reasoning: The paragraph primarily states management’s conclusion that cybersecurity incidents did not materially affect, and are not reasonably likely to materially affect, the company’s business strategy, results of operations, or financial condition, which is a Strategy Integration assessment. It contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts; the negative assertion and reporting-period date do not elevate specificity.


content_category: Strategy Integration

category_confidence: medium

specificity_confidence: high

reasoning: The paragraph primarily provides a materiality-style assessment that prior cybersecurity threats or incidents have not materially affected the company, which fits Strategy Integration under the SEC disclosure rules. Although it also mentions contractual expectations for third-party providers, those statements remain generic and contain no domain-specific, firm-specific, or externally verifiable facts, so specificity stays at Generic Boilerplate.

provider: openai

stage: benchmark


content_category: Incident Disclosure

fact: In November 2023, the Company initiated its cyber response protocol in response to a cybersecurity incident.

fact: The cybersecurity incident resulted in a disruption of portions of the Company's information technology systems.

category_confidence: high

reasoning: The paragraph primarily describes a real cybersecurity incident—when it occurred, what happened, and how the company responded—so Incident Disclosure is the best fit despite brief materiality statements. Specificity is Quantified-Verifiable because it includes a concrete, externally checkable date (November 2023) tied to the incident.


content_category: Third-Party Risk

reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and other external providers, so Third-Party Risk is the best fit. Its wording is generic and does not include cybersecurity-specific domain terms that pass the ERM test, firm-unique roles or structures, or any verifiable facts.


content_category: None/Other

reasoning: This paragraph is primarily a cross-reference to the risk factors section and contains only hypothetical, forward-looking risk language about possible adverse consequences, not a substantive disclosure about governance, management, process, third-party oversight, incidents, or strategy. Because it provides no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment of how cybersecurity threats have affected or could affect the company’s operations, business strategy, results of operations, and financial condition, which fits Strategy Integration. Its statements are generic and self-reported, and the negative assertion about no material effects is not externally verifiable, so no qualifying specific facts elevate specificity above boilerplate.


reasoning: The paragraph primarily discusses the potential business and financial consequences of cybersecurity issues and includes a backward-looking assessment that the company is not aware of any cybersecurity threats or incidents to date, which fits Strategy Integration better than pure risk-process disclosure. Its specificity is Generic Boilerplate because it contains no qualifying domain-specific technical terms, firm-specific organizational facts, or externally verifiable claims; the negative assertion about no incidents does not count as verifiable.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk arising from vendors and contractors, so Third-Party Risk is the best fit. It remains generic boilerplate because it describes vendor assessments and security requirements only at a high level, without domain-specific cyber practices, firm-unique structures, or verifiable facts.


reasoning: The paragraph primarily provides a materiality assessment about whether cybersecurity incidents have affected or are reasonably likely to affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain, firm-specific, or externally verifiable facts because a negative assertion about the absence of material incidents is not independently verifiable.


content_category: Management Role

fact: The Chief Operations Officer (COO) leads the development and implementation of the company's cybersecurity strategy

fact: The COO has over 15 years of experience in cybersecurity

type: quantified

reasoning: This paragraph primarily describes management's cybersecurity leadership structure and the COO's responsibilities and qualifications, which makes it a Management Role disclosure. Specificity reaches Quantified-Verifiable because it includes a concrete, externally checkable claim that the COO has over 15 years of cybersecurity experience.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats have not materially affected the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the references to threats, breaches, and third-party vendors are generic and non-specific.


fact: January 2020

fact: the President and CEO has more than 20 years of experience in the Business Finance and Audit management industry

reasoning: The paragraph primarily describes who in management is responsible for cybersecurity and how that person interfaces with the board, which makes it a management-organization paragraph rather than a board-oversight one. Its specificity is elevated by verifiable facts: the January 2020 date and the claim of more than 20 years of experience.


reasoning: The paragraph primarily states management's conclusions about whether cybersecurity incidents or risks have materially affected, or are reasonably likely to materially affect, the business, which is a Strategy Integration disclosure under the materiality rule. It does not include qualifying domain-specific terminology, firm-specific organizational details, or externally verifiable claims, so specificity remains Generic Boilerplate.


reasoning: This paragraph is a cross-reference to risk factors and contains only hypothetical, forward-looking consequences of possible cybersecurity threats rather than describing governance, management, processes, third-party risk management, strategy assessments, or an actual incident. It includes no qualifying domain-specific, firm-specific, or verifiable facts, so the specificity is Generic Boilerplate.


fact: The incident involved a ransomware virus

fact: Several machines on the company's corporate network were encrypted

fact: Affected files were restored from backup

specificity_confidence: medium

reasoning: This paragraph primarily describes an actual cybersecurity event—what happened, how it was contained, and its operational and financial impact—so it is best classified as Incident Disclosure. Its specificity is Domain-Adapted because it uses cybersecurity-specific concepts such as ransomware, network encryption, and backup restoration, but it does not include firm-unique roles/structures or clearly externally verifiable facts like dates, named vendors, or hard metrics.


content_category: Board Governance

reasoning: The paragraph primarily describes how the board oversees cybersecurity, including who at the board level is responsible and when the board is engaged, which fits Board Governance. It does not contain qualifying domain-specific terms, firm-unique roles/committees, or externally verifiable facts beyond generic board oversight language and cadence.


content_category: Risk Management Process

reasoning: The paragraph primarily describes what the company’s cybersecurity program does in response to incidents—maintaining and evaluating an Incident Response Plan and using it to coordinate notification and escalation—so Risk Management Process is the best fit. It does not include qualifying domain-specific technical terms, firm-unique cyber governance details, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: This paragraph is primarily a general threat-landscape statement about the kinds of cyber threats companies may face, rather than describing Okta’s governance, management structure, risk management process, third-party risk program, a specific incident, or business impact assessment. Although it mentions cyber attack types, it does not provide substantive company-specific measures or other qualifying facts, so under the rules for None/Other it remains Generic Boilerplate.


reasoning: This paragraph is a definitional statement about what "systems" means rather than a substantive disclosure about governance, management, risk processes, third-party risk, incidents, or strategy. It contains no qualifying domain-specific, firm-specific, or verifiable facts, so the specificity is Generic Boilerplate.


category_confidence: low

reasoning: This excerpt is primarily a cross-reference to the Risk Factors section and does not provide a substantive description of governance, management, risk processes, third-party risk, incident details, or strategy integration. Because it contains no qualifying domain-specific, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


fact: phishing attempts

fact: technical vulnerabilities

reasoning: The paragraph primarily provides a materiality assessment, stating that no cybersecurity incidents had a material impact on operations, liquidity, or financial condition, which fits Strategy Integration. Its specificity rises above boilerplate because it references concrete cybersecurity concepts such as phishing attempts and technical vulnerabilities, but it does not include firm-specific or externally verifiable facts.


reasoning: This paragraph is a cross-reference directing readers to risk factor disclosures in Item 1A rather than providing substantive cybersecurity governance, management, process, incident, third-party, or strategy detail itself. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes how the company’s cybersecurity risk management program is structured within its broader risk management approach, which fits Risk Management Process. It contains only generic ERM integration language and no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: This paragraph is a forward-looking risk statement about possible cybersecurity harms and a cross-reference to Risk Factors, not a description of governance, management, processes, third-party oversight, strategy assessment, or an actual incident. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts under the rubric, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that prior cybersecurity incidents have not materially affected and are not reasonably likely to materially affect the company, which makes Strategy Integration the best fit. Its other statements are generic risk and cautionary language, and it contains no qualifying domain-specific, firm-specific, or externally verifiable facts that elevate specificity above boilerplate.


reasoning: This paragraph is primarily a generic risk/disclaimer statement about possible cybersecurity harm and the company's limited capabilities, rather than a substantive description of governance, management, processes, third-party oversight, incidents, or business-impact assessment. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts that elevate specificity above boilerplate.


reasoning: The paragraph is primarily about how the company manages cybersecurity-related risks from third-party service providers, so Third-Party Risk is the best fit. It contains no qualifying domain-specific cybersecurity terminology, firm-unique organizational details, or externally verifiable facts, so the specificity remains Generic Boilerplate.


reasoning: The paragraph primarily explains how the board oversees cybersecurity by describing delegation of oversight from the Board to the Audit Committee, so it fits Board Governance. Its language is generic oversight boilerplate and contains no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: The chief technology officer is responsible for the information security team and cybersecurity program

fact: The chief technology officer has over a decade of industry experience

reasoning: The paragraph primarily explains how management is organized for cybersecurity—centering on the CTO’s responsibility, experience, and reporting role—rather than focusing mainly on board oversight. Specificity reaches Quantified-Verifiable because it includes a verifiable experience claim ('over a decade of industry experience'), along with the firm-specific CTO role.


fact: Uses security software, including cloud-based technology, to scan and analyze for vulnerable software or misconfigurations

fact: Assesses key third-party cybersecurity controls through a cybersecurity questionnaire

reasoning: The paragraph primarily explains how the company evaluates and manages cybersecurity risk posed by vendors, including questionnaires, contractual controls, monitoring, and termination rights, so Third-Party Risk is the best fit. Its specificity rises above boilerplate because it includes cybersecurity-specific concepts such as scanning for vulnerable software or misconfigurations and assessing third-party cybersecurity controls, but it does not provide firm-unique or externally verifiable details.


fact: The company states its websites use hosting and hosting-related services from Namecheap, GoDaddy, and Cloudflare.

reasoning: The paragraph primarily addresses cybersecurity exposure arising from third-party service providers that host or support the company’s websites, making Third-Party Risk the best fit. Specificity reaches Quantified-Verifiable because it names external firms—Namecheap, GoDaddy, and Cloudflare—which are concrete, externally checkable facts.


fact: The Director of Information Technology has over 20 years of experience in information security, risk management, and compliance.

reasoning: The paragraph primarily describes the oversight chain for cybersecurity risk management, with the board's audit committee overseeing and management roles situated beneath it, which makes Board Governance the best fit. Its specificity is elevated to Quantified-Verifiable by the concrete claim that the DIT has over 20 years of relevant experience.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk, specifically stating that oversight occurs at the full Board level and through the Audit Committee. Its language is generic governance boilerplate and contains no qualifying domain-specific, firm-specific, or externally verifiable facts.


reasoning: The paragraph primarily describes management responsibility and qualifications: a Director is responsible for the information security program, and the Director and CFO review cyber risks. It does not include qualifying domain-specific cybersecurity terminology beyond generic risk/control language, nor any firm-specific or externally verifiable facts.


fact: The company obtains and reviews attest reports covering cyber-related controls at certain third parties.

fact: The company designs and implements complementary user entity controls for relevant third-party arrangements.

fact: The company maintains communication channels for cyber incident notifications with third parties.

fact: The company has contractual safeguards in place for cyber incidents involving third parties.

reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from service providers and other third parties, making Third-Party Risk the best fit. Its specificity is elevated by cybersecurity-domain concepts such as attest reports and complementary user entity controls, but it does not include firm-unique roles, committees, dates, numbers, or other externally verifiable facts.


reasoning: The paragraph primarily describes the company’s incident response planning process—what the plan includes and how it is intended to guide response activities—so it is best classified as Risk Management Process. The added statements about having no material cybersecurity incidents and a non-cyber physical break-in do not provide qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts under the specificity rules, so the paragraph remains Generic Boilerplate.


fact: confidentiality, integrity, or availability of information systems

reasoning: The paragraph primarily gives a materiality assessment—stating that known cybersecurity threats and prior incidents have not materially affected, and are not reasonably likely to materially affect, the company’s operations, strategy, results, or financial condition—so Strategy Integration fits best. Its specificity rises above boilerplate only because it includes the cybersecurity-domain concept of confidentiality, integrity, and availability; the remaining statements are largely generic and the negative materiality assertion is not externally verifiable.


reasoning: The paragraph primarily describes what the company’s cybersecurity risk management program does and how it is integrated into enterprise risk management, so Risk Management Process is the best fit despite the brief oversight reference. Its terms are generic ERM-style phrases like risk assessments and maturity assessments, and the only named governance body is the Audit Committee, which does not count toward specificity here.


reasoning: This paragraph primarily describes how the board oversees cybersecurity by delegating responsibility to a board committee and receiving updates, which fits Board Governance. It contains only generic governance language such as board oversight, Audit Committee involvement, and regular updates, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


reasoning: The paragraph primarily describes what the company's cybersecurity program does—risk assessments, training, incident response planning, monitoring, and use of internal/external support—so it fits Risk Management Process. Its language remains generic and does not include qualifying domain-specific terminology, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


fact: In 2019, the company was a victim of a wire fraud scheme

fact: A fraudulent party compromised an employee's email account and sent a fraudulent wire transfer request to the company's bank

fact: After the incident, the company implemented multi-factor authentication (MFA) across its systems and email accounts

fact: The company enhanced internal controls and training to prevent and detect wire fraud and other cyber risks

reasoning: The paragraph primarily describes a real cybersecurity-related event—its nature, alleged cause, and remediation—so Incident Disclosure is the best fit. Specificity reaches Quantified-Verifiable because it includes a dated incident in 2019, alongside concrete cyber details such as email compromise and implementation of MFA.


fact: Chief Information Officer (CIO) oversees the Chief Information Security Officer (CISO)

fact: The CISO and the Information Security team lead the enterprise-wide information security strategy, policy, standards, architecture, and processes

fact: Cyber Incident Response Teams operate under the CISO

reasoning: The paragraph primarily explains how management is organized for cybersecurity—who leads it, who reports to whom, and which teams are responsible—so Management Role is the best fit. Specificity is Firm-Specific because it includes company-specific leadership roles and internal team structure (CIO, CISO, Information Security team, Cyber Incident Response Teams), but no externally verifiable numbers, dates, or named third parties.


fact: The breach was publicly disclosed and notifications were provided to potentially impacted customers.

fact: The SEC is conducting an investigation into data breaches resulting from failures in Progress software.

fact: On or about February 26, 2024, the company received a request from the SEC to preserve and provide documents and information related to the investigation.

reasoning: This paragraph primarily describes an actual cybersecurity incident and the related regulatory response, so Incident Disclosure is the best fit. Its specificity is Quantified-Verifiable because it includes externally checkable facts such as the named software vendor Progress, the SEC investigation, and the specific date of the SEC document request.


fact: The company has a CISO

fact: The company has a Security Governance Committee

fact: Members of the Security Governance Committee are selected from the Adviser's business groups

fact: The CISO has over 20 years of cybersecurity and technology management experience

reasoning: This paragraph primarily describes management-level cybersecurity organization and qualifications, specifically the CISO and Security Governance Committee. Specificity is Quantified-Verifiable because it includes firm-specific roles/committee names and a verifiable claim that the CISO has over 20 years of relevant experience.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from vendors, service providers, and other external parties, making Third-Party Risk the best fit. It uses only generic risk-management language and does not include qualifying domain-specific terminology, firm-specific organizational details, or verifiable facts.


reasoning: The paragraph primarily provides background on the company's dependence on IT and OT systems and the general types of business systems it uses, rather than describing cybersecurity governance, management roles, risk processes, third-party oversight, incidents, or business-impact assessments. Because it contains no substantive cybersecurity measure, process, or assessment, it falls into None/Other and is treated as Generic Boilerplate.


reasoning: The paragraph primarily addresses the business/financial implications of cybersecurity by noting potential material adverse effects and that cybersecurity insurance may not fully cover related costs, which fits Strategy Integration more than pure risk-process discussion. Its language is otherwise generic and speculative, with no domain-specific cybersecurity terminology, firm-unique organizational details, or externally verifiable claims.


fact: The company has an executive risk committee overseeing cybersecurity risk assessment and mitigation activities.

fact: The executive risk committee is comprised of the Chief Legal Officer and the Senior Vice President, Engineering Operations, among others.

fact: The Senior Vice President, Engineering Operations is identified as a member of the executive risk committee with technical experience and education in computer engineering.

reasoning: This paragraph primarily explains how management is organized to handle cybersecurity, focusing on the executive risk committee’s role, membership, and expertise rather than board oversight or detailed program activities. Its specificity rises to Firm-Specific because it includes a named management committee and a specific VP-level role tied to cybersecurity governance, but it does not contain a hard, externally verifiable fact such as a date, headcount, certification, or named outside firm.


reasoning: The paragraph primarily describes how the Board oversees cybersecurity through expertise, documentation, and reporting mechanisms, which squarely fits Board Governance. However, it contains no qualifying domain-specific technical terms, firm-unique roles or committees, or externally verifiable facts, so its specificity is Generic Boilerplate.


reasoning: The paragraph primarily addresses how the company engages with third-party vendors on cybersecurity matters, making third-party risk the best fit. It contains no qualifying domain-specific terms, firm-unique organizational details, or externally verifiable facts, so specificity remains generic boilerplate.


fact: The cybersecurity program is under the direction of the Chief Technology Officer (CTO).

fact: The CTO has over 26 years of information technology experience.

reasoning: This paragraph primarily describes management’s organization and qualifications for cybersecurity, especially the CTO’s leadership, experience, and responsibility for the cybersecurity team, so Management Role is the best fit. Specificity is Quantified-Verifiable because it includes a firm-specific leadership role (CTO) and a verifiable numeric claim that the CTO has over 26 years of IT experience.


fact: ransomware

fact: malware

fact: computer viruses

fact: phishing attempts

fact: cyber intrusions over the Internet

reasoning: The paragraph primarily gives a materiality-oriented assessment that the company is not aware of any material cybersecurity incidents in the last three years, which fits Strategy Integration under the negative-assertion rule. Specificity rises above boilerplate because it names several concrete cyber threat types such as ransomware, malware, phishing, viruses, and cyber intrusions, but it contains no qualifying firm-specific or externally verifiable cybersecurity fact.


fact: Form 8-K filed on July 14, 2023 disclosed the incident

fact: On or about May 31, 2023, the company was informed of the issue

fact: The issue involved a zero-day vulnerability

fact: The vulnerability was in the vendor's managed file transfer software MOVEit

fact: The Bank uses MOVEit to transfer sensitive and confidential information

fact: MOVEit was used for the First National 1870 and Guardian Mortgage divisions

reasoning: This paragraph primarily describes an actual cybersecurity event, including when the company learned of it and the affected software, so it is Incident Disclosure. Specificity is Quantified-Verifiable because it includes concrete dates and the named product MOVEit, along with the zero-day vulnerability detail and named business divisions.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and third-party systems, so Third-Party Risk is the best fit. It remains generic boilerplate because it describes high-level vendor risk assessment and notification processes without any domain-specific cybersecurity terminology, firm-specific structures, or verifiable details.


fact: utilizing a third-party security scoring system to evaluate the security posture of current and potential parties

fact: ongoing monitoring to support continuous compliance with cybersecurity standards

reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and other third parties, making Third-Party Risk the best fit. Specificity rises above boilerplate because it includes cyber-specific practices such as use of a third-party security scoring system and ongoing monitoring for compliance, but it does not provide firm-unique or externally verifiable details.


fact: Chief Information Officer

reasoning: This paragraph primarily describes how cybersecurity information flows to the Audit Committee and full Board, making it a board oversight disclosure. Specificity rises to Firm-Specific because it names the Chief Information Officer, while the rest of the paragraph is otherwise largely generic governance language.


reasoning: This paragraph is a high-level statement of commitment to protect IT assets and data, but it does not describe any actual governance structure, management role, cybersecurity process, third-party risk practice, incident, or business impact assessment. It contains no domain-specific terminology, firm-specific organizational details, or verifiable facts, so its specificity is generic boilerplate.


fact: The Company has an Incident Response Plan ("IRP").

fact: The IRP sets forth processes for containment, review, escalation, recovery, and remediation of cybersecurity incidents.

fact: Incidents are promptly reviewed by the Incident Response Team ("IRT").

fact: The IRT is a committee of IT members that includes the Company's Chief Information Officer.

fact: Incidents that may be material are escalated to the DPT, which oversees investigation and response.

reasoning: This paragraph primarily describes the company's incident response workflow—how incidents are reviewed, escalated, investigated, and remediated—so it is best categorized as Risk Management Process rather than governance or management structure. Specificity rises to Firm-Specific because it names internal structures and roles such as the IRP, IRT, DPT, and Chief Information Officer.


reasoning: The paragraph primarily describes the existence of the company's cybersecurity risk management processes—i.e., that it has processes to identify, assess, and manage cyber risks affecting systems and data—so it fits Risk Management Process. Its language remains high-level and generic, without cybersecurity-specific domain terms that pass the ERM test or any firm-specific or externally verifiable facts, so specificity is Generic Boilerplate.


fact: The company’s Director of Information Technology has more than 20 years of experience in financial services.

fact: The Director of Information Technology has a degree from the University of California, Santa Barbara with a focus on Business Administration coursework.

fact: The Director of Information Technology holds the Certified Information Systems Security Professional (CISSP) certification from ISC2.

type: framework

fact: ISC2 is named as the certifying organization.

reasoning: This paragraph is primarily about management organization and qualifications because it describes the responsibilities, expertise, training, and credentials of the executive responsible for cybersecurity and information security programs. Specificity is Quantified-Verifiable due to the externally checkable claim of more than 20 years of experience and the named CISSP certification and education credential.


reasoning: The paragraph primarily addresses how cybersecurity relates to business and financial exposure by discussing cybersecurity insurance and its limits in managing financial statement risk. It does not include qualifying domain-specific technical terminology, firm-unique organizational details, or externally verifiable facts, so its specificity remains generic boilerplate.


reasoning: The paragraph primarily describes how the board oversees cybersecurity through delegation to the Audit Committee, which is board-level governance. Its language is generic oversight boilerplate and contains no qualifying domain-specific, firm-specific, or externally verifiable facts under the stated rules.


reasoning: The paragraph primarily addresses whether cybersecurity threats have affected or could affect the company’s business, financial condition, results of operations, and cash flows, which fits Strategy Integration. Its statements are generic impact/risk language plus a negative self-assessment and cross-reference, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: data encryption

fact: breach notification

reasoning: The paragraph primarily describes part of the company's cybersecurity risk management/compliance process—monitoring legislative and regulatory developments to maintain compliance—rather than board oversight, management structure, or a specific incident. Its specificity rises above boilerplate because it references cybersecurity-domain concepts such as data encryption and breach notification, but it includes no firm-specific roles, committees, dates, numbers, or other externally verifiable facts.


fact: Suppliers that access, host, or transmit company data must comply with Security Policies and Standards

fact: Periodic supplier security audits or risk assessments include security questionnaires

fact: Supplier reviews include security capabilities and maturity assessments

fact: Supplier reviews include controls evidence reviews

fact: Supplier reviews include application vulnerability assessments

fact: Supplier reviews include public internet presence monitoring

fact: Supplier reviews include alignment reviews with service-specific industry standards such as NIST, ISO, HIPAA, and Payment Card Industry standards

fact: Supplier contracts include right-to-audit provisions

fact: Supplier contracts include technology requirements, key performance metrics, service levels, and background checks for personnel with network access

reasoning: This paragraph is primarily about how the company manages cybersecurity risk from suppliers, so Third-Party Risk is the best fit. Its specificity rises above boilerplate because it describes concrete vendor-security control activities and cites named cybersecurity/privacy frameworks and standards, but it does not include firm-unique roles/committees or externally verifiable quantified facts.


fact: The GISO partners with third-party cybersecurity service and product vendors to help protect networks, information resources, products, services, and data.

fact: The company engages third-party cybersecurity and data protection experts to perform cybersecurity maturity assessments.

fact: The company conducts independent reviews of its cybersecurity control environment and operating effectiveness.

fact: The Chief Information Security Officer receives and reports assessment, audit, and review results to the executive team.

reasoning: The paragraph primarily describes what the cybersecurity program does—using external providers and assessments to evaluate and strengthen controls—so it is best categorized as Risk Management Process rather than Third-Party Risk, since the third parties are serving the company rather than being overseen as vendors. Specificity reaches Firm-Specific because it includes firm-unique organizational facts such as the GISO and the Chief Information Security Officer, along with some cybersecurity-specific assessment terminology.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats have not materially affected the company and are not reasonably likely to materially affect its business strategy, results of operations, or financial condition, which squarely fits Strategy Integration. Its language is otherwise generic and speculative, with no qualifying domain-specific terminology, firm-specific organizational details, or externally verifiable facts.


reasoning: The paragraph primarily provides a materiality assessment: it states that the company has not experienced material cybersecurity incidents and that related expenses were immaterial, which fits Strategy Integration under the negative-assertion/materiality rule. Its references to a three-year period and a cross-reference to Item 1A do not add qualifying domain, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: The paragraph discusses general IT investments to support operations, customer experience, compliance, and growth, but it does not describe cybersecurity oversight, management, processes, incidents, third-party cyber risk, or cyber-related business impact. Because it contains no qualifying cybersecurity-specific or verifiable facts, its specificity is Generic Boilerplate.


fact: protect the confidentiality, integrity, and availability of its critical systems and information

reasoning: The paragraph primarily describes the company's cybersecurity risk management program and its integration into a broader risk framework, which is about how cyber risk is managed rather than who oversees it. Specificity rises above boilerplate because it uses the cybersecurity-specific confidentiality, integrity, and availability triad, but it contains no firm-specific roles, committees, dates, numbers, or other verifiable facts.


fact: The company maintains a comprehensive Security Incident Response Plan ("SIRP").

fact: encryption protocols

fact: multi-factor authentication

fact: data loss prevention controls

reasoning: The paragraph primarily describes what the cybersecurity program does—incident response planning, coordination during incidents, data protection measures, and resilience testing—so it is best classified as Risk Management Process. Its specificity rises to Firm-Specific because it includes a named internal program, SIRP, and also uses cybersecurity-specific technical terms such as multi-factor authentication and data loss prevention controls.


fact: The Company has an Information Security Program ("ISP")

fact: The Information Technology Board Committee ("ITBC") oversees the ISP

fact: The IT Steering Committee ("ITSC") is part of the oversight structure for the ISP

reasoning: This paragraph primarily describes the oversight structure for cybersecurity, centered on board- and committee-level supervision of the Information Security Program, so Board Governance is the best fit. Its specificity is Firm-Specific because it names a distinct internal program (ISP) and two named committees (ITBC and ITSC), but includes no externally verifiable quantitative claim.


reasoning: The paragraph primarily gives a materiality assessment that cybersecurity threats or incidents have not materially affected, and are not reasonably likely to materially affect, the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its specificity is Generic Boilerplate because it contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the 2023 negative assertion is not independently verifiable under the rubric.


fact: The company has a Cybersecurity management team with primary responsibility for the overall cybersecurity risk management program

fact: The Cybersecurity management team is led by Brian Fellon

fact: Brian Fellon serves as Vice President, Chief Information Officer and Chief Information Security Officer (VP, CIO and CISO)

fact: Mr. Fellon joined NW Natural and was appointed to his role in September 2024

fact: Mr. Fellon has 28 years of experience in information technology

fact: Prior to joining NW Natural, Mr. Fellon served as Director of Information Technology at Puget Sound Energy in Bellevue, Washington

fact: Mr. Fellon held that Puget Sound Energy role from 2016 to September 2024

reasoning: This paragraph is primarily about how management is organized to handle cybersecurity, focusing on the cybersecurity management team, its leader, reporting structure, and the executive's qualifications and experience. Specificity reaches Quantified-Verifiable because it includes externally checkable facts such as Brian Fellon’s title, appointment in September 2024, 28 years of IT experience, and his prior role at Puget Sound Energy from 2016 to September 2024.


reasoning: The paragraph primarily explains how the company evaluates cybersecurity-related risks from vendors before onboarding them, making Third-Party Risk the best fit. Its language is generic vendor-risk boilerplate without domain-specific cyber terminology, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


fact: security threat intelligence system

fact: internal vulnerability management tools

fact: patch management standard

fact: Security Operations Center

fact: real-time awareness

fact: event correlation

reasoning: The paragraph primarily describes what the cybersecurity program does—threat intelligence collection, patch management, and SOC-enabled monitoring/response—so it fits Risk Management Process. Its specificity is Domain-Adapted because it uses concrete cybersecurity terminology such as vulnerability management, patch management, Security Operations Center, and event correlation, but does not include firm-unique roles, named internal programs, or externally verifiable facts.


reasoning: The paragraph primarily describes the board oversight structure for cybersecurity, specifically how the Board’s oversight is supported by the Audit Committee and informed by management. It contains no qualifying specificity-elevating facts because the Audit Committee is a generic board committee and the Director of Information Technology title without a security qualifier does not count as firm-specific.


reasoning: The paragraph primarily describes the company’s general cybersecurity activities—seeking to detect, investigate, and prevent unauthorized attacks—so it most directly answers what the program does rather than board oversight or management structure. Its language remains high-level and generic, with no qualifying domain-specific technical terms, firm-unique organizational details, or externally verifiable facts.


reasoning: This sentence is a general contextual statement about the cyber threat landscape and does not describe board oversight, management roles, risk processes, third-party risk, an actual incident, or business impact. It contains no domain-specific cybersecurity practices, firm-specific details, or verifiable facts, so the specificity is Generic Boilerplate.


fact: The board has a technology committee responsible for overseeing cybersecurity risk management processes.

reasoning: The paragraph primarily explains how the board oversees cybersecurity, including delegation to board committees and reporting from management, which makes Board Governance the best fit. Specificity rises above boilerplate because it identifies a non-generic board technology committee, a firm-specific governance detail; the rest of the language is otherwise general oversight and risk-management phrasing.


reasoning: The paragraph primarily provides a materiality assessment, stating that known cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company’s operations, strategy, results, or financial condition, which fits Strategy Integration. Its remaining content is generic cautionary language and a risk-factor cross-reference, with no domain-specific, firm-specific, or externally verifiable facts that elevate specificity.


reasoning: The paragraph primarily describes what the company's cybersecurity program does—risk assessment, prioritization, mitigation, policies, escalation, and employee training—so it is best categorized as Risk Management Process. However, it uses broad ERM-style language without cybersecurity-specific domain terms, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


fact: The Critical Threat Committee evaluates the materiality of cybersecurity incidents using criteria reviewed with the Board of Directors

fact: If a cybersecurity incident is deemed material, the Critical Threat Committee briefs the Board of Directors and oversees the disclosure process

reasoning: This paragraph primarily explains how cybersecurity incident materiality determinations are escalated to and communicated with the Board, making it a board oversight and information-flow disclosure. Its specificity is elevated by the firm-specific named body, the Critical Threat Committee, but it does not include independently verifiable dates, quantities, or named external firms.


reasoning: The paragraph primarily provides a materiality-focused assessment that the company is not aware of any cybersecurity incidents or threats that have materially affected its business, financial condition, or results of operations, which fits Strategy Integration under the negative-assertion rule. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts beyond generic risk and cross-reference language, so specificity is Generic Boilerplate.


fact: In March 2020, the company experienced a ransomware attack

fact: The incident was a ransomware attack

fact: Cybercriminals were able to access the company’s information technology systems

fact: The company states it isolated the source of the attack and restored normal operations

fact: The company believes confidential information was stolen

reasoning: The paragraph primarily describes a real cybersecurity event—its timing, nature, access to systems, response, and possible consequences—so Incident Disclosure is the best fit despite opening and closing materiality language. Specificity is Quantified-Verifiable because it includes a concrete, externally checkable date tied to an actual incident ('In March 2020') and additional incident-specific facts.


fact: The paragraph references the cybersecurity objective of maintaining the security, confidentiality, integrity, and availability of systems and information

reasoning: The paragraph primarily describes the company’s cybersecurity program activities—policies, processes, incident response planning, and external assessments—so it is best categorized as Risk Management Process. Specificity rises above boilerplate because it uses the cybersecurity concept of confidentiality, integrity, and availability, but it does not include firm-specific roles, committees, named systems, or verifiable facts.


fact: The company has a Security Committee that oversees the management of risks from cybersecurity threats.

fact: The company has a Chief Security Officer (CSO) responsible for developing, implementing, and maintaining cybersecurity risk management policies and procedures.

fact: The CSO provides regular cybersecurity updates to the Chairman of the Board.

fact: The company has a Cyber Risk Advisory Committee that oversees Information Technology strategy, priorities, and governance, including cybersecurity threats and risk assessments.

reasoning: The paragraph primarily describes the board-level oversight structure for cybersecurity, including how oversight is delegated to committees and how management reports upward, so Board Governance is the best fit. Specificity is Firm-Specific because it includes company-distinguishing governance details such as the Security Committee, Cyber Risk Advisory Committee, and the CSO role, but no externally verifiable quantified claim.


fact: Information regarding cybersecurity risks and incidents may be elevated from the CISO through reporting channels to the Audit Committee and the Board

reasoning: The paragraph primarily explains how cybersecurity information flows upward to the Board, which makes it a board oversight/governance disclosure rather than a management-organization paragraph. Its specificity is elevated to Firm-Specific because it identifies the CISO as part of that governance chain; the rest of the language is largely generic governance process description.


reasoning: The paragraph primarily provides a materiality assessment that cybersecurity threats have not materially affected the company's business strategy, results of operations, or financial condition, which fits Strategy Integration. Its only other content is a generic cross-reference, and the negative assertion over the last three fiscal years is not treated as an externally verifiable fact under the rules, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily explains how the company oversees a service provider's cybersecurity obligations, making third-party risk the central topic. It contains no qualifying domain-specific terminology, firm-unique roles/committees/programs, or externally verifiable facts beyond generic references to an unnamed IT consultant and standard oversight language.


fact: security event monitoring and detection

fact: extended detection and response

fact: vulnerability scanning

fact: phishing simulations

fact: penetration tests

reasoning: The paragraph primarily describes what the company's cybersecurity program does—its monitoring, detection, testing, and training activities—so it fits Risk Management Process. Specificity is Domain-Adapted because it uses concrete cybersecurity practices and tooling terms such as extended detection and response, vulnerability scanning, phishing simulations, and penetration tests, but does not provide firm-unique or externally verifiable facts.


reasoning: This paragraph is primarily a disclaimer and cross-reference to another section for potential business impacts, rather than a substantive disclosure about governance, management, risk processes, third-party risk, incidents, or strategy integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so the specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes what the company's cybersecurity program does—risk assessments, training, incident response planning, use of external assessors, and third-party risk management—so Risk Management Process is the best fit. Its details remain largely generic process descriptions without qualifying domain-specific technical terminology that clearly passes the ERM test, firm-unique organizational facts, or externally verifiable claims.


reasoning: The paragraph is primarily about how the company evaluates and governs vendors that provide critical services or handle sensitive information, making third-party risk the central topic. It does not include qualifying domain-specific cybersecurity terminology, firm-unique organizational details, or externally verifiable facts, so the specificity remains generic boilerplate.


fact: identity management and access control safeguards

fact: encryption of data in transit and at rest

fact: system and network security and monitoring

reasoning: The paragraph primarily describes the company’s cybersecurity protective measures, so it is about the risk management process rather than governance or management structure. Its specificity is elevated by concrete cybersecurity practices such as identity and access controls, encryption in transit and at rest, and system/network security monitoring, but it contains no firm-specific or externally verifiable facts.


fact: Cybersecurity Leadership Team provides reports on cybersecurity matters to the Audit Committee

reasoning: The paragraph primarily describes how the board oversees cybersecurity, including delegation to the Audit Committee and reporting flows up to the Board, which makes Board Governance the best fit. Specificity rises above boilerplate because it names a firm-specific internal body—the Cybersecurity Leadership Team—while the rest of the paragraph is otherwise general governance language.


fact: The company's cybersecurity programs are directly supported by the ITD

fact: The Director of ITD has over 7 years of experience leading cybersecurity teams and programs

reasoning: The paragraph primarily describes the oversight structure for cybersecurity, emphasizing the Board of Directors' responsibility and how management escalates cyber risk information to the board, which makes Board Governance the best fit. Specificity reaches Quantified-Verifiable because it includes a concrete, externally checkable claim that the Director of ITD has over 7 years of cybersecurity leadership experience, and it also references the firm-specific ITD team.


reasoning: The paragraph primarily describes how the board, through the Audit Committee, receives information about cybersecurity risk and significant incidents, which is board-level oversight. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts because the Audit Committee and regular management reporting are generic governance disclosures.


reasoning: The paragraph primarily provides the company's conclusion about whether cybersecurity incidents have had or are reasonably likely to have a material effect on its business, results, or financial condition, which fits Strategy Integration. Its only concrete-sounding statement is a negative self-assessment about the absence of material incidents, which is not externally verifiable, and the rest is a generic cross-reference.


fact: In October 2023, the company experienced a cybersecurity incident

fact: Certain user information was accessed and downloaded without authorization from individual 23andMe.com accounts

fact: The company enhanced its Security Operations following the incident

fact: The company reset customer passwords following the incident

fact: The company required two-factor verification for new and existing customers

fact: The company enhanced detection tools and capabilities

reasoning: The paragraph primarily describes a real cybersecurity event, including when it occurred, what was affected, and remediation steps taken, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a concrete date and identifiable details about the affected 23andMe.com accounts, along with specific technical remediation measures.


fact: vulnerability management policy

fact: encryption of data

reasoning: The paragraph primarily describes the company’s cybersecurity measures and controls—i.e., what its program does to manage and mitigate cyber risk—so it fits Risk Management Process. Its specificity rises above boilerplate because it includes cybersecurity-specific practices such as vulnerability management and data encryption, but it does not include firm-unique roles, committees, or externally verifiable facts.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from third parties, making Third-Party Risk the best fit. Its language remains high-level and generic—references to a TPRM program, gathering information, and assessing security controls do not add domain-specific, firm-specific, or externally verifiable detail.


reasoning: The paragraph primarily describes the oversight structure for cybersecurity risk, emphasizing the Board of Directors and Audit Committee's roles in overseeing risk management, which makes Board Governance the best fit. Its details are generic governance statements using excluded roles and committees (e.g., Board, Audit Committee, CFO) without qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity is Generic Boilerplate.


fact: In late May 2023, the company experienced a ransomware attack relating to certain systems on its network.

fact: ransomware attack

reasoning: The paragraph primarily describes an actual cybersecurity event and the company’s response, so it is best classified as Incident Disclosure. Its specificity is Quantified-Verifiable because it includes a concrete event timing ('late May 2023') tied to a real ransomware incident; the ransomware reference also adds cybersecurity domain specificity.


fact: Previously disclosed in the company's Form 10-Q for the quarter ended June 30, 2023

fact: The affected third-party vendor was Pension Benefit Information, LLC ("PBI")

fact: The breach involved Progress Software Corporation's MOVEit Transfer software

fact: MOVEit Transfer software was the implicated system/software

fact: An unknown actor exploited a MOVEit software flaw to access PBI's systems and download data

fact: Personally identifiable information relating to approximately 850,000 Jackson customers was obtained

fact: PBI informed Jackson that it rectified the MOVEit vulnerability

reasoning: This paragraph primarily describes a specific cybersecurity event, including what happened, which vendor and software were involved, the scope of affected data, and remediation, so it is Incident Disclosure. Specificity is Quantified-Verifiable because it includes named firms/software, a specific filing-date reference, and an approximate affected-customer count of 850,000.


fact: patching and vulnerability management

fact: technical threats

fact: information technology security infrastructure

fact: annual cybersecurity tabletop exercise

fact: security awareness training

reasoning: The paragraph primarily explains how the board is informed about cybersecurity matters through management reports and briefings, which makes it a board oversight disclosure. Its specificity is elevated by cybersecurity-specific operational terms such as patching, vulnerability management, security infrastructure, and tabletop exercises, but it does not include firm-unique roles/committees or externally verifiable facts.


reasoning: This paragraph is primarily a cautionary disclaimer stating there is no assurance the cybersecurity program will be effective, and it mainly points readers to a risk-factor cross-reference rather than describing governance, management, processes, third-party risk, strategy, or an actual incident. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable facts, its specificity is Generic Boilerplate.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from vendors, supply chain parties, and other third parties, so Third-Party Risk is the best fit. Its language remains high-level and generic—describing oversight of provider risks and audit requirements without using domain-specific security terminology, firm-unique structures, or verifiable facts.


fact: The incident affected certain of the company's information technology systems, and affected systems were suspended as part of containment, with additional systems temporarily suspended as a precaution.

fact: Operational systems were reactivated and restored over the course of the week following the Cybersecurity Incident.

fact: In 2023, incident-related costs net of an expected insurance receivable totaled $1.0 million.

fact: System remediation efforts related to the Cybersecurity Incident were concluded as of December 30, 2023.

fact: In the fourth quarter of 2024, the company received insurance claim proceeds that exceeded the recorded receivable by $0.6 million.

fact: The excess insurance proceeds represented costs associated with lost revenue and incremental expenses incurred.

reasoning: This paragraph primarily describes a real cybersecurity incident, including containment actions, restoration, remediation timing, and resulting financial effects, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes externally checkable dates and monetary amounts, including $1.0 million in 2023 costs, remediation concluded on December 30, 2023, and $0.6 million of excess insurance proceeds in Q4 2024.


fact: Senior Vice President of Engineering and Chief Information Security Officer (CISO) is part of the management input into cybersecurity risk management

fact: Chief Privacy Officer is involved in the cybersecurity risk management strategy

fact: Privacy and Security Council participates in the cybersecurity governance structure

reasoning: The paragraph primarily explains how management is organized to handle cybersecurity, identifying which executives and management bodies contribute to setting priorities and implementing the program, so it is best classified as Management Role. Specificity is Firm-Specific because it includes company-distinguishing roles and a named council, but no externally verifiable numbers, dates, certifications, or named outside firms.


fact: The company has a CISO responsible for assessing and managing material cybersecurity risks.

fact: The company has a steering committee on information security.

fact: The information security steering committee includes members of executive management and leaders of business functional areas.

fact: The CISO has over 20 years of experience in the information security field.

fact: The CISO received a CIO Executive Education Certificate from Stanford University.

reasoning: This paragraph primarily describes how management is organized to handle cybersecurity, focusing on the CISO, the information security steering committee, and the CISO’s qualifications, so Management Role is the best fit. Specificity is Quantified-Verifiable because it includes externally checkable claims such as the CISO having over 20 years of experience and holding a Stanford University executive education certificate.


fact: Vice President of Information Technology reviews the Company's cybersecurity risk management program with the audit committee and Board

reasoning: The paragraph primarily describes how the Board, through its audit committee, oversees cybersecurity risk and receives information from management, which makes it Board Governance. Specificity rises to Firm-Specific because it identifies a company-specific leadership role, the Vice President of Information Technology; the rest is largely generic governance language and generic meeting cadence.


reasoning: The paragraph primarily describes how management reports cybersecurity matters to the audit committee, which is about board-level oversight and information flow rather than management organization or program operations. Its details are generic governance topics and cadences, without qualifying domain-specific terminology, firm-specific roles/structures, or externally verifiable facts.


fact: identification and testing of vulnerabilities

fact: phishing simulations

fact: cybersecurity awareness training

fact: internal security reviews of information systems and related controls

fact: external reviews of the cybersecurity program and practices

fact: assessments of relevant data protection practices

fact: targeted attack simulations

reasoning: The paragraph primarily describes what the cybersecurity program does—testing vulnerabilities, running phishing simulations, conducting reviews, and assessing protections—so it is best classified as Risk Management Process. Its specificity is Domain-Adapted because it uses concrete cybersecurity practices and terminology, but does not include firm-unique organizational facts or externally verifiable claims.


fact: The Company has a Chief Information Security Officer (CISO)

fact: The CISO operates under the supervision of the Company's Chief Risk Officer (CRO)

fact: The executive team includes a Chief Technology Officer (CTO)

fact: The executive team includes a Chief Legal Officer (CLO)

fact: The Company refers to an Information Security Program

reasoning: This paragraph primarily describes management's organizational structure and reporting relationships for cybersecurity, centered on the CISO's role under the CRO and coordination with the executive team. Its specificity is Firm-Specific because it includes company-specific leadership roles and a named internal program, but no externally verifiable numbers, dates, certifications, or named vendors.


reasoning: The paragraph primarily gives a materiality-style assessment that the company has not experienced material cybersecurity breaches during the reporting period, which fits Strategy Integration under the SEC disclosure rules. Its only concrete-sounding statements are a negative assertion and generic hypothetical impact language, neither of which is externally verifiable or domain-specific enough to raise specificity above boilerplate.


fact: The Audit Committee receives updates on cybersecurity and information technology matters from the CISO

fact: The Board receives updates on cybersecurity risks from the CISO and Chief Information Officer

fact: Certain cybersecurity incidents are escalated within the company and, where appropriate, reported to the Board and Audit Committee under established protocols involving the CISO and Chief Information Officer

reasoning: This paragraph primarily describes how the Board and its delegated committee oversee cybersecurity risk and how information is reported upward, which squarely fits Board Governance. Its specificity rises above boilerplate because it includes firm-specific management roles involved in the governance chain, especially the CISO and Chief Information Officer, but it does not include externally verifiable quantitative facts.


fact: Chief Information Officer

fact: Chief Information Security Officer

fact: Internal Audit Group

reasoning: The paragraph primarily describes how cybersecurity information flows through the company’s oversight structure: management reports to the Audit Committee, which evaluates cybersecurity risk and informs the Board. Specificity rises to Firm-Specific because it names company-specific management roles and an internal team, but includes no externally verifiable quantities or claims.


reasoning: The paragraph primarily describes the company’s incident evaluation and escalation process—what happens after a potential cybersecurity incident is identified—so it is best categorized as Risk Management Process. Its details remain generic and process-oriented, without cybersecurity domain terms that pass the ERM test, firm-unique roles/committees, or externally verifiable facts.


fact: The Company has a Chief Information Security Officer

reasoning: The paragraph primarily describes what the cybersecurity program does—protecting information systems, coordinating incident response, and monitoring prevention, detection, mitigation, and remediation—so it is best classified as Risk Management Process rather than management organization. Its specificity rises to Firm-Specific because it includes the firm-specific role of a Chief Information Security Officer; the remaining details are largely generic program descriptions.


fact: The Audit Committee has been delegated oversight of the company's cybersecurity risk management program

fact: The VP of IT provides reports to the Audit Committee and senior management regarding cybersecurity matters

reasoning: This paragraph primarily describes how the board oversees cybersecurity through delegation to the Audit Committee and reporting up from management, which is board governance. Its specificity is elevated to Firm-Specific by the company-specific oversight structure and the named VP of IT role, but it contains no hard verifiable numbers, dates, or named external firms.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and service providers, including contractual requirements, reassessments, and data deletion at termination, so Third-Party Risk is the best fit. Its language is largely generic risk-management and vendor-oversight boilerplate without qualifying domain-specific terms, firm-unique structures, or externally verifiable facts.


fact: The VP of IT has served in information technology and information security roles

fact: The VP of IT has over 24 years of experience

fact: The VP of IT previously served as the Chief Information Security Officer of a healthcare company

fact: The VP of IT was a member of a cyber emergency response team at several companies

fact: The VP of IT holds undergraduate and graduate degrees in computer science

fact: The Cybersecurity Response Committee is identified as a management body

fact: The NVP of Finance and the rest of the Cybersecurity Response Committee have over 50 years of collective experience managing enterprise risks, including cybersecurity threats

reasoning: This paragraph primarily describes management organization and qualifications, focusing on the backgrounds and experience of the VP of IT and the Cybersecurity Response Committee rather than cybersecurity processes. Specificity is Quantified-Verifiable because it includes hard, checkable experience claims such as over 24 years of experience and over 50 years of collective experience, along with firm-specific management roles and a named committee.


reasoning: The paragraph primarily provides a materiality assessment, stating that past cybersecurity incidents have not had a material impact on the company’s business strategy, results of operations, or financial condition, which makes Strategy Integration the best fit. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: The Audit Committee receives periodic updates on the Company's cybersecurity risk profile and mitigation strategies and shares updates with the broader Board.

fact: The Board discusses major planned IT changes, associated risks, and potential mitigation strategies as part of cybersecurity oversight.

fact: The company states that three directors have cybersecurity risk management experience.

fact: The directors identified as having cybersecurity risk management experience are Ann Bordelon, Paulette Dodson, and Noah Glass.

reasoning: This paragraph primarily describes how the board oversees cybersecurity, including the Audit Committee’s role, reporting flow to the full Board, and director-level expertise, so Board Governance is the best fit. Specificity reaches Quantified-Verifiable because it includes a concrete, checkable claim that three named directors have cybersecurity risk management experience.


fact: The company designates a Chief Information Security Officer (CISO) to provide oversight and direction for the cybersecurity program.

reasoning: The paragraph primarily explains management’s organizational role in cybersecurity by describing what the CISO is responsible for and how that role coordinates across the company. Its specificity rises above boilerplate because it identifies a firm-specific cybersecurity leadership role (CISO), but it does not include externally verifiable dates, numbers, or named third parties.


reasoning: The paragraph primarily says that senior leadership evaluates cybersecurity risks and mitigations, which is most directly about management’s role rather than describing a substantive cybersecurity process. It contains no qualifying domain-specific terminology, firm-specific roles, or verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph is a generic statement that the company faces cybersecurity risk and intends to improve over time, but it does not substantively describe board oversight, management structure, risk processes, third-party risk, a real incident, or business impact. It contains no qualifying domain-specific, firm-specific, or verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily answers whether cybersecurity has materially affected the company’s business, results of operations, or financial condition, which makes it a Strategy Integration disclosure. Its language is entirely generic and does not include qualifying domain-specific technical terms, firm-specific organizational details, or externally verifiable facts.


reasoning: The paragraph primarily explains how the company oversees cybersecurity risks posed by third-party service providers, making Third-Party Risk the best fit. Its details remain generic: vendor assessments, ongoing monitoring, and a negative material-impact assertion do not include qualifying domain-specific, firm-specific, or externally verifiable facts under the rubric.


fact: The Board receives updates from the CIO

fact: The Board receives updates from the CISO

fact: The updates cover Morgan Stanley's Cybersecurity Program

reasoning: The paragraph primarily describes how the Board oversees cybersecurity risk through reporting and updates from management, which is Board Governance. Specificity rises to Firm-Specific because it identifies firm-specific cybersecurity leadership roles (CIO and CISO) and references Morgan Stanley's Cybersecurity Program.


fact: Enterprise Risk Committee ("ERC") manages overall risk across the Company, including cybersecurity risks identified by the Cybersecurity team

fact: Operational Risk Committee ("ORC") applies the policy decisions of the ERC

fact: Operational responsibility for the adequacy and effectiveness of risk management, control and governance processes is assigned to the Chief Information Security Officer ("CISO")

fact: The Cybersecurity team regularly coordinates with Compliance, Human Resources, Internal Audit and Legal

reasoning: This paragraph primarily explains how management is organized to handle cybersecurity through management committees, the CISO, and the Cybersecurity team’s responsibilities and reporting relationships. Its specificity is Firm-Specific because it includes company-specific governance bodies and roles such as the ERC, ORC, CISO, and named cross-functional coordination groups, but no externally verifiable quantified claim.


fact: encryption

fact: data loss prevention technology

fact: authentication technology

fact: entitlement management

fact: access control

fact: anti-virus and anti-malware software

fact: transmission of data over private networks

fact: National Institute of Standards and Technology Cybersecurity Framework

reasoning: The paragraph primarily describes what the company’s cybersecurity program does and the controls/framework it uses, which makes it a risk management process disclosure rather than third-party risk or governance. Its specificity is driven by multiple cybersecurity-specific control terms and the reference to the NIST Cybersecurity Framework, but it includes no firm-unique or externally verifiable facts.


fact: The paragraph refers to organizational and technical controls for managing cybersecurity and data privacy risks.

fact: It describes continuously monitoring for potential threats.

fact: It refers to responding to security incidents.

fact: It invokes the confidentiality, integrity, and availability of sensitive information.

reasoning: The paragraph primarily explains what the company's cybersecurity program does—controls, monitoring, awareness, and incident response—so it is best classified as Risk Management Process rather than governance or strategy. Its specificity rises above boilerplate because it uses cybersecurity-domain concepts such as technical controls, threat monitoring, incident response, and the confidentiality-integrity-availability triad, but it includes no firm-specific roles, committees, numbers, dates, or other verifiable facts.


fact: The advisor experienced a security incident in January 2023

reasoning: This paragraph primarily describes an actual cybersecurity event, including when it occurred and what happened, so it is Incident Disclosure. Specificity is Quantified-Verifiable because it includes a concrete date tied to a real incident ('January 2023').


reasoning: The paragraph primarily states management's conclusion that cybersecurity threats have not materially affected the company, its business strategy, results of operations, or financial condition, which is a Strategy Integration materiality assessment. Its remaining content is generic and includes no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity is Generic Boilerplate.


fact: Management supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents

fact: Threat intelligence is used as an input

fact: Alerts and reports produced by security tools deployed in the IT environment are used

fact: Other members of the management team include personnel from legal, finance, and internal audit

reasoning: The paragraph primarily describes how the company’s cybersecurity program operates—using threat intelligence, internal briefings, and security-tool alerts to prevent, detect, mitigate, and remediate cyber risks—so Risk Management Process is the best fit. Specificity rises to Firm-Specific because it names a distinct cross-functional management composition (legal, finance, and internal audit), while also containing cybersecurity domain terms such as threat intelligence and security tools.


fact: Members of the management team hold CISSP certification

fact: Members of the management team hold CCNP certification

fact: Members of the management team hold CISA certification

fact: Members of the management team hold CySA+ certification

reasoning: This paragraph is primarily about how management is qualified to oversee cybersecurity, which makes it a Management Role disclosure rather than a process description. Its specificity is Quantified-Verifiable because it includes named professional certifications—CISSP, CCNP, CISA, and CySA+—that are externally verifiable claims.


reasoning: The paragraph primarily addresses potential business and financial consequences of cybersecurity events by noting possible material adverse effects and limits of cybersecurity insurance coverage. Its references are generic and cross-referential, with no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily describes a cybersecurity control activity—communicating program provisions to employees as a procedure to mitigate internal threats—so it fits Risk Management Process. However, it uses only generic risk and training language without domain-specific cybersecurity terminology, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily explains how cybersecurity information is reported to and reviewed by the board, so it is best categorized as Board Governance. Its details are mostly generic oversight cadence and enterprise-risk language; it does not include qualifying domain-specific cybersecurity terminology, firm-unique cyber roles/structures, or externally verifiable claims.


fact: The Audit & Finance Committee oversees the company's cybersecurity strategy and governance.

fact: The Audit & Finance Committee is briefed by the CISO.

fact: The Audit & Finance Committee is briefed by the CIO.

reasoning: The paragraph primarily describes how the board-level Audit & Finance Committee oversees cybersecurity and receives information from management, which makes it a board oversight disclosure. Specificity is Firm-Specific because it names a specific board committee and identifies the CISO and CIO as roles in the reporting chain, but it does not provide externally verifiable numbers, dates, or named vendors/products.


reasoning: The paragraph primarily provides a materiality assessment by stating that past cybersecurity incidents have not been determined to be material and by cross-referencing discussion of whether cyber risks are reasonably likely to materially affect the company. Its process language is generic, and it contains no qualifying domain-specific, firm-specific, or externally verifiable facts that elevate specificity above boilerplate.


fact: TPG has established an Enterprise Risk Committee ("ERC") that includes cybersecurity risks identified by TPG's cybersecurity team

fact: TPG has established an Operational Risk Committee ("ORC") responsible for applying the policy decisions of the ERC

fact: Operational responsibility for the adequacy and effectiveness of the Adviser's risk management, control and governance processes is assigned to TPG's Chief Information Security Officer ("CISO")

fact: The CISO periodically reports potentially material cybersecurity incidents to the ORC and reports to the ERC

fact: TPG's cybersecurity team regularly coordinates with compliance, human resources, internal audit, and legal

fact: The CISO leads TPG's cybersecurity team, which is responsible for implementing, maintaining and enforcing the cybersecurity program

fact: TPG's CISO previously held leadership roles within the Technology Risk department of a large banking institution over a 17-year period

fact: TPG's CISO holds a Bachelor of Science in Electrical Engineering and Mathematics from the University of Texas at Arlington

fact: TPG's CISO is a Certified Information Systems Security Professional (CISSP)

fact: Technology Risk department

reasoning: The paragraph primarily explains how management is organized to handle cybersecurity, focusing on TPG's CISO, cybersecurity team, and management-level committees rather than board oversight or process details. Specificity reaches Quantified-Verifiable because it includes checkable facts such as the CISO's 17-year experience and named credentials/education, along with firm-specific committee and role names.


fact: Vice President of IT is part of the management team responsible for assessing and managing cybersecurity risks

fact: The management team supervises internal cybersecurity personnel and retained external cybersecurity consultants

fact: Vice President of IT Randy Jepsen oversees infrastructure, procurement, development, and IT support

fact: Randy Jepsen has over 25 years of experience in the IT industry

fact: Randy Jepsen has 19 years at Smith Douglas and The SMART Builder Solutions

fact: Smith Douglas and The SMART Builder Solutions are specifically named employers in Randy Jepsen's experience summary

fact: Chief Financial Officer Russell Devendorf is identified as part of the management team handling cybersecurity risk

fact: Russell Devendorf previously oversaw the information technology and risk management functions of a publicly traded homebuilder from 2008 to 2017

fact: Russell Devendorf oversaw the company's cybersecurity program and implementation of an incident response plan and cybersecurity insurance in that prior role

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, emphasizing the responsibilities, reporting scope, and qualifications of specific executives rather than the mechanics of the security program itself. Specificity reaches Quantified-Verifiable because it includes named individuals, firms, and checkable experience claims and dates such as over 25 years of experience, 19 years at named firms, and service from 2008 to 2017.


fact: The company has a Chief Security Officer (CSO) who leads the cybersecurity team

fact: The CSO reports directly to the Executive Vice President and Chief Operations Officer

fact: The CSO has over 20 years of security experience managing global security organizations

fact: The information security team holds certifications such as Certified Information Systems Security Professional (CISSP) and Certified Information Security Manager (CISM)

reasoning: The paragraph primarily describes how cybersecurity risk oversight flows from management to the Board and Audit Committee, so Board Governance is the best fit despite substantial management-detail content. Specificity reaches Quantified-Verifiable because it includes an externally checkable claim that the CSO has over 20 years of security experience, along with firm-specific role details and named cybersecurity certifications.


fact: The paragraph describes oversight through dedicated management-level cybersecurity risk committees at Morgan Stanley.

fact: Significant cybersecurity risks are escalated to Morgan Stanley's Non-Financial Risk Committee.

fact: The CIO reports on the status of Morgan Stanley's Cybersecurity Program and significant cybersecurity risks.

fact: The Head of Operational Risk reports on the status of Morgan Stanley's Cybersecurity Program and significant cybersecurity risks.

fact: Reporting is made to the Firm Risk Committee.

fact: Reporting is made to the BOTC.

fact: Reporting is made to the MS Board.

fact: Cybersecurity Program

reasoning: The paragraph primarily explains the oversight and escalation structure from management committees up to board-level bodies, so it is best categorized as Board Governance. Specificity is elevated by firm-identifying and organizationally specific facts such as Morgan Stanley and its named committees and roles, which include externally checkable named-entity claims.


fact: Uses the ISO 27001:2022 information security standard to drive risk assessment and prioritize technology and process investments

fact: Maintains a Security Operations Center (SOC) with enterprise event visibility

reasoning: The paragraph primarily describes what the cybersecurity program does—investing in defenses, using a security standard for assessments, and operating monitoring capabilities—so it is best classified as Risk Management Process. Its specificity is elevated by concrete cybersecurity domain terminology such as ISO 27001:2022 and Security Operations Center, but it does not provide a clearly verifiable metric, date, certification, or other hard external fact.


fact: The vendor risk management program includes vulnerability scans related to vendors.

reasoning: The paragraph primarily explains how the company manages cybersecurity risks from vendors and other service providers, so Third-Party Risk is the best fit. Specificity rises above boilerplate because it mentions the cyber-specific practice of conducting vulnerability scans, but it does not include firm-unique roles, committees, dates, numbers, or other verifiable details.


fact: The information security program is overseen by the Vice President of IT

fact: Reports include United States Computer Emergency Readiness Team alerts processed

reasoning: This is primarily a governance-chain paragraph describing how cybersecurity information flows from management to the board and how the board is briefed, so Board Governance is the best fit. Specificity rises above boilerplate because it includes a firm-specific cybersecurity oversight role (Vice President of IT) and a concrete reference to US-CERT alerts, but it does not contain a clearly externally verifiable quantified claim.


fact: The Company's CIO has over two decades of experience in technology development, management, and security.

fact: The Company has a CIO responsible for technology and security leadership.

fact: The Company's CEO, CFO, and GC each have over 15 years of experience managing enterprise risks, including cybersecurity threats.

reasoning: This paragraph primarily describes management expertise and qualifications for handling cybersecurity, especially the CIO and senior executives, which makes it a Management Role disclosure rather than a process description. Specificity is Quantified-Verifiable because it includes checkable experience claims of over two decades for the CIO and over 15 years for the other executives.