasoning: This paragraph primarily describes how the Board oversees cybersecurity risk, including delegation to a board committee and interaction with management, so Board Governance is the best fit. Specificity is Firm-Specific because it names a company-specific committee and identifies the Director - Information Systems as the chief information officer, but it does not include externally verifiable quantified claims.


reasoning: This paragraph is a cross-reference directing readers to Item 1A for discussion of cybersecurity-related risks rather than providing substantive disclosure about governance, management, process, incidents, third parties, or strategy itself. Because it contains no qualifying domain, firm-specific, or verifiable cybersecurity facts, it is generic boilerplate.


fact: The company states cybersecurity is critical to advancing its "21st Century Security" vision.

fact: ransomware

fact: denial-of-service

fact: nation state actors

fact: defense industrial base

fact: critical infrastructure sectors

reasoning: The paragraph primarily frames cybersecurity in terms of its importance to the company’s business strategy and operations, especially by tying it to the company’s named strategic vision and digital transformation efforts rather than describing governance or specific program activities. Specificity rises to Firm-Specific because it includes the company-unique "21st Century Security" vision, and it also uses several cybersecurity domain terms such as ransomware, denial-of-service, and nation state actors.


fact: The CRO, CIO and CISO each have over 15 years of experience managing cybersecurity, information technology and other risk management processes.

fact: The CRO has more than 30 years of experience.

fact: CRO (Chief Risk Officer) is identified as a cybersecurity-related management role with oversight of operational risks including cybersecurity.

fact: CIO (Chief Information Officer) is identified as a senior technology leadership role.

fact: CISO is identified as the role responsible for implementing the company's cybersecurity risk management strategy.

fact: The CRO previously served as the Company's Global Chief Risk Officer.

fact: The CRO oversees RGA's Enterprise Risk Management program.

fact: The CRO led cybersecurity programs to enhance the Company's cybersecurity systems for compliance with Privacy and Security Regulations.

fact: The CIO leads RGA's global information technology operations.

fact: The CIO's experience includes digital transformation, core platform modernization, and data analytics modernization.

fact: The CISO oversees the Company's global security and privacy teams.

fact: The CISO's experience includes cybersecurity, data privacy, operational risk management, regulatory compliance, and risk quantification.

reasoning: This paragraph is primarily about management organization and qualifications: it details the responsibilities, reporting stature, and experience of the CRO, CIO, and CISO rather than describing the cybersecurity program itself. Specificity is Quantified-Verifiable because it includes externally checkable tenure claims such as over 15 years of experience for each executive and more than 30 years for the CRO.


reasoning: The paragraph is centrally about how the company manages cybersecurity risks from vendors and service providers, making Third-Party Risk the best fit. Although it describes a vendor oversight process, the language remains generic ERM-style disclosure without cybersecurity-specific domain terms, firm-unique organizational details, or externally verifiable facts.


fact: The Audit and Risk Committee receives cybersecurity information from the CISO and other members of management

fact: The CISO provides briefings on cybersecurity matters to the Audit and Risk Committee and the Board of Directors

reasoning: This paragraph primarily describes how the board and its committee oversee cybersecurity through regular reporting and briefings, which is board governance. Its specificity rises to Firm-Specific because it identifies the company's CISO and the Audit and Risk Committee, but the timing references are generic cadences rather than verifiable facts.


reasoning: The paragraph primarily describes reliance on third parties, including service providers and consulting firms, to help identify, assess, and manage cybersecurity risks, making third-party risk the best fit. Its statements are generic and contain no qualifying domain-specific terminology, firm-unique organizational details, or externally verifiable facts; the negative materiality assertion does not elevate specificity.


fact: The Risk Committee of the Board ultimately oversees the company's cyber risk management strategy.

fact: The Global Security Organization is tasked with executing the cyber risk management strategy.

fact: The Global Security Organization reports cyber risks to the ERM Steering Committee, the Risk Committee of the Board, or the Board, as appropriate.

fact: The CSO serves as an advisor to the Company's Disclosure Committee.

fact: The ERM Steering Committee is part of the reporting/escalation structure for cybersecurity risks.

fact: The Company's Disclosure Committee is identified as part of the cybersecurity governance structure.

reasoning: This paragraph primarily explains the oversight chain for cybersecurity, especially how management escalates cyber risk to the Risk Committee of the Board and other board-level bodies, which makes it Board Governance. Its specificity is Firm-Specific because it names internal roles, teams, and committees such as the Global Security Organization, ERM Steering Committee, CSO, and Disclosure Committee, but does not provide externally verifiable quantified facts.


fact: Information Technology Automated Solutions (ITAS) contract owners validate vendor certifications throughout the life of the agreement

reasoning: The paragraph is primarily about how the company manages cybersecurity risks from third-party service providers through pre-engagement assessments, contractual requirements, and ongoing audits, so Third-Party Risk is the best fit. Its specificity is elevated to Firm-Specific by the named internal group Information Technology Automated Solutions (ITAS); the rest of the language is mostly generic vendor-risk process description.


reasoning: This paragraph primarily describes how cybersecurity information flows to and through the board, so it is about board oversight structure. It contains no qualifying domain-specific terminology, firm-specific governance facts, or externally verifiable claims beyond generic board and audit committee reporting language.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which squarely fits Strategy Integration. Its remaining content is generic cautionary language and a cross-reference, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: References advanced cybersecurity threats and attack vectors

reasoning: The paragraph primarily makes a business-impact/materiality statement by saying the company has not experienced material cybersecurity events to date but that cyber threats could materially affect its business, results, or financial condition, which fits Strategy Integration. Its specificity rises above boilerplate only because it uses cybersecurity-specific terminology such as 'attack vectors'; the negative assertion about no material events is not externally verifiable.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from vendors, service providers, and other third-party systems, making Third-Party Risk the best fit. It uses generic risk-management language without any domain-specific security terminology, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


fact: The board receives periodic updates from the Chief Information Officer

fact: The board receives periodic updates from the Executive Director of Information Security

fact: The updates cover the ISMS

fact: The updates cover the company's information security governance framework

reasoning: This paragraph primarily describes how the board and its committee oversee cybersecurity-related risk and how information flows up to the board, which makes it Board Governance. Specificity rises to Firm-Specific because it names company-specific management roles involved in board reporting, and it also includes cybersecurity domain terminology such as ISMS.


fact: The Board oversees the Company's ERM program, including cybersecurity threat risks.

fact: The Board has not delegated cybersecurity oversight responsibility to any board committee or subcommittee.

reasoning: The paragraph primarily explains how the board oversees cybersecurity risk, including the fact that oversight remains with the full Board rather than a committee, so Board Governance is the best fit. Specificity rises above boilerplate because it gives company-specific governance structure details, but it does not include externally verifiable dates, quantities, or named certifications/firms.


reasoning: This paragraph is a forward-looking cautionary statement and cross-reference to Risk Factors rather than a substantive disclosure about governance, management, processes, third-party risk, incidents, or strategy. It contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, so the specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality and business-impact assessment of cybersecurity incidents and notes cyber risk insurance, so it is best categorized as Strategy Integration. Its statements are generic and include a negative assertion about no material adverse effect, which is not externally verifiable, so no qualifying specificity-elevating facts are present.


fact: firewalls

fact: intrusion prevention systems

fact: endpoint detection and response systems

fact: access controls

fact: vulnerability assessments

fact: cybersecurity threat intelligence

reasoning: The paragraph primarily describes the company’s cybersecurity program activities and technical controls, so it is best classified as Risk Management Process. Its specificity is Domain-Adapted because it uses concrete cybersecurity terminology such as intrusion prevention, endpoint detection and response, vulnerability assessments, and threat intelligence, but does not include firm-specific or externally verifiable facts.


reasoning: The paragraph primarily explains how material cybersecurity incidents are escalated to and overseen by the Board of Managers, including notification and update flows, which makes board oversight the central topic. Its details remain generic for specificity purposes because the cited roles and procedures (CEO, CFO, board notification, incident response procedures, third-party service provider) are standard and do not include qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: On February 13, 2023, the company disclosed a security breach

fact: The incident involved a third-party vendor's secure file transfer software platform used by the company's subsidiaries

fact: Personal information of certain patients of the company's healthcare facilities was exposed to the attacker

fact: secure file transfer software platform

reasoning: The paragraph primarily describes an actual cybersecurity event, including what happened and when, so it is best classified as Incident Disclosure. Specificity reaches Quantified-Verifiable because it includes a precise incident date and concrete, checkable details about the breach and the affected data.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from vendors, service providers, and other external parties, making Third-Party Risk the best fit. It remains generic boilerplate because it gives only high-level oversight language without any cybersecurity-specific domain terms, firm-specific structures, or verifiable details.


reasoning: The paragraph primarily frames cybersecurity in terms of potential and actual material effects on the company’s business, strategy, results of operations, and financial condition, including the explicit statement that the company does not believe it has experienced a material incident. Its language is high-level and generic, with no qualifying domain-specific technical terms, firm-specific organizational details, or externally verifiable facts that would raise specificity above boilerplate.


fact: protect the confidentiality, integrity, and availability of our data

reasoning: The paragraph primarily describes the company's cybersecurity program objective and risk management approach, so it best fits Risk Management Process. Its specificity rises above boilerplate because it uses the security-specific CIA triad concept ('confidentiality, integrity, and availability'), but it does not include firm-specific roles, committees, or verifiable details.


fact: The CISO briefs the Company's Audit Committee on cybersecurity matters.

fact: The briefings cover the same types of information presented to the Cybersecurity Executive Committee.

fact: The Audit Committee is composed of the two members of the Board of Directors who are also members of the Cybersecurity Executive Committee.

reasoning: The paragraph primarily describes how cybersecurity information flows from management to a board committee, which makes it a board oversight disclosure. Its specificity reaches Quantified-Verifiable because it includes firm-specific governance roles and committees and a concrete, checkable claim that two board members serving on the Audit Committee also serve on the Cybersecurity Executive Committee.


reasoning: The paragraph primarily explains how the company evaluates and imposes requirements on third-party vendors, especially those with access to customer information or the network, so Third-Party Risk is the best fit. Its language remains generic and ERM-style—vendor evaluation, confidentiality obligations, and legal compliance—without cybersecurity-specific domain terms that pass the ERM test, firm-unique organizational details, or verifiable facts.


fact: The cybersecurity program is overseen by the Vice President of IT & Digitization.

fact: The company refers to the Vice President of IT & Digitization and information technology team collectively as the "IT Team."

reasoning: The paragraph primarily explains who in management is responsible for cybersecurity and how that responsibility is organized, which makes it a Management Role disclosure. Its specificity is Firm-Specific because it identifies a company-specific leadership role and named internal team, but provides no quantified or externally verifiable facts.


reasoning: The paragraph primarily describes the company’s cybersecurity risk management activities—specifically how it assesses cyber risk—so Risk Management Process is the best fit. However, it uses generic enterprise-risk language about risk assessments, likelihood, damage, and safeguards without domain-specific cybersecurity terminology, firm-unique organizational details, or verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes how the Board and a board-level committee are informed about cybersecurity matters, which is board oversight rather than management organization or program activities. It contains no qualifying domain-specific terminology, firm-specific cybersecurity roles/structures, or externally verifiable facts, so specificity remains generic boilerplate.


fact: The Company has a named Cybersecurity Team within the Information Technology department

fact: The Cybersecurity Team reports to the Company's Vice President and Chief Information Officer (CIO)

fact: The team is led by the Company's Chief Information Security Officer (CISO)

fact: The CISO has primary responsibility for oversight of the Company's assessment, identification, and management of cybersecurity risks

fact: The CISO has 27 years of cybersecurity experience

fact: 17 of the CISO's 27 years of experience are in the oil and gas industry

fact: The CISO is one of less than 400 CISOs globally that has graduated from the FBI's CISO Academy

fact: The FBI's CISO Academy in Quantico, Virginia is specifically identified

fact: The Company's Cybersecurity Executive Committee is specifically named

reasoning: This paragraph primarily explains how management is organized for cybersecurity, including the Cybersecurity Team, reporting lines, leadership responsibilities, and escalation roles, so Management Role is the best fit. Specificity is Quantified-Verifiable because it includes externally checkable claims such as the CISO's 27 years of experience, 17 years in oil and gas, and graduation from the FBI's CISO Academy with the 'less than 400' qualifier.


fact: The company has appointed an "IS Steering Committee" to oversee the vendor management program.

fact: The IS Steering Committee is chaired by the Chief Information Officer.

reasoning: The paragraph primarily explains how the company manages risks arising from third-party service providers and outsourcing arrangements, making Third-Party Risk the best fit. Specificity rises to Firm-Specific because it includes company-specific organizational details—the IS Steering Committee and the Chief Information Officer—without any hard, externally verifiable quantitative claim.


reasoning: The paragraph primarily describes which member of management is responsible for cybersecurity oversight, so it fits Management Role. It does not include qualifying domain-specific cybersecurity terminology, firm-unique organizational details, or verifiable claims, so specificity remains Generic Boilerplate.


fact: The company states that material cybersecurity risks are managed through its enterprise information security program.

fact: The enterprise information security program is maintained by the Chief Information Security Officer (CISO).

fact: The program is overseen by the Executive Vice President and Chief Information Officer (CIO).

reasoning: The paragraph primarily answers how the company manages cybersecurity risk by stating that it uses an enterprise information security program, so Risk Management Process is the best fit. Specificity rises to Firm-Specific because it names firm-level cybersecurity leadership roles—the CISO and the Executive Vice President and CIO—even though the process description itself is otherwise generic.


fact: conducting vulnerability scans related to vendors' services

reasoning: The paragraph primarily explains how the company manages cybersecurity risks from vendors and other external providers, making Third-Party Risk the best fit. Specificity rises above boilerplate because it includes the cybersecurity-specific practice of vulnerability scanning, but it does not include firm-unique roles, committees, or externally verifiable claims.


reasoning: This paragraph is a cross-reference directing readers to another section for additional discussion of cybersecurity risks, rather than describing governance, management, processes, third-party risk, incidents, or strategy impacts. Because it contains no qualifying domain-specific, firm-specific, or verifiable cybersecurity facts, its specificity is Generic Boilerplate.


fact: Director of Information Security

fact: The Director of Information Security has over 30 years of experience in information technology and information security

fact: The Director of Information Security is a Certified Information Systems Security Professional (CISSP)

fact: OD Technology Department

reasoning: The paragraph is primarily about how management is organized to handle cybersecurity, centered on the Director of Information Security’s qualifications, responsibilities, and coordination/reporting role. Specificity is Quantified-Verifiable because it includes externally checkable facts: over 30 years of experience and CISSP certification, along with firm-specific organizational details such as the Director role and OD Technology Department.


reasoning: The paragraph primarily describes how the company handles cybersecurity incidents through its incident response process, so it fits Risk Management Process. However, it only provides generic process elements—such as an incident response plan, severity evaluation, and law enforcement engagement—without cybersecurity-domain terms that pass the ERM test, firm-specific organizational details, or verifiable facts.


fact: The Board has a "Cybersecurity Special Committee" that receives reports on incident response and breach management processes.

reasoning: The paragraph primarily describes the company’s incident response and breach management activities—preparation, detection/analysis, containment/recovery, and post-incident review—so it is best categorized as Risk Management Process. Its specificity rises to Firm-Specific because it names a company-specific board body, the Cybersecurity Special Committee; the rest of the process description is otherwise generic.


fact: In February 2022, the company determined it was the subject of a targeted cyber-attack

fact: The attack resulted in shutting down most of the company's connectivity, operating, and accounting systems globally

fact: The company had limited ability to conduct operations for approximately three weeks

fact: The disruption affected activities including arranging freight shipments and managing customs and distribution activities

fact: The company accelerated investments in its CSRM program after the attack

fact: The company added a Chief Information Security Officer (CISO) to its IS leadership

reasoning: The paragraph primarily describes a real cybersecurity event, including when it occurred, what systems were affected, operational disruption, and subsequent response, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes externally checkable facts such as the February 2022 timing and the approximately three-week operational impact, along with a firm-specific CISO role.


fact: In early April 2023, the company detected a cybersecurity incident.

reasoning: The paragraph primarily describes an actual cybersecurity incident and the company’s response steps, which makes it Incident Disclosure. Its specificity is Quantified-Verifiable because it includes a concrete timeframe tied to a real event: detection of the incident in early April 2023.


reasoning: The paragraph primarily describes general cybersecurity measures the company says it maintains—investing in cybersecurity and adapting controls and processes to protect systems—so it fits Risk Management Process more than the other categories. It contains no qualifying domain-specific cybersecurity terms, firm-specific organizational details, or externally verifiable facts, so the specificity is Generic Boilerplate.


fact: The incident involved ransomware actors

fact: The actors may have exfiltrated personal information from the company's systems

reasoning: The paragraph primarily describes what was learned and done in connection with a real cybersecurity incident, so it is an Incident Disclosure. Its specificity is elevated by cybersecurity-specific incident details such as ransomware and exfiltration, but it does not include firm-unique roles/structures or externally verifiable dates, numbers, or named third parties.


reasoning: The paragraph primarily describes the Board’s overall oversight structure for risk management, emphasizing the Board’s ultimate responsibility and the role of board committees, which fits Board Governance. It contains no qualifying cybersecurity-specific domain terms, firm-unique cyber roles/committees, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: Periodic assessments are conducted by the Chief Information Security Officer (CISO)

reasoning: The paragraph primarily explains how the company oversees cybersecurity risks arising from third-party service providers, making Third-Party Risk the best fit. Specificity rises above boilerplate because it identifies a firm-specific cybersecurity leadership role—the CISO—as part of the monitoring process, but it does not include quantified or independently verifiable details.


reasoning: This paragraph is a cross-reference directing the reader to another section for discussion of cybersecurity risks, rather than providing substantive disclosure about governance, management, processes, third-party risk, incidents, or strategy impact. Because it contains no qualifying domain-specific, firm-specific, or verifiable cybersecurity facts, its specificity is Generic Boilerplate.


fact: Cybersecurity policies, standards, processes and practices are integrated into the company's enterprise risk management program

fact: The company's cybersecurity program is based on frameworks established by the National Institute of Standards and Technology (NIST)

fact: The company's cybersecurity program is based on frameworks established by the International Organization for Standardization (ISO)

fact: The approach emphasizes preserving the confidentiality and availability of information while identifying, preventing, mitigating, and remediating cybersecurity threats

reasoning: The paragraph primarily describes how the company's cybersecurity program is structured and operated, including ERM integration, framework alignment, and core risk-management activities, which makes Risk Management Process the best fit despite the opening reference to board oversight. Specificity is Domain-Adapted because it uses cybersecurity-specific concepts and recognized frameworks such as NIST and ISO, but does not include firm-unique organizational details or externally verifiable quantitative claims.


reasoning: The paragraph primarily describes the company's cybersecurity/information security program at a high level—emphasizing that it is integrated into operations and uses a cross-functional approach—so it best fits Risk Management Process. It contains no qualifying domain-specific technical terms, firm-unique roles or committees, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph is purely forward-looking and speculative about potential cyberattacks and business dependence on security, without describing actual governance, management roles, risk processes, third-party oversight, incidents, or a materiality assessment. Because it contains no qualifying domain-specific, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


fact: malware

fact: computer virus attacks

reasoning: The paragraph primarily provides a materiality assessment by stating that cybersecurity risks and threats have not materially affected the company’s business strategy, results of operations, or financial condition to date, which fits Strategy Integration. Its specificity rises above boilerplate because it references concrete cyber threat types—malware and computer virus attacks—but it contains no firm-specific organizational details or externally verifiable claims.


reasoning: The paragraph primarily explains how the board oversees cybersecurity risk by describing the board’s risk oversight role and delegation of oversight responsibility to the audit committee. Its language is generic governance boilerplate and does not include qualifying domain-specific terminology, firm-unique roles/committees beyond excluded generic ones, or externally verifiable facts.


fact: Service Organization Controls (SOC) reports are used in third-party due diligence questionnaires

reasoning: The paragraph primarily explains how the company evaluates and monitors cybersecurity risks posed by vendors and other service providers, making Third-Party Risk the best fit. Its specificity is elevated by the use of cybersecurity-specific evidence in vendor review—SOC reports—but it does not include a clearly firm-unique or externally verifiable fact.


fact: The company has experienced cyberattacks and attempted breaches, including phishing emails and other targeted attacks

fact: In the fourth quarter of fiscal year 2019, the company experienced a ransomware incident

fact: The ransomware incident encrypted information on the company’s systems and disrupted customer and employee access to systems and services

fact: The company retained third party consultants and forensic experts to assist with restoration, remediation, and investigation of the attack

fact: Law enforcement assisted in investigating the attack

fact: The incident led to increased expenditures for IT infrastructure, systems, and network

fact: The ransomware incident adversely affected operations and the company’s fourth quarter 2019 revenue

reasoning: This paragraph primarily describes an actual past cybersecurity event—its nature, timing, response, and operational effects—so it is best classified as Incident Disclosure. Specificity reaches Quantified-Verifiable because it includes a concrete, externally checkable timeframe tied to a real ransomware incident in the fourth quarter of fiscal year 2019.


reasoning: The paragraph primarily explains how cybersecurity risks from third-party vendors are assessed, contractually managed, and monitored, making Third-Party Risk the best fit. Its descriptions remain generic process language without qualifying domain-specific technical terms, firm-unique structures, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph is primarily about how the company oversees cybersecurity expectations for third-party service providers, making Third-Party Risk the best fit. It remains generic boilerplate because it describes vendor security obligations only at a high level and does not include qualifying domain-specific terminology, firm-specific organizational details, or verifiable facts.


fact: Chief Information Security Officer (CISO) leads the cybersecurity risk management program

reasoning: The paragraph primarily explains what the company's cybersecurity program does—assessing, identifying, managing, reporting, responding to, and recovering from cyber risks—so Risk Management Process is the best fit. Its specificity rises above boilerplate because it includes a firm-specific leadership fact: the program is led by the CISO; the remaining language is largely general and not quantified or independently verifiable.


fact: One member of the Board of Directors, Paresh Patel, has information technology expertise.

reasoning: The paragraph primarily describes how the board oversees cybersecurity through receiving reports and identifies board-level expertise, which is board governance. Specificity rises to Firm-Specific because it names a specific board member, Paresh Patel, in the cybersecurity/technology oversight context, but includes no externally verifiable quantitative claim.


reasoning: This paragraph is a cross-reference directing the reader to risk factors and contains only hypothetical material-adverse-effect language, not a substantive disclosure about governance, management, processes, third-party risk, incidents, or strategy. Because it provides no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph is a generic introductory statement that the company relies on digital technology and therefore faces security risks; it does not describe board oversight, management roles, a cybersecurity program, third-party risk management, an actual incident, or a materiality/business-impact assessment. It contains no domain-specific cybersecurity terminology, firm-specific organizational facts, or verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily explains that the Board oversees cybersecurity as part of the company's broader risk management and ERM structure, which makes Board Governance the best fit. It does not include qualifying domain-specific technical terminology, firm-unique governance details, or externally verifiable facts beyond generic oversight and risk-management language.


fact: Day-to-day cybersecurity efforts are led by the Chief Technology and Digital Officer

fact: Day-to-day cybersecurity efforts are led by the Senior Vice President, Technology

fact: The Chief Technology and Digital Officer has over 10 years of networking and information technology management or executive experience

fact: The Senior Vice President, Technology has over 25 years of networking and information technology management or executive experience

fact: The company has a Cybersecurity Committee

fact: The Cybersecurity Committee is comprised of representatives from accounting, finance, legal, internal audit, and information technology

reasoning: The paragraph primarily explains how management is organized to lead cybersecurity operations, emphasizing named executives, their experience, and the management-level Cybersecurity Committee’s composition and responsibilities. Specificity reaches Quantified-Verifiable because it includes externally checkable experience claims of over 10 and 25 years, along with firm-specific roles and a named committee.


reasoning: The paragraph primarily provides management's conclusion about whether cybersecurity risks have materially affected or are reasonably likely to affect the business, strategy, results, or financial condition, which is a Strategy Integration disclosure. It contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, so specificity is Generic Boilerplate.


fact: The corporate information security organization is led by the CISO.

fact: The CISO is responsible for overall information security strategy, policy, security engineering, operations, and cyber threat detection and response.

fact: The paragraph references security engineering.

fact: The paragraph references cyber threat detection and response.

fact: The paragraph references system resilience.

fact: The current CISO has a certificate in Cybersecurity Oversight.

fact: The certificate is from the Carnegie Mellon University Software Engineering Institute.

reasoning: The paragraph primarily explains how management is organized for cybersecurity by describing the corporate information security organization, the CISO’s leadership responsibilities, and the CISO’s qualifications. Specificity reaches Quantified-Verifiable because it includes an externally checkable credential claim tied to a named institution, in addition to firm-specific role details and domain terminology.


reasoning: This paragraph is a cross-reference directing readers to risk factors elsewhere in the filing rather than describing the company's cybersecurity governance, management, process, third-party oversight, incident, or strategy assessment. Because it contains no substantive cybersecurity disclosure in this paragraph itself, it is classified as None/Other with Generic Boilerplate specificity.


reasoning: The paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity and how information flows upward to them, so it is best categorized as Board Governance. Although it mentions information security programs, audits, vendors, and an advisor, those references are generic and do not include qualifying domain-specific, firm-unique, or externally verifiable facts under the specificity rules.


reasoning: This paragraph is a cross-reference to risk factors and contains hypothetical, forward-looking risk language about potential consequences of cybersecurity threats rather than describing governance, management, processes, third-party risk management, an actual incident, or a materiality assessment. Because it provides no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: This paragraph primarily describes how the Board and Audit Committee oversee cybersecurity through discussions, updates, and consideration of cyber risks, which makes it a Board Governance disclosure. It contains only generic oversight language and generic governance actors, with no qualifying domain-specific terminology, firm-specific facts, or externally verifiable claims.


reasoning: This paragraph is a cross-reference to risk factors and contains hypothetical adverse-effect language rather than describing cybersecurity governance, management, processes, third-party risk practices, incident details, or strategy assessments. Because it provides no substantive cybersecurity measure or company-specific operational detail, it is generic boilerplate.


reasoning: The paragraph primarily states a conclusion about whether cybersecurity incidents have materially affected the company’s business strategy, results of operations, or financial condition, which makes it a Strategy Integration disclosure. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts beyond generic statements about threats, risk assessment, and investment in capabilities.


fact: The Company’s Enterprise Risk Management Committee oversees implementation and monitoring of the Information Security Policy and Program.

fact: The Company’s Chief Information Officer is included on the Enterprise Risk Management Committee.

fact: Testing includes a comprehensive Information Systems Audit.

fact: The company conducts internal and external penetration testing.

fact: Results are reviewed with the Risk Oversight Committee.

fact: The committee assesses information security risks in response to changes in the threat landscape, including cybersecurity incidents affecting financial institutions or their vendors.

reasoning: The paragraph primarily describes what the cybersecurity program does—audits, penetration testing, and periodic risk assessment—so it is best categorized as Risk Management Process rather than management structure. Its specificity rises to Firm-Specific because it includes company-specific governance elements such as the Enterprise Risk Management Committee, the CIO’s participation, and the Risk Oversight Committee, in addition to domain-specific terms like penetration testing.


fact: In early 2019, the company became aware of a ransomware attack affecting certain information technology systems

fact: ransomware attack

fact: critical business data was on affected systems

fact: the company commenced an investigation immediately following discovery

fact: the company recovered access to compromised systems and restored operations within weeks of the incident

fact: additional protective measures and internal control policies and procedures were implemented after the incident

fact: a professional cybersecurity investigation firm was retained to conduct a full forensic analysis

fact: forensic analysis

fact: no evidence of malware was found in the company environment

fact: no evidence of persistence mechanisms was found

fact: on-premises accounts were reviewed as part of the analysis

reasoning: This paragraph primarily describes a real cybersecurity event—its timing, nature, response, recovery, and investigation—so it is best classified as Incident Disclosure. Specificity reaches Quantified-Verifiable because it includes a dated incident reference ('early 2019') and a time-bounded recovery claim ('within weeks'), along with multiple cybersecurity-specific terms such as ransomware, forensic analysis, malware, and persistence mechanisms.


reasoning: The paragraph primarily explains how the Board and its Audit Committee oversee cybersecurity and information security risk, which makes it a board oversight/governance disclosure. Its language is high-level and generic, and the only named governance body is the Audit Committee, which does not count as a specificity-elevating fact under the rubric.


fact: In early 2024, Standard BioTools completed a merger with SomaLogic Operating Co., Inc.

fact: SomaLogic Operating Co., Inc.

fact: The company conducted a wholesale review of policies, procedures and tools relevant to the combined cybersecurity environment as part of integration activities.

fact: ISO 27001 compliance certification

fact: The SomaLogic organization has ongoing ISO 27001 compliance certification.

reasoning: The paragraph primarily describes cybersecurity integration and review activities following a merger, which makes it chiefly about the company’s risk management process rather than governance or strategy. Specificity reaches Quantified-Verifiable because it includes a time-anchored merger fact involving a named firm and a concrete claim about ongoing ISO 27001 certification.


reasoning: The paragraph primarily explains that the Company’s cybersecurity risk posture depends on its Investment Adviser and other third-party service providers, making third-party reliance the central topic. Its language is otherwise generic and contains no qualifying domain-specific, firm-specific, or externally verifiable facts that would raise specificity above boilerplate.


fact: The company uses third-party service providers to assess its information security program and provide an industry view of the cyberthreat landscape

fact: The paragraph references breach notification and response processes

reasoning: The paragraph primarily describes what the cybersecurity program does—using outside providers to assess the program, inform threat awareness, and support controls and response processes—so it fits Risk Management Process rather than Third-Party Risk. Specificity rises above boilerplate because it includes cybersecurity-domain concepts such as the cyberthreat landscape and breach notification/response processes, but it does not provide firm-unique or externally verifiable details.


fact: Depending on the incident, representatives from Legal/Compliance, Corporate Security, Internal Audit, Human Resources, Directors of Banking and Mortgage, and Corporate Communications may be included on the response teams for a particular investigation/response.

reasoning: The paragraph primarily describes how management brings in personnel from different business functions to participate on cyber investigation/response teams, which is about organizational roles and team composition rather than the underlying security process itself. Specificity rises to Firm-Specific because it provides a company-specific cross-functional set of participating areas, but it does not include hard verifiable facts such as dates, numbers, or named external firms.


fact: The Chief Technology Officer is tasked with assessing and managing significant cybersecurity risks across the company.

reasoning: The paragraph primarily describes management’s organizational responsibility for cybersecurity—specifically that the CTO is responsible for assessing and managing significant cyber risks, supported by the IT Director’s assessments—so it is about management roles rather than board oversight or program activities. Specificity rises to Firm-Specific because it identifies the CTO, a company-specific senior leadership role, but it does not include verifiable numbers, dates, certifications, or other externally checkable facts.


reasoning: This paragraph primarily describes the escalation and reporting path for cybersecurity matters from management to the audit committee and ultimately the board, which makes it a board oversight/governance disclosure. It does not contain qualifying domain-specific terms or allowable firm-specific/verifiable facts under the specificity rules; the roles and cadence mentioned are generic or excluded.


reasoning: The paragraph primarily describes how the board oversees cybersecurity by delegating oversight responsibility to a board committee and having that committee monitor management's program, which fits Board Governance. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts because references to the Board, Audit Committee, and a generic cybersecurity risk management program are boilerplate.


fact: The Senior Director of Information Technology has over 25 years of work experience in information technology and cybersecurity roles, including at public companies in the company's industry.

reasoning: The paragraph primarily describes which management personnel are responsible for implementing and maintaining cybersecurity processes and highlights their relevant experience, so it is about management organization rather than the underlying cyber program. Its specificity is elevated to Quantified-Verifiable by the externally checkable claim that the Senior Director of Information Technology has over 25 years of relevant experience.


reasoning: This paragraph is a cross-reference to risk factors and contains hypothetical, forward-looking language about potential adverse effects rather than describing actual cybersecurity governance, management, process, third-party oversight, incident details, or a concrete materiality assessment. Because it provides no substantive cybersecurity program detail, it is generic boilerplate.


fact: The company’s cybersecurity risk management and strategy processes are led by its CISO, CPO, CIO, and VP of Global IT Security.

fact: The paragraph identifies a VP of Global IT Security role.

fact: The paragraph identifies a CISO role.

fact: The paragraph identifies a CPO role.

fact: The paragraph identifies a CIO role.

fact: The company states its leaders hold certifications including Certified Information Systems Auditor.

fact: The company states its leaders hold certifications including Certified Information Systems Security Professional.

fact: The company states its leaders hold certifications including Fellow of Information Privacy.

fact: The company states its leaders hold certifications including Certified Information Privacy Professional.

fact: The cybersecurity and privacy offices are responsible for incident reporting and management.

fact: The paragraph identifies an Incident Response team.

fact: The Incident Response team includes cross-functional professionals and stakeholders globally.

fact: The team works to identify, respond, contain, and coordinate events threatening the security, confidentiality, integrity, and availability of information and information systems.

reasoning: This paragraph primarily describes who in management leads cybersecurity, their qualifications, and how responsibilities are organized, so Management Role is the best fit. Specificity reaches Quantified-Verifiable because it names concrete leadership roles and asserts that leaders hold specific professional certifications, which are independently checkable.


fact: ransomware attacks

fact: phishing attacks

fact: insider threats

fact: computer viruses or other malicious codes

fact: unauthorized access attempts

reasoning: The paragraph primarily answers whether cybersecurity has materially affected the business, concluding that none of the described cyber-incidents have had a material impact on Domtar’s business information systems or operations. Its specificity is Domain-Adapted because it uses concrete cybersecurity threat terminology such as ransomware, phishing, insider threats, malicious code, and unauthorized access attempts, but includes no firm-specific or externally verifiable facts.


reasoning: The paragraph primarily describes how cybersecurity information is escalated to and overseen by the Audit Committee and, potentially, the full Board, making board oversight the central topic. Although it mentions the CFO and consultants, those are generic roles and the paragraph contains no qualifying domain-specific, firm-specific, or externally verifiable facts that elevate specificity above boilerplate.


reasoning: The paragraph is primarily about how the Trust oversees cybersecurity risks arising from vendors and other service providers, making Third-Party Risk the best fit. Its language remains generic—describing a vendor management/oversight process and periodic reviews without any qualifying domain-specific controls, named frameworks, firm-unique roles/programs, or verifiable facts.


fact: The company identifies its hotel manager as Our Town.

reasoning: The paragraph is primarily about cybersecurity risk arising from third parties whose systems the company does not control—specifically its hotel manager and franchisors—so Third-Party Risk is the best fit. Specificity is elevated to Quantified-Verifiable because the paragraph names a specific external firm, Our Town, which is an externally identifiable and checkable fact.


reasoning: This paragraph is a cross-reference to Risk Factors and contains only hypothetical, forward-looking language about threats that may materially affect the company, rather than describing governance, management, processes, third-party risk, an actual incident, or a substantive materiality assessment. Because it provides no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides the company's materiality assessment of how cybersecurity risks have affected, and are reasonably likely to affect, its operations, strategy, results, and financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the statements are high-level conclusions and a cross-reference to risk factors.


reasoning: The paragraph primarily describes how the board oversees cybersecurity by delegating responsibility to a board committee and receiving management input, which fits Board Governance. It contains no qualifying domain-adapted, firm-specific, or externally verifiable facts because references to the Audit Committee and General Counsel are generic governance roles.


reasoning: The paragraph primarily provides a materiality assessment, stating that known cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company’s operations, strategy, results, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific terminology, firm-specific organizational details, or externally verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risk arising from vendors and service providers, so it is best categorized as Third-Party Risk. Its language is generic and process-level only; it includes no qualifying cybersecurity domain terms, firm-specific organizational details, or externally verifiable facts.


fact: Teknova's Vice President of Information Systems and Architecture (VP of IT) manages the Cybersecurity Program

fact: The Cybersecurity Program includes information security and data protection, including data privacy and network security

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity: the VP of IT's responsibilities, experience, and reporting lines. Specificity rises to Firm-Specific because it names a company-specific VP-level technology role; while it also uses domain terms like network security and data privacy, it does not provide named certifications, dates, numbers, or other externally verifiable claims.


reasoning: The paragraph primarily provides a materiality assessment that cybersecurity incidents or threats have not materially affected, and are not reasonably likely to materially affect, the company, which fits Strategy Integration under the SEC materiality rule. Its remaining content is generic incident/threat language and a cross-reference to Risk Factors, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: The company has a named 'Breach Response Team'

reasoning: The paragraph primarily describes a cybersecurity program activity—conducting tabletop exercises to simulate incident response and develop detection, mitigation, and remediation strategies—so it fits Risk Management Process. Its specificity is elevated to Firm-Specific because it identifies a named internal team, the 'Breach Response Team,' while the rest of the language is otherwise fairly generic.


fact: The current Head of IT has over thirty years of experience leading information technology teams in the life sciences industry.

fact: The Head of IT reviews threat intelligence to help identify risks from cybersecurity threats.

reasoning: The paragraph primarily describes management organization and qualifications by focusing on the Head of IT’s responsibility and experience, so Management Role is the best fit. Specificity is Quantified-Verifiable because it includes a checkable claim of over thirty years of experience, and it also uses cybersecurity-specific terminology through 'threat intelligence.'


reasoning: The paragraph primarily gives the company's materiality assessment that cybersecurity threats and prior incidents have not materially affected, and are not reasonably likely to materially affect, its business strategy, results of operations, or financial condition, which fits Strategy Integration. Its remaining content is generic hypothetical incident language and a risk-factor cross-reference, and it contains no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: Our Vice President, Information Security and Privacy briefs the Audit Committee on cybersecurity matters.

fact: Our Senior Vice President, Chief Strategy and Digital Officer briefs the Audit Committee on cybersecurity matters.

reasoning: The paragraph primarily describes how the board, through the Audit Committee, oversees cybersecurity risk and receives information from management, so it is Board Governance. Its specificity rises to Firm-Specific because it identifies company-specific management roles involved in reporting to the committee, but it does not include externally verifiable numbers, dates, or named vendors/products.


fact: HITRUST framework

fact: SOC 2 framework

fact: penetration testing

fact: threat modeling

fact: network firewalls

fact: access controls

fact: vulnerability scanners

fact: intrusion prevention and detection systems

fact: identity and access management systems

fact: vulnerability assessments

fact: cybersecurity threat intelligence

fact: phishing email simulations

fact: NIST framework

fact: Incident Response Plan includes triage, severity assessment, escalation, containment, investigation, and remediation processes

reasoning: The paragraph primarily describes what the company’s cybersecurity program does—its assessments, controls, training, monitoring, and incident response activities—so it is best classified as Risk Management Process. Its specificity is Domain-Adapted because it uses numerous cybersecurity-specific frameworks and technical practices, but does not include firm-unique organizational details or externally verifiable claims.


fact: The company engages third-party services to conduct evaluations of its security controls.

fact: Those evaluations include penetration testing.

reasoning: The paragraph primarily describes what the cybersecurity program does—risk assessment, use of frameworks, control evaluations, and integration of cyber risk into the company’s overall approach—so Risk Management Process is the best fit. Its specificity is elevated by cybersecurity-specific terminology such as security controls and penetration testing, but it lacks firm-unique roles, named committees, dates, numbers, or other externally verifiable details.


reasoning: This paragraph is purely definitional and cross-referential, pointing to Item 106 of Regulation S-K for term meanings rather than describing the company's cybersecurity governance, management, process, third-party risk, incidents, or strategy impact. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts about the company, it is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company has not identified cybersecurity threats reasonably anticipated to materially affect its business strategy, results of operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts beyond generic forward-looking cybersecurity language.


reasoning: The paragraph primarily explains management’s responsibility and general qualifications for overseeing cybersecurity, which makes it a management-organization disclosure rather than a description of the cybersecurity program itself. It does not include qualifying domain-specific terms, firm-unique roles or committees, or externally verifiable facts, so specificity remains generic boilerplate.


fact: engagement of vendors to conduct penetration tests

reasoning: The paragraph primarily explains management’s involvement and responsibilities in cybersecurity—overseeing policies, participating on the incident response team, and directing responses—so it is best categorized as Management Role. Its specificity is elevated to Domain-Adapted because it includes the cybersecurity-specific practice of penetration testing, but it does not provide firm-unique roles, named committees, or verifiable quantitative details.


reasoning: The paragraph primarily explains how the Board oversees cybersecurity, including updates, escalation, and presentations to directors, so it is best classified as Board Governance. It does not contain qualifying domain-specific terms, firm-specific governance facts, or externally verifiable claims that elevate specificity above generic oversight boilerplate.


reasoning: The paragraph primarily addresses oversight by stating that the cybersecurity program is supported by management and the Board of Directors, which makes Board Governance the best fit. It remains generic boilerplate because it contains no qualifying domain-specific technical terms, firm-specific governance details, or externally verifiable facts; references to the Board and Audit Committee are too generic to elevate specificity.


fact: The Chief Information Officer (CIO) also serves as the Chief Information Technology Architect & Chief Information Security Officer (CISO).

reasoning: This paragraph primarily describes how the committee and full board receive cybersecurity information and oversee cyber risk, so it is Board Governance. Its specificity is Firm-Specific because it includes a company-specific cybersecurity leadership role structure—the CIO also serving as Chief Information Technology Architect & CISO—while the rest is mostly generic oversight cadence language.


reasoning: The paragraph primarily describes how the Audit Committee and Board receive and oversee cybersecurity/data privacy risk information, which is a board oversight structure question. It contains no qualifying domain-specific cybersecurity terms or firm-specific/verifiable facts under the rubric, so specificity remains generic boilerplate.


fact: The information security program is managed by the Senior Vice President and Chief Information Officer (CIO).

fact: The CIO has over 25 years of IT Risk Management experience.

fact: The CIO's cybersecurity team has more than 30 years of collective information and product security experience.

fact: The team includes personnel with cybersecurity degrees.

fact: The team includes seasoned professionals with multiple cybersecurity-related certifications.

fact: The team is responsible for enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes.

reasoning: This paragraph primarily explains how management is organized to oversee cybersecurity, focusing on the CIO, the cybersecurity team, their experience, and their responsibilities, with board reporting as a secondary element. Specificity reaches Quantified-Verifiable because it includes checkable experience claims such as the CIO having over 25 years of experience and the team having more than 30 years of collective experience.