fact: Recurring threat intelligence from partners

fact: Tactics, techniques, and procedures (TTPs) used by threat actors

fact: Mandatory recurring cybersecurity training and phishing exercises

fact: Monitoring and detection of the cybersecurity environment

fact: Cybersecurity incident response plan ("CIRP")

reasoning: The paragraph primarily describes what the company’s cybersecurity program does—threat intelligence intake, employee training, monitoring/detection, vendor assessments, and incident response—so Risk Management Process is the best fit, even though third-party risk is one component. Specificity reaches Firm-Specific because it includes the named internal program "CIRP," along with several cybersecurity domain terms that elevate it above generic boilerplate.


content_category: Risk Management Process

fact: References the cybersecurity objective of protecting the confidentiality, integrity, and availability of systems and information

category_confidence: high

specificity_confidence: medium

reasoning: The paragraph primarily describes the company's cybersecurity risk management program and its purpose, so it fits Risk Management Process. Its specificity is elevated by the classic cybersecurity concept of confidentiality, integrity, and availability, but it contains no firm-specific roles, structures, or verifiable claims.

provider: openai

stage: benchmark


specificity_confidence: high

reasoning: The paragraph primarily describes an element of the company’s cybersecurity program—using risk assessments to identify cybersecurity risks—so it fits Risk Management Process. Its language is high-level and generic, with no domain-specific cyber terminology that passes the ERM test and no firm-specific or verifiable facts.


content_category: Strategy Integration

reasoning: The paragraph primarily provides a materiality assessment, stating that privacy or cybersecurity threats did not materially affect and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its specificity is Generic Boilerplate because it contains no qualifying domain-specific technical terms, firm-specific organizational details, or externally verifiable cybersecurity facts; the 2024 negative assertion does not count as verifiable.


content_category: Third-Party Risk

reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and service providers, making Third-Party Risk the best fit. It remains Generic Boilerplate because it only uses broad terms like due diligence, oversight, and vendor risk identification without any cybersecurity-specific techniques, named roles, systems, standards, or verifiable details.


content_category: Board Governance

fact: The Board periodically receives reports from the World Gold Council regarding cybersecurity programs.

reasoning: The paragraph primarily explains how the Board oversees cybersecurity risk through receiving reports on service-provider due diligence, operational risks, incidents, and cybersecurity programs, which makes it Board Governance. Its specificity is elevated to Quantified-Verifiable because it includes the named external organization World Gold Council, an externally identifiable fact.


category_confidence: medium

reasoning: The paragraph primarily makes a company-level assessment that no cybersecurity incident occurred during 2024, which fits Strategy Integration under the negative-assertion/materiality-style rule more than board oversight. Its language is otherwise generic, and the only dated statement is a negative self-assertion that is not externally verifiable, so specificity remains Generic Boilerplate.


reasoning: The paragraph most directly addresses the company's general approach to cybersecurity risk management by stating that it assesses, identifies, and manages material cyber risks and listing broad risk types. Its language is highly generic and contains no qualifying domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


fact: SaaS platforms

fact: managed services

fact: cloud-based infrastructure

fact: data center facilities

fact: encryption and authentication technology

fact: threat intelligence service providers

fact: cybersecurity software providers

fact: penetration testing firms

reasoning: The paragraph primarily explains the company’s reliance on third-party providers and vendors for security-related services, making third-party cyber risk the central topic. Its specificity is elevated by multiple cybersecurity-specific terms and service categories, but it does not include firm-unique organizational details or externally verifiable claims.


content_category: None/Other

reasoning: This paragraph is a forward-looking risk/cross-reference statement pointing readers to Item 1A for more discussion, rather than describing governance, management, processes, third-party risk, an actual incident, or a materiality/business assessment. It contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes how a board-level committee oversees cybersecurity through reports and updates from management, which is board governance. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts beyond generic oversight language.


reasoning: The paragraph primarily describes elements of the company's cybersecurity program—third-party assessments, certifications, and reporting structure—as part of its overall governance approach, rather than board oversight, a specific management role, or vendor-risk controls as the central topic. Its language remains high-level and generic, with no named frameworks, roles, committees, certifications, dates, quantities, or other qualifying specific facts.


reasoning: The paragraph primarily addresses how cybersecurity is integrated into the company's financial risk strategy by stating that it maintains cybersecurity insurance coverage. It does not include qualifying domain-specific technical terminology, firm-unique organizational details, or externally verifiable facts, so it remains generic boilerplate.


reasoning: The paragraph primarily explains how the board and its audit committee oversee cybersecurity, so it fits Board Governance. Its details are generic governance statements using excluded items like the Board, audit committee, and routine review cadences, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


reasoning: The paragraph primarily describes what the company’s cybersecurity program does—risk assessments, security controls, incident response, training, and third-party risk management—so it is best categorized as Risk Management Process. Its language remains high-level and generic, without qualifying domain-specific technical terms, firm-unique structures, or externally verifiable facts that would elevate specificity.


reasoning: The paragraph primarily provides a business-impact/materiality assessment, stating that cybersecurity has not affected results of operations or financial condition to date, which fits Strategy Integration. Its remaining content is generic forward-looking risk language, and the negative assertion about no incident or impact is not externally verifiable, so no specificity-elevating facts are present.


reasoning: This paragraph is a cross-reference directing readers to Item 1A risk factors rather than providing substantive cybersecurity governance, management, process, incident, third-party, or strategy detail. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: This paragraph is primarily a generic commitment/risk framing statement with a cross-reference to risk factors and hypothetical impacts, rather than a substantive description of board oversight, management roles, risk processes, third-party risk management, incident details, or a materiality assessment. Under the instructions, None/Other paragraphs receive Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference directing readers to Item 1A risk factors rather than providing a substantive cybersecurity governance, management, process, incident, third-party, or strategy assessment itself. Because it contains no qualifying domain-specific, firm-specific, or verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides the company’s assessment that cybersecurity threats and prior incidents have not materially affected, and are not reasonably anticipated to materially affect, the organization, which makes Strategy Integration the best fit. Although it briefly mentions enhanced risk management practices and tabletop exercises, those references remain generic and do not include qualifying domain-specific, firm-specific, or externally verifiable facts.


reasoning: The paragraph primarily describes the company’s cybersecurity risk management activities and safeguards, so it is best classified as Risk Management Process. However, it uses only high-level, generic language about assessing risks, safeguards, system tests, and external assistance, without domain-specific cybersecurity terms, firm-unique details, or externally verifiable facts.


reasoning: The paragraph primarily gives a high-level assessment of the business impact of cybersecurity risk and states that, as of the reporting date, the company had not experienced cybersecurity incidents, which fits Strategy Integration rather than describing a concrete process or governance structure. Its language is generic and does not include qualifying domain-specific terminology, firm-specific organizational details, or externally verifiable cybersecurity facts.


fact: Policies, standards, processes, and practices are based on frameworks established by NIST

type: framework

fact: Policies, standards, processes, and practices are based on frameworks established by ISO

fact: The approach addresses the confidentiality, integrity, and availability of information systems and information collected and processed

reasoning: The paragraph primarily describes the company's cybersecurity program and how it identifies, assesses, and manages cyber risk, which fits Risk Management Process. Its specificity is elevated by cybersecurity-specific framework references (NIST, ISO) and the CIA triad language, but it does not include firm-unique organizational details or externally verifiable quantified claims.


reasoning: This paragraph is only a cross-reference to a risk factor and contains no substantive cybersecurity governance, management, process, third-party risk, incident, or strategy disclosure. Because it provides no qualifying domain, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses how the board oversees cybersecurity by stating that the Board has primary oversight responsibility. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; references to the Board and generic experience areas do not elevate specificity under the rubric.


reasoning: The paragraph primarily explains oversight responsibility by stating that the Board has overall responsibility for cybersecurity risk management, with management handling identification and assessment of risks. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the statement that no incidents occurred in fiscal year 2024 is a negative self-assertion and does not elevate specificity.


fact: The chief information security officer prepares and presents reports on material cyber risks and mitigation efforts

reasoning: The paragraph primarily explains how cybersecurity risk information flows to the board through committee reporting, which makes it a board oversight disclosure. Its specificity is elevated to Firm-Specific by the mention of the chief information security officer, a qualifying firm-level cybersecurity leadership role; the rest of the language is otherwise fairly generic.


reasoning: This paragraph describes general vCIO/MSP service offerings and reporting mechanics, not a substantive cybersecurity governance, management, risk, third-party cyber risk, incident, or strategy disclosure. It contains no qualifying cybersecurity-specific domain terms or firm-specific/verifiable cybersecurity facts, so specificity remains Generic Boilerplate.


reasoning: The paragraph is primarily about how the company addresses cybersecurity risks arising from vendors, service providers, and other external parties, making Third-Party Risk the best fit. It remains generic boilerplate because it provides no cybersecurity-specific domain terms, firm-specific structures, or verifiable details beyond a high-level statement of approach.


reasoning: This paragraph is only a cross-reference to another section discussing cybersecurity-related risk factors and does not itself describe governance, management, processes, third-party risk, incident details, or strategy impacts. Because it contains no qualifying domain-specific, firm-specific, or verifiable cybersecurity facts, its specificity is Generic Boilerplate.


content_category: Management Role

fact: team includes military veterans versed in forensic analysis

fact: forensic analysis

fact: over 23 years of combined cybersecurity experience in the private and public sector

type: quantified

fact: supported by a Master's degree in Cybersecurity

reasoning: The paragraph primarily describes management’s organization and qualifications—i.e., the background and experience of the cybersecurity leadership team—rather than the company’s cybersecurity processes. Specificity is elevated to Quantified-Verifiable because it includes a concrete, checkable claim of over 23 years of combined cybersecurity experience, along with additional background details.


fact: firewalls

fact: intrusion prevention and detection systems

fact: anti-malware functionality

fact: access controls

reasoning: The paragraph primarily describes the company’s cybersecurity program activities and technical measures, so it is best categorized as Risk Management Process. Its specificity rises above boilerplate because it names concrete cybersecurity control types such as firewalls and intrusion prevention/detection systems, but it includes no firm-specific or externally verifiable facts.


fact: Chief Information Officer supervises the information security team

fact: Information Security Officer coordinates with compliance and human resources to conduct company-wide information security awareness training

fact: The Chief Information Officer and Information Security Officer have combined over 35 years of IT management experience

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on the CIO’s supervision of the information security team, the Information Security Officer’s responsibilities, and their experience; the vendor-risk discussion is secondary. Specificity is Quantified-Verifiable because it includes firm-specific management roles and a checkable numerical claim that the CIO and Information Security Officer have over 35 years of combined IT management experience.


reasoning: The paragraph primarily explains how the Board is informed about cybersecurity matters, including periodic updates and notification of material incidents, so its main focus is board oversight rather than management organization. It contains only generic oversight language and no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: SVP, Engineering is a management team member primarily responsible for assessing and managing material cybersecurity risks

fact: VP, Technology & CISO is a management team member primarily responsible for assessing and managing material cybersecurity risks

fact: The VP, Technology & CISO has prior experience in head of security and CISO positions at public and private companies

reasoning: This paragraph primarily describes which management roles are responsible for cybersecurity and summarizes their experience and reporting responsibilities, so it is best classified as Management Role. Its specificity is Firm-Specific because it includes company-specific leadership titles such as the SVP, Engineering and VP, Technology & CISO, but no hard verifiable dates, numbers, certifications, or named external firms.


content_category: Incident Disclosure

fact: The incident caused interrupted manufacturing at the company's domestic plants

fact: The incident delayed order fulfillment for the company's retail network

fact: The incident delayed some wholesale shipments

fact: Within a few days of the incident, the company resumed retail order fulfillment and caught up on delayed wholesale orders

fact: The company fully restored its IT systems and data

fact: The company's investigation found no evidence that its core operating systems for manufacturing, wholesale and retail order processing and fulfillment, or financial reporting were impacted

reasoning: This paragraph primarily describes the operational effects and recovery status of an actual cybersecurity incident, so it is best classified as Incident Disclosure. Its specificity is elevated by concrete, company-specific incident impacts and remediation details, but it lacks hard dates, named firms, or numeric facts that would make it Quantified-Verifiable.


fact: The Board receives updates regarding GC Advisors' cybersecurity program.

reasoning: The paragraph primarily describes how the Board oversees cybersecurity risk through strategic oversight and management reporting, which is Board Governance. Specificity rises above boilerplate because it references the company-specific GC Advisors cybersecurity program, but otherwise uses largely generic oversight language.


reasoning: The paragraph is primarily about cybersecurity risks posed by service providers and suppliers, focusing on the company's limited oversight of third-party cybersecurity practices, so Third-Party Risk is the best fit. It contains no qualifying domain-specific cybersecurity terms, firm-unique organizational details, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily describes how the company’s cybersecurity program operates by using external providers for monitoring, investigation, remediation, and risk management support; although third parties are mentioned throughout, the main focus is the company’s overall cybersecurity process rather than vendor oversight as a standalone topic. The language remains high-level and generic, without firm-unique roles, committees, named providers, frameworks, or verifiable details that would elevate specificity.


reasoning: The paragraph primarily describes cybersecurity program activities—incident response operation and employee security/privacy training—rather than management structure or board oversight, so Risk Management Process is the best fit. It does not include qualifying domain-specific technical terms, firm-unique organizational details, or externally verifiable claims, so the specificity remains Generic Boilerplate.


reasoning: This paragraph describes general business reliance on technology and information systems, not a substantive cybersecurity governance, management, risk, third-party, incident, or materiality disclosure. Because it contains no qualifying cybersecurity-specific or firm-distinguishing facts under the rubric, specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes the company's cybersecurity-related measures and vulnerabilities—e.g., additional security technologies, resiliency, backup, and disaster recovery—so it most directly answers what the program does rather than board or management structure. Its language remains high-level and generic, without qualifying domain-specific terminology that clearly passes the ERM test or any firm-specific or externally verifiable facts.


reasoning: This paragraph is primarily a cautionary, forward-looking disclaimer about the possibility of cyberattacks and a cross-reference to risk factors, rather than a substantive description of governance, management, processes, third-party risk, incidents, or strategy assessment. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily describes how the company's cybersecurity risk management program is structured and integrated within its broader risk management processes, which fits Risk Management Process. It contains no qualifying domain-specific cybersecurity terminology, firm-unique roles/committees, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: This paragraph is a cross-reference directing readers to Item 1A Risk Factors for discussion of potential cybersecurity impacts, rather than providing substantive disclosure about governance, management, processes, incidents, third-party risk, or strategy integration itself. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: This paragraph is a forward-looking, hypothetical risk statement about possible consequences of cybersecurity incidents rather than a description of governance, management, processes, third-party risk, strategy assessment, or an actual incident. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: Vice President of IT and Digital is regularly informed about cybersecurity developments

fact: CISO is regularly informed about cybersecurity developments

reasoning: The paragraph primarily describes how management roles—the Vice President of IT and Digital and the CISO—stay informed, which is about management organization and responsibilities rather than the underlying cybersecurity program itself. Specificity is Firm-Specific because it names company leadership roles, but it does not include externally verifiable dates, quantities, or named systems/firms.


reasoning: The paragraph primarily answers whether cybersecurity has affected or is likely to affect the business, stating that cyber risks have not had a material impact on operations, strategy, or financial results to date, which is a Strategy Integration materiality assessment. Its language is otherwise generic and contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily explains how the company manages cybersecurity expectations for outside service providers, especially by planning to require significant third parties to certify security measures and report suspected breaches. Although it mentions consultants helping with internal processes, the disclosure remains generic and includes no qualifying domain-specific terms, firm-unique details, or externally verifiable facts.


reasoning: The paragraph primarily provides a materiality assessment—stating that cybersecurity threats and prior immaterial incidents have not materially affected, and are not reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition—so it fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the insurance reference is generic and does not elevate specificity.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk, including delegation of oversight responsibility, so it fits Board Governance. Its details are generic governance language, and the only named body is the Audit Committee, which does not count as specificity-elevating under the rules.


reasoning: The paragraph primarily gives management’s conclusion that known cybersecurity threats are not reasonably likely to materially affect the company’s operations, strategy, results, or financial condition, which is a materiality/business-impact assessment. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts beyond generic management and cross-reference language.


reasoning: The paragraph primarily describes how the board-level oversight chain works for cybersecurity, with the audit committee receiving management updates and reporting to the board. It contains no qualifying domain-specific terminology, firm-unique roles or structures, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: protected health information

fact: confidentiality, integrity, or availability of information

reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from service providers, including vendor qualification and reliance on providers for notification and remediation, so Third-Party Risk is the best fit. Its specificity rises above boilerplate because it uses cybersecurity/privacy domain terminology such as protected health information and the confidentiality-integrity-availability framing, but it does not include firm-specific roles, committees, or externally verifiable facts.


fact: The company monitors its information systems for potential vulnerabilities.

fact: The company uses various security tools to identify, escalate, investigate, resolve, and recover from security incidents.

fact: The company collaborates with third parties to assess the effectiveness of its cybersecurity prevention and response systems and processes.

reasoning: The paragraph primarily explains what the cybersecurity program does—risk assessment, monitoring for vulnerabilities, use of security tools, testing, and related mitigation activities—so Risk Management Process is the best fit despite secondary mentions of board oversight, third parties, and materiality. Specificity rises above boilerplate because it uses cybersecurity-specific concepts such as vulnerabilities, security tools, and security incidents, but it does not include firm-unique roles/structures or externally verifiable claims.


fact: annual assessments of the SOC reports of providers

fact: implementing complementary controls

reasoning: The paragraph primarily explains how the company manages cybersecurity risks from third-party service providers through pre-engagement assessments and ongoing oversight, making Third-Party Risk the best fit. Specificity rises above boilerplate because it references cybersecurity-specific evidence and practices such as reviewing SOC reports and implementing complementary controls, but it does not include firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes the board’s oversight role versus management’s day-to-day role in cybersecurity-related risk, which fits Board Governance. It contains only generic governance language with no domain-specific cybersecurity terms, firm-specific roles beyond common corporate actors, or verifiable details.


reasoning: The paragraph primarily states management's conclusion about whether cybersecurity threats have materially affected or are reasonably likely to affect the company's business, results, or financial condition, which is a Strategy Integration assessment. Its specificity remains Generic Boilerplate because it contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the year-linked negative assertion about no material effect is not externally verifiable under the rubric.


reasoning: The paragraph primarily explains who is responsible for handling cybersecurity-related matters—an outsourced third-party subcontractor—rather than describing a substantive cybersecurity process or vendor oversight program. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so the specificity remains generic boilerplate.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity by assigning responsibility to the Chief Executive Officer and describing his reporting role to the Board. It does not include qualifying domain-specific terminology or firm-specific/verifiable facts for specificity because CEO and Board of Directors are generic governance roles, and terms like risk assessment, incident response plan, prevention, mitigation, detection, and remediation are too generic here to elevate specificity.


reasoning: The paragraph primarily addresses cybersecurity's actual and potential impact on the company's business, financial condition, and future resource needs, which makes it a Strategy Integration disclosure. It contains no qualifying domain-specific terms, firm-specific organizational facts, or externally verifiable claims, so specificity remains Generic Boilerplate.


fact: Contracts with CROs that handle all of the company's data and software

fact: CRO data systems are described as 21 CFR 11 (Part 11) compliant

fact: Industry standard antivirus software on CRO networks

fact: Industry standard antimalware software on CRO networks

reasoning: The paragraph is primarily about how the company manages cybersecurity risk through its CRO vendors, including reviewing their policies and requiring incident reporting, so Third-Party Risk is the best fit. Specificity rises above boilerplate because it includes cybersecurity/domain details like 21 CFR 11 compliance and antivirus/antimalware controls, but it lacks named vendors, roles, or clearly independently verifiable company-specific facts.


fact: confidentiality, integrity, and accessibility of our data

reasoning: The paragraph primarily describes the company’s cybersecurity program objective—maintaining strong measures to protect information systems—so it fits Risk Management Process. Specificity rises above boilerplate only because it uses the security triad concept ('confidentiality, integrity, and accessibility'), but it contains no firm-specific roles, committees, dates, numbers, or other verifiable details.


fact: controls are designed to detect, triage and eradicate attacks

fact: cyber insurance policy covering investigation and mitigation expenses

fact: cyberattacks are described as increasing in frequency and sophistication

reasoning: The paragraph primarily answers whether cybersecurity affects the company’s business or finances by stating that cyber risks and prior incidents have not materially affected, and are not reasonably likely to materially affect, business strategy, results of operations, or financial condition, while also mentioning cyber insurance. Specificity is Domain-Adapted because it includes cybersecurity-specific operational terminology such as detecting, triaging, and eradicating attacks, but it does not provide firm-unique organizational details or externally verifiable facts.


fact: breach notification requirements

reasoning: The paragraph primarily describes how the board and management oversee cybersecurity matters, including approving investments and supervising compliance and legal support, which makes Board Governance the best fit. Specificity rises above boilerplate only because it mentions the cyber-specific concept of breach notification requirements; otherwise the discussion is mostly generic oversight language.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from third-party service providers, especially by imposing security certifications and breach-reporting obligations on them. It remains generic boilerplate because it provides no qualifying domain-specific technical terms, firm-specific organizational details, or externally verifiable facts.


reasoning: The paragraph primarily gives a backward-looking assessment that cybersecurity issues have not materially affected the company’s operations or financial condition, which fits Strategy Integration. Its only concrete-looking statement is a negative self-assessment that is not externally verifiable, and the rest is a generic cross-reference, so specificity remains Generic Boilerplate.


fact: The company refers to a 'Cybersecurity Governance Board' that considers cybersecurity and information technology risks as part of its oversight function.

reasoning: The paragraph primarily answers whether cybersecurity risks have materially affected or are reasonably likely to materially affect the business, operations, results, or financial condition, which is a Strategy Integration assessment. Its specificity rises above boilerplate because it includes a firm-specific governance body, the 'Cybersecurity Governance Board,' but otherwise the materiality language is generic and not externally verifiable.


reasoning: The paragraph primarily describes the oversight chain for cybersecurity risk, stating that the Board of Directors oversees cybersecurity and that management handles related practices, which fits Board Governance. It contains no qualifying domain-specific cybersecurity terminology, firm-specific qualifying roles, or verifiable claims; CEO and CFO do not count for specificity under the rules.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk posed by outside service providers, especially through required certifications, security obligations, and breach reporting expectations. It remains generic because it names no specific frameworks, tools, firms, roles, committees, dates, or other verifiable or firm-unique details.


fact: ransomware

fact: denial-of-service

reasoning: The paragraph primarily explains why cybersecurity matters to the company’s business strategy and resource allocation, emphasizing potential business effects and the need to invest in cybersecurity rather than describing governance or operational processes. Its specificity rises above boilerplate because it names concrete cyber threat types—ransomware and denial-of-service—which reflect cybersecurity domain knowledge.


reasoning: The paragraph primarily describes the oversight chain for cybersecurity risk reporting from senior management to the Audit Committee and then to the Board, which makes Board Governance the best fit. Its details are generic and rely on excluded boilerplate roles and unnamed third-party support, with no qualifying domain terms, firm-specific facts, or verifiable claims.


reasoning: The paragraph primarily provides a materiality assessment, stating both that known cybersecurity threats have not materially affected the company and that certain ongoing threats are reasonably likely to do so, which fits Strategy Integration under the SEC materiality rule. Its wording is otherwise generic and does not include qualifying domain-specific terminology, firm-specific cyber governance details, or externally verifiable claims.


reasoning: The paragraph primarily addresses potential business/financial exposure from cybersecurity incidents by noting possible material adverse effects and the absence of insurance coverage for resulting damages. Its language is generic and speculative, with no qualifying domain-specific terminology, firm-unique governance/management details, or externally verifiable facts.


reasoning: The paragraph primarily describes the oversight chain between management and the Board, including management updating the Board about cybersecurity matters, which makes Board Governance the best fit. Its details are generic and do not include qualifying domain-specific terms, firm-specific roles beyond excluded generic executives, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality-oriented assessment that the company does not believe it has experienced material cybersecurity incidents or costs and discusses possible future effects on business strategy, results of operations, and financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, so specificity is Generic Boilerplate.


fact: References cybersecurity-specific concepts including breach attempts, vulnerabilities, and a cybersecurity incident

reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and breach attempts have not materially affected the company's business, strategy, results of operations, or financial condition, which fits Strategy Integration. Its specificity rises above boilerplate because it includes cybersecurity-domain terms such as breach attempts, vulnerabilities, and cybersecurity incident, but it does not include firm-specific or externally verifiable facts.


reasoning: The paragraph primarily provides a backward-looking materiality/business-impact assessment by stating that the company has not experienced a material security breach and therefore has not incurred material breach-related expenses or settlements, which fits Strategy Integration rather than Incident Disclosure. Its specificity is Generic Boilerplate because the statements are negative self-assertions that are not externally verifiable, and no qualifying domain-specific, firm-specific, or quantified-verifiable facts are present.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity incidents or threats have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the negative assertion and generic reference to third-party vendors do not elevate specificity above boilerplate.


fact: CGNC oversees cybersecurity in addition to management responsibilities

reasoning: The paragraph primarily explains management’s operational role: business-unit senior management handles day-to-day protection of information systems and reviews incident reports for possible SEC reporting. Specificity rises to Firm-Specific because it references the CGNC, a named internal committee, while the rest of the language is otherwise fairly generic.


fact: annual assessments of the SOC reports of third-party providers

reasoning: The paragraph primarily explains how the company manages cybersecurity risks from third-party service providers, making Third-Party Risk the best fit. Its specificity rises above boilerplate because it references cybersecurity-specific concepts such as reviewing SOC reports and using complementary controls, but it does not include firm-unique roles, committees, or externally verifiable claims.


reasoning: The paragraph primarily provides a materiality-style assessment that cybersecurity incidents have not had a materially adverse effect on the company’s business, operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts beyond generic risk language and a cross-reference, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily gives a backward-looking materiality/business-impact assessment by stating that cybersecurity challenges did not materially impair operations or financial standing, which fits Strategy Integration under the materiality rule. Its remaining statements are generic forward-looking caution and monitoring language, and the dated negative assertion is not externally verifiable, so no specificity-elevating facts qualify.


fact: Mr. Dennis has served as Director of Information Technology since June 2019

fact: Mr. Dennis is the founder of a data privacy consulting company

fact: Mr. Dennis has over 20 years of experience in the data management space

fact: system alerts of potential malicious cyber activity

fact: real-time dashboards that monitor and assess systems

fact: potential new attack vectors

fact: vulnerabilities

reasoning: The paragraph primarily explains how the company monitors and manages cybersecurity risk through alerts, dashboards, reporting, and provider communications, so Risk Management Process is the best fit despite references to Mr. Dennis and Audit Committee reporting. Specificity is Quantified-Verifiable because it includes externally checkable facts such as Mr. Dennis serving since June 2019 and having over 20 years of experience, along with several cybersecurity-specific terms.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from third-party service providers through onboarding diligence and contractual requirements, making Third-Party Risk the best fit. However, it uses generic vendor-risk language without domain-specific cybersecurity terminology, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily gives a materiality assessment, stating that cybersecurity risks have not previously materially affected the company and are not reasonably likely to do so, which fits Strategy Integration under the SEC materiality rule. Its remaining language is generalized risk and cautionary phrasing without qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes how the board and its committee oversee cybersecurity, which is board-level governance. It contains only generic oversight language centered on the Board and Audit Committee, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: ISAT

fact: penetration testing

reasoning: The paragraph primarily describes how the company’s cybersecurity program operates, specifically using outside experts to assess, test, monitor, and improve the program, which makes it a risk management process disclosure rather than third-party risk. Specificity reaches Firm-Specific because it names the internal team ISAT; it also includes the cybersecurity-specific practice of penetration testing.


fact: The incident response team monitors threat intelligence feeds

fact: The company performs vulnerability management

fact: The paragraph describes handling high severity security incidents through a cyber crisis response plan

reasoning: The paragraph primarily explains what the cybersecurity program does—incident handling, monitoring, vulnerability management, and training—so it is best classified as Risk Management Process. Its specificity is elevated by cybersecurity-specific practices like threat intelligence feeds and vulnerability management, but it lacks firm-unique roles, named programs, or externally verifiable facts.


reasoning: The paragraph primarily addresses the company’s current cybersecurity risk management posture by stating that it has not yet adopted formal cybersecurity risk management programs or formal risk-assessment processes, which makes Risk Management Process the best fit. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so the specificity remains Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity incidents or threats have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which makes it Strategy Integration. Its remaining language is generic hypothetical risk and a cross-reference, and it contains no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: The Board of Directors receives regular reports from the SMIS and Cybersecurity Committee on cyber risks and threats, security projects, security program assessments, insurance, and the threat landscape.

fact: The paragraph references the SMIS and SMIS's team as part of the company's cybersecurity oversight and incident-escalation structure.

fact: The Cybersecurity Committee is promptly informed by SMIS's team of cybersecurity incidents that could adversely affect the company or its information systems.

reasoning: This paragraph primarily explains how cybersecurity information flows upward to the Cybersecurity Committee, Board, and Audit Committee, so it is chiefly about board oversight rather than management operations. Its specificity is Firm-Specific because it names company-specific governance bodies and organizational entities such as the Cybersecurity Committee and SMIS, but it does not include externally verifiable dates, quantities, or named outside firms.


reasoning: The paragraph primarily provides a materiality-oriented conclusion that the company did not experience a material cybersecurity incident, which fits Strategy Integration under the stated rule for negative material-incident assertions. Its remaining content is a cross-reference to risk factors, and it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts for specificity purposes.


reasoning: The paragraph primarily describes cybersecurity program activities—ongoing evaluation of security improvements, technologies, and external expert review—so it fits Risk Management Process rather than management structure. Its language remains generic, with no qualifying domain-specific terms, firm-unique details, or externally verifiable facts that would elevate specificity above boilerplate.


reasoning: The paragraph primarily provides the company's materiality assessment that cybersecurity risks and past incidents have not had, and are not reasonably likely to have, a material adverse effect on business strategy, results of operations, or financial condition, which fits Strategy Integration. Its statements are generic and largely cautionary; the dated negative assertion and cross-reference do not qualify as specificity-elevating verifiable or firm-specific facts under the rules.


fact: The company has a service provider oversight committee

reasoning: The paragraph is centrally about how the company oversees cybersecurity and operational risks arising from third-party service providers, so Third-Party Risk is the best fit. Specificity rises to Firm-Specific because it identifies a company-specific governance body, the service provider oversight committee; the rest of the paragraph is largely generic vendor oversight process language.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making Third-Party Risk the best fit. Although it describes a vendor oversight process, it uses mostly generic risk-management language and does not include qualifying domain-specific technical terms, firm-unique organizational facts, or externally verifiable details.


fact: Chief Technology Officer is responsible for the establishment and maintenance of the company's cybersecurity risk management processes and day-to-day oversight of cybersecurity risk assessment and management

fact: Chief Technology Officer has over 15 years of experience in software development and security architecture

fact: security architecture

reasoning: This paragraph primarily describes management organization and responsibility for cybersecurity, focusing on the CTO's role, experience, and reporting relationship rather than board oversight or detailed program activities. Specificity reaches Quantified-Verifiable because it includes the externally checkable claim that the CTO has over 15 years of experience, along with the firm-specific CTO role and the domain-specific term security architecture.


fact: The company became aware in January 2021 that certain of its information technology systems hosted by a third-party cloud provider were improperly accessed.

fact: Certain source code was compromised in the incident.

fact: Credentials used to access the affected information technology systems were compromised.

fact: The company received a threat to publicly release the materials unless a payment was made.

reasoning: This paragraph primarily describes a real cybersecurity incident—when it was discovered, what was accessed, and the extortion threat—so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a concrete date (January 2021) and discrete, checkable claims about the incident’s nature and scope.


reasoning: The paragraph primarily gives a materiality/impact assessment—stating that no cybersecurity incident resulted in unauthorized access with a material adverse effect on the business, operations, or financial condition—so Strategy Integration is the best fit. Its remaining content is hypothetical adverse-effect language and a risk-factor cross-reference, and it contains no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: The company has a CISO who works at the direction of the CDO.

fact: The CDO has more than 20 years of executive IT leadership experience.

fact: The CDO leads the company's Digital and Information Technology functions.

fact: The CDO joined MPC in 2021.

fact: Before joining MPC, the CDO worked for GE and its subsidiary companies for over 20 years.

fact: The CDO held several executive IT leadership roles at GE with increasing responsibility.

fact: The CDO was named Senior Vice President and Chief Information Officer of Services for GE in 2017.

fact: The CDO was later named Vice President and Chief Information Officer of GE Healthcare.

fact: The CDO holds a Bachelor's degree in Business Administration, Management and Information Systems.

reasoning: This paragraph primarily describes management organization and qualifications by explaining the reporting relationship between the CISO and CDO and detailing the CDO’s experience and background. Specificity is Quantified-Verifiable because it includes externally checkable facts such as more than 20 years of experience, the 2021 join date, the 2017 GE appointment, named employers, and the CDO’s degree.


reasoning: The paragraph is primarily a generic cautionary statement plus a cross-reference to Risk Factors, not a substantive description of governance, management, risk processes, third-party oversight, strategy impact, or any specific cyber incident. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: BNY Mellon is identified as the entity with the third-party governance framework and protocols described.

reasoning: The paragraph primarily explains how cyber risk from third-party service providers is assessed and mitigated, so Third-Party Risk is the best fit. Specificity rises above boilerplate because it names BNY Mellon, an externally identifiable firm, but otherwise the controls described are fairly generic.


reasoning: The paragraph primarily provides a materiality assessment that no known cybersecurity incidents have materially affected or are reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its statements are generic and include only a negative self-assertion and cross-reference, neither of which adds qualifying specificity.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and other external service providers, making Third-Party Risk the best fit. Its statements are process-oriented but generic—contractual requirements, inclusion in ERM, and possible audits do not add cybersecurity-domain detail, firm-unique structure, or verifiable facts.


fact: The company has a Chief Information Security Officer (CISO) overseeing the information security program.

fact: The CISO is responsible for leading and implementing the company's cybersecurity strategy, policy, architecture, and risk management processes.

fact: The CISO has over 30 years of experience in cybersecurity.

fact: The CISO served as a Security Officer in the United States Navy.

fact: The CISO previously served as CISO at Amgen.

fact: The CISO previously served as CISO at Warner Bros.

fact: The CISO previously held cybersecurity roles at KPMG.

fact: The CISO previously held cybersecurity roles at Forrester.

fact: cybersecurity architecture

reasoning: This paragraph primarily explains how management is organized to handle cybersecurity by describing the CISO’s responsibilities and qualifications, so it fits Management Role. Its specificity is Quantified-Verifiable because it includes externally checkable facts, especially the CISO’s over 30 years of experience and prior roles at named organizations.


fact: The Company's IT Committee includes senior executives and other members of management.

fact: The Senior Vice President of Information Technology plays a role in informing the Board on cybersecurity risks.

fact: The paragraph refers to the current cybersecurity landscape and emerging threats as part of Board briefings.

reasoning: The paragraph primarily explains how cybersecurity information flows to the Board and how the Board oversees cyber risk, so Board Governance is the best fit. Its specificity rises above boilerplate because it names a company-specific IT Committee and a VP-level IT role; while it also contains some cyber domain language, there are no hard verifiable facts such as dates, certifications, or quantified claims.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which fits Strategy Integration. Its remaining language is generic cautionary and cross-referential, and it contains no qualifying domain-specific, firm-specific, or externally verifiable facts that elevate specificity.


reasoning: This paragraph is a cross-reference directing readers to another heading for discussion of potential cyber impacts rather than providing substantive disclosure about governance, management, process, third-party risk, incidents, or strategy integration in this paragraph itself. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


fact: The company states it experienced a ransomware attack on its computer network

fact: The ransomware attack occurred on April 28, 2023

fact: Following remediation, the network returned to full operation on May 1, 2023

reasoning: This paragraph primarily describes an actual cybersecurity incident, including what happened and the recovery timeline, so it is best classified as Incident Disclosure. Its specificity is Quantified-Verifiable because it includes a named incident type (ransomware) and concrete, externally checkable dates for occurrence and restoration of operations.


reasoning: The paragraph primarily provides a materiality assessment, stating that past cybersecurity incidents or threats have not materially affected the company and are not reasonably likely to do so, which fits Strategy Integration under the SEC materiality rule. The remaining language is generic cautionary and process-oriented disclosure without domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


fact: In 2022, Clarium Managed Services, LLC conducted a Cybersecurity Assessment for the Bank

fact: The Cybersecurity Assessment was conducted in 2022

fact: The assessment resulted in a score of 4.8 on a scale of 0 to 5

reasoning: The paragraph primarily answers whether cybersecurity incidents or threats have materially affected or are reasonably likely to materially affect the company’s business, results, or financial condition, which fits Strategy Integration. Its specificity is Quantified-Verifiable because it includes a named outside firm, a specific year, and a numerical assessment score.


fact: Deutsche Bank's Chief Security Officer

fact: The Chief Security Officer has served in information security roles for more than 20 years

fact: He previously served as global Chief Information Security Officer / Chief Security Officer for three different large European financial institutions

reasoning: The paragraph is primarily about management organization and qualifications, describing the Chief Security Officer’s background and the supporting security personnel rather than the company’s cybersecurity processes. Specificity reaches Quantified-Verifiable because it includes externally checkable experience claims, including more than 20 years in information security and service in CISO/CSO roles at three institutions.


reasoning: The paragraph primarily provides a materiality assessment about whether known cybersecurity threats have materially affected or are reasonably likely to materially affect the company’s business strategy, financial condition, results of operations, and operations, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts; the negative assertion and risk-factor cross-reference are generic disclosure language.


fact: VRM considers specific factors in performing due diligence on high-risk and vital vendors

fact: Review of the vendor's information security and related controls, including third-party audit

reasoning: The paragraph is centrally about how the company evaluates cybersecurity risk from vendors, so Third-Party Risk is the best fit. Specificity reaches Firm-Specific because it references VRM, a named internal function/team, and also includes a cybersecurity-specific review element involving vendors' information security controls and third-party audits.


fact: Monitors for and detects anomalous activity

fact: Security controls are designed to protect the confidentiality, integrity and availability of processes and systems

fact: Evaluates controls against the current threat landscape and industry-specific threats

fact: Maintains a risk register to catalog known risks and assess potential impact

fact: Uses independent third parties to perform annual penetration tests

fact: Tests controls across facilities, networks, devices and cloud environments

reasoning: The paragraph primarily describes what the company’s cybersecurity program does—control design, monitoring, risk evaluation, testing, and recovery capabilities—so it is best classified as Risk Management Process. Its specificity is Domain-Adapted because it uses cybersecurity-specific concepts such as anomalous activity detection, the confidentiality-integrity-availability triad, penetration testing, and cloud-environment control testing, but it does not provide firm-unique roles or externally verifiable facts.


fact: third-party service providers and products that host, manage, or control sensitive data

fact: cybersecurity incidents involving ransomware

fact: other forms of malware

fact: computer virus attacks

fact: unauthorized access

fact: systems failures and temporary disruptions

fact: In June 2018, the company identified forged and fraudulently induced electronic payment disbursements

fact: the disbursements were made to third parties in an aggregate amount of $10 million

fact: the June 2018 incident resulted from unauthorized third-party access to the company's email system

reasoning: The paragraph primarily describes actual cybersecurity incidents, especially the June 2018 event, its nature, and its immediate effects, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a concrete incident date and a specific loss amount of $10 million, alongside cybersecurity-specific threat terms such as ransomware and malware.


fact: The company experienced a single cybersecurity event in June 2023

fact: An unauthorized third party gained access to the email accounts of two employees

fact: Affected customers were notified in early September 2023

fact: The company has incurred approximately $25,000 in expenses related to the incident

reasoning: The paragraph primarily describes an actual cybersecurity incident, including what happened, when it occurred, notification timing, and resulting costs, so Incident Disclosure is the best fit. Its specificity is Quantified-Verifiable because it includes concrete dates, a specific count of affected employee accounts, and a dollar amount tied to the incident.


reasoning: The paragraph primarily provides a materiality-style assessment that cybersecurity risks and incidents have not materially affected the company’s business strategy, results of operations, or financial condition to date, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the negative assertion about no material effect is not independently verifiable.


fact: Deutsche Bank Group's security incident management is described as covering cybersecurity events affecting it, its subsidiaries, clients, business partners, or employees

fact: DWS is identified as the party that would follow a communication protocol if notified of an incident

reasoning: The paragraph primarily explains how cybersecurity incidents involving external affiliated firms would be managed and communicated to the company, making third-party cyber risk the central topic. Specificity reaches Quantified-Verifiable because it names identifiable firms—Deutsche Bank Group and DWS—which are externally verifiable facts.


fact: The Company's CISO leads the overall cybersecurity function

fact: The CISO reports to the Risk and Compliance Committee

fact: The Risk and Compliance Committee receives reports on cybersecurity topics from the CISO

reasoning: This paragraph primarily explains how cybersecurity information flows through the board oversight structure—CISO to the Risk and Compliance Committee to the Board—so Board Governance is the best fit. Specificity rises to Firm-Specific because it includes firm-unique organizational details such as the CISO role and the named Risk and Compliance Committee, but it does not contain externally verifiable dates, quantities, or named vendors/products.


fact: Energy Transfer's Chief Information Officer oversees the functions of IT, cybersecurity, infrastructure and IT governance

fact: Energy Transfer's Chief Information Officer has more than 35 years of experience leading business technology functions

fact: the Energy Transfer IT team

fact: members of the Energy Transfer IT team have over 50 years of combined experience in IT

fact: members of the Energy Transfer IT team have 20 years dedicated to cybersecurity

fact: team certifications include Global Industrial Cyber Security Professional (GICSP)

fact: team certifications include Certified Information Systems Security Professional (CISSP)

fact: team certifications include Certified Ethical Hacker (CEH)

fact: our internal cybersecurity program is led by USAC's IT department

fact: members of USAC's IT leadership team have an average of over 25 years of experience in IT operations

fact: members of USAC's IT leadership team have an average of over 10 years of experience in IT security

fact: cybersecurity risk identification and mitigation

reasoning: The paragraph primarily explains how management is organized to handle cybersecurity by identifying the CIO, IT team, and IT leadership team's responsibilities and qualifications, rather than describing board oversight or detailed security processes. Specificity is Quantified-Verifiable because it includes multiple externally checkable claims such as years of experience and named certifications (GICSP, CISSP, CEH).


fact: vulnerability assessments

fact: The Company's Chief Information Security Officer

reasoning: This paragraph primarily explains how the board oversees cybersecurity risk: the Audit Committee's oversight, management reporting to the board, incident escalation, and board discussion with the CISO. Specificity rises above boilerplate because it includes a cybersecurity domain term ('vulnerability assessments') and a firm-specific management role (Chief Information Security Officer), but no externally verifiable quantified claim.


fact: regular scanning of both internal and externally facing systems

fact: annual third-party penetration testing

fact: implementation of security technologies to identify, contain, and remediate malware risks

fact: active monitoring of logs and events

fact: monitoring of the network perimeter and internal systems

reasoning: The paragraph primarily describes what the cybersecurity program does—scanning, penetration testing, malware controls, and monitoring—so it fits Risk Management Process rather than Third-Party Risk. Its specificity is Domain-Adapted because it uses concrete cybersecurity practices and technical concepts, but does not include firm-unique roles, committees, systems, or externally verifiable facts.


reasoning: This paragraph is a cross-reference to another risk-factor heading rather than a substantive cybersecurity disclosure about governance, management, process, third parties, incidents, or strategy. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: This paragraph is only a cross-reference to another risk factor section and does not itself describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impact. Because it contains no qualifying domain-specific, firm-specific, or verifiable cybersecurity facts, it is generic boilerplate.


reasoning: The paragraph primarily describes how the board and its committee oversee cybersecurity risk and management’s program, which is board-level oversight structure. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts because references to the board, audit committee, and a cybersecurity risk management program are generic governance language.


fact: On October 15, 2025, the company learned that a threat actor had gained unauthorized access to portions of its IT environment.

fact: The company immediately notified law enforcement, including the Federal Bureau of Investigation (FBI).

fact: The incident involved unauthorized access and deployment of encryption and monitoring software to a portion of the company's internal corporate IT systems.

reasoning: This paragraph primarily describes an actual cybersecurity incident—when it was discovered, what occurred, and the response steps taken—so it is Incident Disclosure. Specificity is Quantified-Verifiable because it includes a precise incident date and a concrete, externally checkable claim that the FBI was notified.


fact: threat modeling

fact: vulnerability testing

fact: independent reviews of our information security control environment and operating effectiveness

reasoning: The paragraph primarily describes what the company’s cybersecurity program does—testing, assessments, third-party reviews, and feedback into policy updates—so it is best categorized as Risk Management Process. Its specificity rises above boilerplate because it uses cybersecurity-specific practices such as threat modeling, vulnerability testing, and information security maturity assessments, but it does not include firm-unique roles/committees or externally verifiable facts.


reasoning: The paragraph primarily explains how the board-level Audit Committee receives information and conducts oversight of cybersecurity risk, which makes it Board Governance. It contains only generic oversight language and common governance/process terms; it does not include qualifying domain-specific cybersecurity terminology, firm-unique roles/committees that elevate specificity, or externally verifiable facts.


reasoning: This is a cross-reference directing readers to another section for more information, rather than providing any substantive disclosure about cybersecurity governance, management, risk processes, third-party risk, incidents, or strategy impact. Because it contains no qualifying domain-specific, firm-specific, or verifiable facts, it is Generic Boilerplate.


reasoning: The paragraph primarily addresses how cybersecurity risk is handled in a business/financial sense by noting the existence of cyber liability insurance, which fits Strategy Integration. It provides no qualifying domain-specific, firm-unique, or externally verifiable detail beyond that generic statement, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes what the company's cybersecurity program does—its overall risk management approach and use of outside reviewers—so it fits Risk Management Process. However, it stays at a generic level without cybersecurity-specific domain terms, firm-unique roles or structures, or externally verifiable facts.


reasoning: This paragraph is only a cross-reference to a risk factor and contains speculative language about possible cyber effects, rather than describing governance, management, processes, third-party risk, an actual incident, or a materiality assessment. Because it provides no substantive cybersecurity program or incident details, it is generic boilerplate.


fact: threat intelligence service providers

fact: penetration testing firms

fact: cybersecurity software providers

fact: managed cybersecurity service providers

reasoning: The paragraph primarily describes components of the company's cybersecurity risk management program—specifically the use of outside specialists to help identify, assess, and manage cyber risks—so it fits Risk Management Process rather than Third-Party Risk. Its specificity is Domain-Adapted because it includes cybersecurity-specific practices and services such as threat intelligence and penetration testing, but no firm-unique or externally verifiable facts.


fact: The company states that a ransomware attack occurred in February 2023.

fact: The incident involved the unauthorized release of sensitive personal information of certain current and former employees.

fact: The company incurred remediation expenditures to scan leaked files, identify impacted individuals, determine the scope of exposed sensitive personal information, and provide notifications and free credit monitoring.

fact: ransomware attack

reasoning: This paragraph primarily describes what happened in a specific cybersecurity incident and the resulting response steps, so it is best classified as Incident Disclosure. Its specificity reaches Quantified-Verifiable because it includes a dated incident fact ('February 2023') tied to a real ransomware event, along with concrete incident details and remediation actions.


fact: The company has established a cross functional Information Security Steering Committee ("ISSC").

fact: The ISSC includes executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments.

fact: The company references a services agreement with Liberty.

reasoning: This paragraph primarily describes management’s organizational structure for cybersecurity oversight—specifically the existence, membership, and responsibilities of the ISSC—so Management Role is the best fit. Specificity is elevated by firm-specific details such as the named ISSC and its departmental composition, and by the reference to a named firm relationship with Liberty, which is externally checkable.


fact: DISH TV, SLING TV, and Retail Wireless services remained operational during the incident

fact: The company's wireless and data networks remained operational during the incident

fact: As of March 31, 2023, all significant systems had been restored

reasoning: The paragraph describes the status and resolution of a real cybersecurity incident, including operational impact and restoration timing, so it is primarily Incident Disclosure. Specificity is Quantified-Verifiable because it includes a concrete date and named services/networks whose operational status and restoration claim are externally checkable.


fact: Threat actors unlawfully accessed certain computer systems

fact: Threat actors exfiltrated images of video meetings and computer screens that may contain sensitive information

fact: The company closed off the point of unlawful access in response to the incident

fact: The company bolstered its cyber defensive capabilities after the incident

reasoning: The paragraph primarily describes an actual cybersecurity incident, including unauthorized access, data exfiltration, public release of information, and remediation steps, so it is Incident Disclosure. Its specificity is elevated by cyber-domain terminology such as threat actors, unlawful access, exfiltration, and defensive capabilities, but it lacks firm-unique roles/committees or externally verifiable dates, numbers, or named firms.


reasoning: The paragraph primarily explains how cybersecurity information is escalated to and overseen by the Board of Directors, including updates at meetings and between meetings, which makes it Board Governance. It does not include qualifying domain-specific terminology, firm-unique named roles/committees, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from third-party suppliers, so Third-Party Risk is the best fit. Its language remains generic—continuous assessment, contract addendums, and remediation with suppliers are common boilerplate practices and do not include domain-specific terminology, firm-unique details, or verifiable facts.


reasoning: The paragraph primarily describes how the board oversees cybersecurity, including delegation of primary oversight responsibility to a board committee, so it is Board Governance. Its language is generic and does not include qualifying domain-specific terms, firm-specific roles beyond excluded generic governance bodies, or externally verifiable facts.


fact: Chief Information Security Officer is responsible for overall data security and cybersecurity risk reduction efforts

fact: Chief Information Security Officer is responsible for information security compliance, training and awareness, and application, network and system security

fact: The Chief Information Security Officer has 25 years of prior experience in information systems, cybersecurity, risk management, and infrastructure management

fact: Certified Internal Controls Auditor (CICA) certification

fact: Payment Card Industry Professional (PCIP) certification

fact: Certified Information Systems Security Professional (CISSP) certification

fact: Certified Information Systems Auditor (CISA) certification

fact: Certified in Risk and Information Systems Control (CRISC) certification

fact: information security compliance

fact: application security

fact: network security

fact: system security

reasoning: This paragraph primarily describes how management is organized to handle cybersecurity by identifying the CISO’s responsibilities and qualifications, which makes it a Management Role disclosure. Specificity is Quantified-Verifiable because it includes externally checkable facts such as the CISO’s 25 years of experience and named professional certifications.


fact: regular vulnerability scans

fact: penetration tests

reasoning: The paragraph primarily describes what the company’s cybersecurity program does to identify, assess, monitor, and test cyber risk, which fits Risk Management Process. Its specificity rises above boilerplate because it includes cybersecurity-specific practices—vulnerability scans and penetration tests—but does not include firm-unique roles, committees, or externally verifiable facts.


reasoning: This paragraph primarily addresses how cybersecurity relates to the company's financial risk posture by stating that it maintains insurance coverage for potential cyber-related losses. It does not include qualifying domain-specific technical terminology, firm-unique organizational details, or externally verifiable facts, so specificity remains generic boilerplate.


fact: The company has established a cross functional Information Security Steering Committee ("ISSC").

fact: The ISSC includes executives from the Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments.

fact: The ISSC has management oversight responsibility for technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks.

fact: The committee was established through the company's services agreement with LMC.

reasoning: This paragraph primarily describes how management is organized for cybersecurity oversight by identifying a management-level committee, its membership, and its responsibilities, so Management Role fits best. Specificity reaches Quantified-Verifiable because it includes a named external firm/entity (LMC), along with firm-specific details such as the named ISSC and the specific departments represented.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk from vendors and other external service providers, making Third-Party Risk the best fit. Its language is largely generic vendor-risk and policy language without qualifying domain-specific technical terms or clearly firm-unique/verifiable facts, so the specificity remains Generic Boilerplate.


reasoning: The paragraph primarily describes a cybersecurity program activity—having an incident response plan and what it is intended to do—so it fits Risk Management Process. Its language is generic and does not include qualifying domain-specific terms, firm-unique organizational details, or verifiable facts, so specificity is Generic Boilerplate.


fact: vulnerability assessments

fact: threat environment

fact: information security considerations

reasoning: The paragraph primarily describes how the board, via the Audit Committee, receives information and oversees cybersecurity risk, so it is Board Governance. Its specificity rises above boilerplate because it includes cybersecurity-specific concepts such as vulnerability assessments and the threat environment, but it does not contain qualifying firm-specific or externally verifiable facts.


reasoning: The paragraph primarily describes the escalation path for cybersecurity risks from management to the Board, which makes board oversight the central question being answered. Its language is generic and contains no qualifying domain-specific terms, firm-unique roles/committees, or externally verifiable facts that elevate specificity above boilerplate.


fact: On February 23, 2023, DISH Network experienced a network outage.

fact: The outage affected DISH Network's internal servers and IT telephony.

fact: The company immediately activated its incident response and business continuity plans in response to the situation.

fact: The company engaged cyber-security experts and outside advisors to assist in evaluating the situation.

fact: The company determined that the outage was due to a cybersecurity incident and promptly notified appropriate law enforcement authorities.

fact: On February 28, 2023, the company disclosed that certain data had been extracted from the DISH Network IT systems.

fact: DISH Network

reasoning: This paragraph primarily describes a real cybersecurity incident, including what happened, when it occurred, and how the company responded, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes concrete dates and a named firm tied to the event, which are externally checkable facts.


reasoning: The paragraph primarily describes how management is organized to oversee cybersecurity—who is responsible, their experience, and how they interact with IT personnel—so Management Role is the best fit. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts under the rules because the cited roles are generic executives (CEO/CFO), the quarterly cadence is boilerplate, and the activities described remain high-level.


fact: The cybersecurity risk management program is based on recognized cybersecurity industry frameworks and standards

fact: National Institute of Standards and Technology

fact: Center for Internet Security Controls

fact: risk-based model to identify and manage cyber risks

reasoning: The paragraph primarily explains how the company's cybersecurity program is structured and operated, specifically that it is grounded in established frameworks for identifying and managing cyber risk, which fits Risk Management Process. Specificity is Domain-Adapted because it references concrete cybersecurity frameworks such as NIST and CIS Controls, but does not include firm-unique organizational details or externally verifiable quantified claims.


fact: The current Head of IT reports directly to the Chief Financial Officer

fact: The current Head of IT has over twenty years of experience managing information technology and cybersecurity matters

fact: The current Head of IT holds a Master of Science degree in Telecommunications and Computer Networks

fact: The current Head of IT is Project Management Professional certified

fact: The current Head of IT is Certified Scrum Master certified

fact: The current Head of IT is IT Infrastructure Library certified

reasoning: The paragraph primarily explains who in management is responsible for cybersecurity and the qualifications/reporting line of that person, so Management Role fits best despite some added ERM and materiality language. Specificity is Quantified-Verifiable because it includes externally checkable credentials and a specific claim of over twenty years of experience.


reasoning: The paragraph primarily gives a materiality assessment, stating that management has not identified cybersecurity risks that have materially affected or are reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its remaining content is generic cautionary language and a cross-reference, with no domain-specific technical terms, firm-specific organizational details, or externally verifiable facts.


reasoning: The paragraph primarily states management’s conclusion that cybersecurity threats and incidents are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration under the materiality rule. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the statements are generic negative assertions about absence of material impact/incidents.


reasoning: This paragraph is primarily regulatory context and a cross-reference to another section rather than a substantive disclosure about governance, management, processes, third-party risk, incidents, or strategy impact. It does not contain qualifying cybersecurity-specific facts that elevate specificity beyond boilerplate.


fact: Information Security Officer is primarily responsible for the cybersecurity component of the risk management program

fact: The Information Security Officer reports directly to the Chief Risk Officer

reasoning: The paragraph primarily explains how management is organized for cybersecurity by identifying the Information Security Officer’s responsibility and reporting lines. Its specificity is Firm-Specific because it includes firm-unique organizational details, including the named Information Security Officer role and the Information Technology Steering Committee, but no externally verifiable quantified fact.


reasoning: The paragraph primarily describes that the company uses and is considering third-party service providers to support its IT and cybersecurity functions, which fits risk management process more than third-party risk because it does not discuss oversight or requirements imposed on vendors. It contains no qualifying domain-specific terminology, firm-specific organizational details, or externally verifiable facts, so specificity remains generic boilerplate.


reasoning: The paragraph primarily gives a materiality assessment—stating that, despite past cybersecurity incidents and ongoing threats, cybersecurity risks have not materially affected the company to date—which fits Strategy Integration under the SEC materiality rule. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts beyond generic cyber-risk language and a cross-reference, so specificity remains Generic Boilerplate.


fact: managed security service monitoring

fact: penetration testing

fact: vulnerability assessment

fact: Management Enterprise Risk Committee

fact: Vendor Management Committee

reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from service providers and vendors, so Third-Party Risk is the best fit. Its specificity rises above generic process language because it includes cybersecurity domain terms and firm-specific named management committees.


fact: The CSO is identified as a management role responsible for coordinating implementation of the cybersecurity program.

reasoning: The paragraph primarily explains how management is organized to carry out cybersecurity responsibilities: the CSO coordinates with executive leadership and multidisciplinary teams across the company. Its specificity is elevated by the firm-specific management role of the CSO; the remaining language about protecting systems and responding to incidents is otherwise generic.


fact: References the National Security Agency (NSA) Cybersecurity Collaboration Center

fact: References the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Critical Partnership

fact: References the Federal Bureau of Investigation (FBI) InfraGard

fact: References the U.S. Coast Guard Area Maritime Security Committees and Cybersecurity Subcommittees

fact: References Cyber-Hawaii Maritime Transportation System Information Sharing and Analysis Center (MTS-ISAC)

reasoning: This fragment most directly supports how the company manages cybersecurity risk through external information-sharing and collaboration channels, which fits Risk Management Process better than the other categories. Specificity is elevated by the list of named external organizations and programs, which are concrete, identifiable affiliations/references rather than generic boilerplate.


reasoning: The paragraph primarily provides management’s materiality assessment of cybersecurity threats and incidents on the business, results of operations, financial condition, and strategy, which fits Strategy Integration. Its statements are high-level and generic; the negative assertions about no material impact and the mention of cyber insurance are not externally verifiable or sufficiently distinctive to raise specificity above boilerplate.


reasoning: The paragraph is primarily about how the company addresses cybersecurity risks arising from third-party service providers, suppliers, and manufacturers, so Third-Party Risk is the best fit. It stays at Generic Boilerplate because it describes vendor diligence, contractual requirements, and monitoring only at a high level, without domain-specific cybersecurity terminology, firm-unique structures, or verifiable details.


reasoning: The paragraph primarily explains how the company manages cybersecurity expectations for outside service providers, especially by requiring certifications of security measures and breach reporting, so Third-Party Risk is the best fit. It contains no qualifying domain-specific technical terms, firm-unique roles/programs, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily states management's conclusion that known cybersecurity risks are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which is a Strategy Integration materiality assessment. It contains no qualifying domain-specific terminology, firm-specific organizational facts, or externally verifiable claims, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its specificity is Generic Boilerplate because the statement is a non-verifiable negative assertion and the rest is a generic risk-factor cross-reference without qualifying domain, firm-specific, or externally verifiable facts.


reasoning: The paragraph primarily describes what the cybersecurity program does—using controls, technologies, policies, and outside support to assess and manage cyber risks—so it fits Risk Management Process. However, it contains no qualifying domain-specific terminology, firm-unique organizational details, or externally verifiable facts, making it Generic Boilerplate.


reasoning: The paragraph primarily provides the company's materiality assessment that no cybersecurity incidents have materially affected, or are reasonably likely to materially affect, its business, results, or financial condition, which fits Strategy Integration. Its only substantive claim is a negative self-assessment and a cross-reference, neither of which adds domain-specific, firm-specific, or externally verifiable detail.


reasoning: This paragraph primarily serves as a cross-reference to risk factors and contains only generic statements that the company faces cybersecurity risks and has experienced threats from time to time, without describing governance, management, processes, third-party risk, strategy, or a specific incident. Because it includes no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


fact: In 2019, the company was the subject of a successful phishing attempt.

fact: phishing attempt

reasoning: The paragraph primarily provides a materiality/business-impact assessment by stating that no known cybersecurity risks are reasonably likely to materially affect the company, which fits Strategy Integration. Its specificity rises to Quantified-Verifiable because it references a real cyber event tied to a specific year (2019), and also includes the domain-specific term 'phishing attempt.'


fact: The Company has a Chief Information Security Officer (CISO).

fact: The CISO is responsible for developing and implementing the information security program.

fact: The CISO reports cybersecurity matters to the Chief Risk Officer (CRO), who oversees the risk function including information security, compliance, legal, operational, and enterprise risk areas.

fact: The CISO has over 18 years of experience in information technology leadership.

fact: Eight years of the CISO's experience are in leading information security oversight.

reasoning: This paragraph primarily explains how management is organized for cybersecurity, focusing on the CISO’s responsibilities, reporting line to the CRO, and management oversight structure, so Management Role fits best. Specificity is Quantified-Verifiable because it includes externally checkable experience claims with concrete numbers (over 18 years and eight years) and firm-specific organizational details such as the CISO role and reporting structure.


fact: DISH TV and SLING TV services remained operational at all times during the incident

fact: As of March 31, 2023, all significant systems had been restored

reasoning: This paragraph describes the status and resolution of an actual cybersecurity incident, including service continuity and restoration, so it is primarily Incident Disclosure. Specificity is Quantified-Verifiable because it includes named services and a concrete restoration date (March 31, 2023).


fact: The company was targeted by a complex criminal scheme in March 2023

fact: The scheme resulted in fraudulently-induced outbound wire transfers to a third-party account

fact: The company contacted dispute resolution experts and federal and local law enforcement authorities in response

fact: The company incurred professional fees related to an independent forensic investigation and fund recovery efforts

fact: The company recognized $2.7 million of loss, net of funds recovered

reasoning: This paragraph primarily describes an actual cybersecurity-related event, including when it occurred, the nature of the fraudulent activity, the response, and the resulting loss, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes externally checkable facts such as the March 2023 timing and the $2.7 million recognized loss.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and other third parties through due diligence and ongoing monitoring, making Third-Party Risk the best fit. Its language remains generic and process-level; it does not include cybersecurity domain terms that pass the ERM test, firm-unique organizational details, or externally verifiable facts.


fact: The company has an internal Software Approval Board that approves new software before purchase or installation.

fact: The Software Approval Board includes members from Quality, Internal Audit, Information Security, Business Systems, and R&D.

fact: The company performs diligence on high-risk third parties that provide software or have access to its systems or highly sensitive information.

reasoning: The paragraph is primarily about how the company manages cybersecurity risk from vendors and software providers, including diligence, contractual requirements, and controls over third-party software, so Third-Party Risk is the best fit. Specificity rises to Firm-Specific because it names a company-specific governance body—the Software Approval Board—and gives its cross-functional composition.


fact: Third parties are assessed using a questionnaire covering security, including cyber risk

fact: External documentation requested includes SOC 2 Type 2 reports

fact: External documentation requested includes penetration testing results

fact: External documentation requested includes ISO 27001 certification and scope

fact: Third-party contracts include security and privacy clauses covering implementation of security controls and self-reporting

reasoning: The paragraph is primarily about how the company evaluates and monitors cybersecurity risk posed by vendors and other third parties, so Third-Party Risk is the best fit. Its specificity is Domain-Adapted because it uses cybersecurity-specific concepts and evidence types such as SOC 2 Type 2, penetration testing, and ISO 27001, but it does not provide firm-unique or externally verifiable company-specific facts.


fact: Management updates the audit committee on vulnerability assessments.

fact: In January 2024, the board of directors participated in a cybersecurity training session provided by the company's internal audit firm.

reasoning: The paragraph primarily describes how the board and its audit committee oversee cybersecurity, receive reporting, engage specialists, and participate in strategic decisions, so Board Governance is the best fit. Specificity rises to Quantified-Verifiable because it includes a concrete dated event in January 2024, and it also uses cybersecurity-specific terminology such as vulnerability assessments.


reasoning: The paragraph primarily introduces the existence and purpose of the company’s cybersecurity program—monitoring and improving cybersecurity—so it fits Risk Management Process better than Strategy Integration. However, it provides only high-level, generic statements without domain-specific practices, firm-unique structures, or verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes the existence and purpose of the company's cybersecurity risk assessment and management processes, so it is best categorized as Risk Management Process. Its language is high-level and generic, with no named frameworks, tools, roles, committees, dates, numbers, or other specificity-elevating facts.


fact: On February 23, 2023, the company experienced a network outage

fact: The outage affected internal servers and IT telephony

fact: The company activated its incident response and business continuity plans following the outage

fact: The company notified appropriate law enforcement authorities after determining the outage was due to a cybersecurity incident

fact: On February 28, 2023, the company disclosed that certain data had been extracted from the DISH Network IT systems

fact: DISH Network IT systems were identified as the source from which data was extracted

reasoning: This paragraph primarily describes a real cybersecurity event, including when it occurred, what systems were affected, and what response actions were taken, so it is best classified as Incident Disclosure. Its specificity is Quantified-Verifiable because it includes concrete dated incident facts and identifiable system impacts that could be externally checked.


reasoning: The paragraph primarily describes management personnel qualifications and experience relevant to overseeing cybersecurity-related risks, which fits Management Role. However, it does not include qualifying domain-specific cybersecurity terminology, firm-specific cybersecurity roles/structures, or clearly verifiable facts; the experience statement is too approximate and generic to elevate specificity.


fact: Reviewing relevant cybersecurity certifications as part of supplier risk assessments

fact: Reviewing third-party audit results for key suppliers

fact: Assessing suppliers' technical and organizational controls

reasoning: The paragraph is primarily about how the company evaluates cybersecurity risk posed by suppliers, so Third-Party Risk is the best fit. Its specificity rises above boilerplate because it identifies cyber-focused evaluation elements—certifications, audit results, and technical/organizational controls—but does not name firm-unique structures or externally verifiable facts.


fact: Compliance with the Interagency Guidance on Third-Party Relationships: Risk Management

reasoning: The paragraph is primarily about how the company manages cybersecurity-related risks arising from vendors and other third parties, making Third-Party Risk the best fit. Specificity rises above boilerplate because it cites a specific regulatory risk-management framework, but the other details are largely generic program and policy descriptions rather than firm-unique or externally verifiable facts.