reasoning: The paragraph primarily addresses business impact/materiality by stating that cybersecurity incidents could have material adverse effects but that no such incident has had such an impact to date, which fits Strategy Integration under the materiality-assessment rule. Its language is otherwise generic and cross-referential, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


content_category: Board Governance

fact: The Board and the Security & Technology Committee receive prompt information regarding cybersecurity incidents that meet established reporting thresholds.

fact: The Security & Technology Committee receives ongoing updates on such incidents until they have been addressed.

category_confidence: high

specificity_confidence: high

reasoning: This paragraph primarily describes how cybersecurity incident information flows to the board and a board-level committee, which is a board oversight/governance function. Its specificity is elevated by the named Security & Technology Committee, a firm-specific governance body; the rest of the language is otherwise general.

provider: openai

stage: benchmark


fact: The ISO reports directly to the board of directors on the overall status of the Information Security Program.

fact: The Company assesses compliance with the Interagency Guidelines for Safeguarding Customer Information.

type: framework

fact: Topics reported to the board include material findings related to risk assessment, risk management and control decisions, service provider arrangements, results of testing, security breaches or violations, management responses, and recommendations for program changes.

specificity_confidence: medium

reasoning: The paragraph primarily describes how cybersecurity information flows to the board and what the board is told, which makes it Board Governance. Specificity rises to Firm-Specific because it identifies the ISO as the reporting role, and it also includes domain-adapted detail through the named banking security guideline and the specific categories of issues presented to the board.


fact: The Audit Committee and full Board receive periodic updates from the CISO on cybersecurity matters.

fact: The Audit Committee and full Board receive periodic updates from the CIO on cybersecurity-related matters.

fact: The Board also receives updates from the Security & Resiliency global practice leader on cybersecurity-related matters.

reasoning: This paragraph primarily describes how the Board and its Audit Committee oversee cybersecurity risk and receive information from management, which makes it Board Governance. Specificity is Firm-Specific because it identifies company-specific cybersecurity leadership roles involved in reporting to the Board, but it does not include externally verifiable dates, numbers, or named vendors/products.


content_category: Strategy Integration

reasoning: The paragraph primarily states management’s conclusion that cybersecurity threats and incidents have not materially affected, and are not reasonably likely to materially affect, the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts; the dated negative assertion is still a non-verifiable absence claim and the rest is generic risk language.


reasoning: The paragraph primarily provides a materiality-oriented assessment of whether cybersecurity threats or prior incidents have affected or are reasonably likely to affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Despite mentioning a period of 'more than 5 years,' the paragraph contains only self-reported negative assertions and cross-references, with no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts that elevate specificity.


content_category: Management Role

category_confidence: medium

reasoning: The paragraph primarily describes how management is organized to receive and escalate cybersecurity information, centering on the CFO’s coordinating role and management reporting lines rather than the board’s oversight itself. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts under the stated rules; the references to the CFO, senior management, Audit Committee, Board, and a generic cybersecurity team do not elevate specificity.


fact: The company references a specific prior event: the February 2023 cyberattack.

reasoning: The paragraph primarily answers how cybersecurity has affected or could affect the business and financial condition, emphasizing that the February 2023 cyberattack did not have a material adverse impact and that future incidents could cause costs, disruption, or lost sales. Specificity is Quantified-Verifiable because it includes a concrete, externally checkable fact: a cyberattack in February 2023.


content_category: Risk Management Process

fact: vendor-provided software fixes, commonly called patches

fact: security configurations are documented, approved, and tested

fact: exploitable files and services are assessed and removed or disabled based upon known vulnerabilities

fact: vulnerability scanning tools

fact: intrusion detection tools

reasoning: The paragraph primarily describes operational cybersecurity activities management may perform to remediate vulnerabilities, so it fits Risk Management Process. Its specificity is Domain-Adapted because it uses concrete cybersecurity terminology such as patches, vulnerability scanning, intrusion detection, and security configuration controls, but contains no firm-specific or externally verifiable facts.


reasoning: The paragraph primarily describes how the Audit Committee is informed about cybersecurity matters through periodic reports and other materials, which is board-level oversight. Its language remains generic, and the only potentially specific statement is a negative materiality assertion about prior incidents, which is not externally verifiable and does not elevate specificity.


fact: The Board receives updates from the Chief Information Officer

fact: The Board receives cybersecurity program updates and scorecard assessments covering the emerging threat landscape

reasoning: This paragraph primarily describes how the Board oversees cybersecurity, including the information it receives and from whom, so Board Governance is the best fit. Specificity rises above boilerplate because it identifies the Chief Information Officer as the reporting management role, which is a firm-specific organizational fact; the cyber-specific reference to the emerging threat landscape also adds domain detail.


reasoning: The paragraph primarily explains how the board, through the audit committee, oversees cybersecurity reporting and escalation, which is board-level governance. It contains only generic oversight language and excluded items like the audit committee and annual reporting cadence, without any qualifying domain, firm-specific, or verifiable facts.


content_category: Third-Party Risk

reasoning: The paragraph is primarily about how the company manages cybersecurity risks from third-party service providers and vendors, including contractual requirements and onboarding review, so Third-Party Risk is the best fit. However, it uses high-level, generic vendor-risk language without cybersecurity domain terms that pass the ERM test, firm-unique organizational details, or externally verifiable facts.


fact: National Institute of Standards and Technology (NIST) Cybersecurity Framework

fact: Federal Financial Institutions Examination Council (FFIEC) Information Technology Examination Handbooks

fact: FFIEC Cybersecurity Assessment Tool

fact: Our Information Security Program is led by our Information Security Officer

fact: Our Information Security Program is led in conjunction with our Information Technology Officer

reasoning: The paragraph primarily explains what the company’s cybersecurity program is designed to do and the frameworks it uses, which makes Risk Management Process the best fit. Specificity reaches Firm-Specific because, beyond domain-specific frameworks like NIST and FFIEC guidance, it identifies firm roles—the Information Security Officer and Information Technology Officer—leading the program.


content_category: Incident Disclosure

fact: The online banking platform was targeted by threat actors who created malicious look-alike phishing sites.

fact: threat actors

fact: phishing sites

reasoning: The paragraph primarily describes an actual cybersecurity event—attempted attacks on the company's online banking platform, their nature, and the outcome—so it is best classified as Incident Disclosure. Its specificity rises above boilerplate because it uses cybersecurity-specific terms such as threat actors and phishing sites, but it does not include firm-unique organizational details or externally verifiable dates, numbers, or named vendors.


reasoning: The paragraph primarily describes how the board-level Audit Committee oversees cybersecurity through reports from management and input from consultants, which is board oversight. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts under the stated rules, so specificity remains generic boilerplate.


reasoning: The paragraph primarily states management's conclusion that cybersecurity threats and prior incidents have not materially affected the company's business strategy, results of operations, or financial condition, which is a Strategy Integration materiality assessment. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the negative assertion is self-reported and not independently verifiable.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats or incidents did not materially affect and are not reasonably likely to materially affect the company's business, results, or financial condition, which fits Strategy Integration. Its remaining content is generic cautionary language and a cross-reference, and the 2023 negative assertion is not externally verifiable, so no facts elevate specificity above boilerplate.


content_category: None/Other

reasoning: This paragraph is only a cross-reference to another section ('Risk Factors' in Item 1A) and does not itself describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy assessments. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: This paragraph primarily describes how the board, through the Audit Committee, oversees cybersecurity risk and receives updates, which squarely fits Board Governance. It does not contain qualifying domain-specific terminology, firm-specific cybersecurity roles or structures, or externally verifiable facts under the stated specificity rules.


reasoning: The paragraph primarily addresses cybersecurity risk arising from third-party technology service providers and the company's efforts to monitor provider-related breach implications, making Third-Party Risk the best fit. It remains generic boilerplate because it contains no qualifying domain-specific cybersecurity terminology, firm-unique organizational details, or externally verifiable facts.


fact: data encryption

fact: protecting data from unauthorized incorporation in large language models or other artificial intelligence systems

reasoning: The paragraph primarily explains how cybersecurity information flows to the board, stating that the Audit Committee and full Board receive regular cybersecurity reports, which makes board oversight the main topic despite some brief process language. Specificity rises above boilerplate because it includes cybersecurity-domain concepts such as data encryption and the risk of unauthorized use of data in large language model/AI systems, but it does not provide firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes how cybersecurity information flows from management to the audit committee, which is a board oversight/governance function. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; 'audit committee' is generic and does not elevate specificity.


fact: cybersecurity containment and remediation efforts

reasoning: The paragraph primarily describes part of the company’s cybersecurity operating approach—using outside providers to support containment and remediation—so it fits Risk Management Process rather than Third-Party Risk. Its specificity rises above boilerplate because 'containment and remediation' reflects incident-response cybersecurity terminology, but it includes no firm-specific or externally verifiable details.


fact: The CISO provides reports to the audit committee on significant cybersecurity threats, risks, and related processes.

reasoning: This paragraph primarily describes how the board-level audit committee oversees cybersecurity through receiving reports and materials, which is board governance. Its specificity rises to Firm-Specific because it includes the named cybersecurity leadership role of CISO; the rest is otherwise generic oversight language.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from vendors, suppliers, and other business partners, so Third-Party Risk is the best fit. Its language is generic and does not include domain-specific cyber terminology, firm-unique structures, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: This paragraph is primarily a high-level introductory risk statement about possible cybersecurity threats and adverse effects, without describing actual governance, management roles, processes, third-party controls, incidents, or a materiality assessment. Because it is non-substantive boilerplate rather than a concrete cybersecurity disclosure, it falls under None/Other and receives Generic Boilerplate specificity.


fact: Franklin Templeton requires third party vendors to comply with confidentiality, security, and privacy requirements.

reasoning: The paragraph is primarily about how cyber risk from vendors and other external service providers is mitigated, so Third-Party Risk is the best fit. Specificity is elevated by the named-firm fact involving Franklin Templeton's vendor requirements; otherwise the remaining language is fairly generic.


fact: Hines' Chief Technology Officer (CTO) provides reports to the board on the effectiveness of Hines' cybersecurity risk management program

fact: Hines' Chief Information Security Officer (CISO) provides reports to the board on the effectiveness of Hines' cybersecurity risk management program

reasoning: The paragraph primarily describes how the board oversees cybersecurity, including receiving reports and incident-related information, so it is Board Governance. Its specificity rises to Firm-Specific because it names firm-specific cybersecurity leadership roles—the CTO and CISO—while containing no externally verifiable dates, quantities, or certifications.


fact: Kroger's CDO leads the company's technology and digital capabilities, including the overall cybersecurity strategy

fact: Kroger's CDO reports to the CEO

fact: Kroger's CDO has over 20 years of experience leading and transforming technology, digital growth, and e-commerce in the retail and food industry

type: quantified

fact: Kroger's CDO holds a master's degree in business administration and management from Ecole Sup rieure de Commerce de Chamb ry, Rh ne-Alpes, France

fact: Kroger's interim CISO brings nearly 20 years of experience developing and leading security and risk programs

fact: information security

fact: threat management

fact: Kroger's interim CISO holds a bachelor's degree in management information systems and marketing from Miami University

reasoning: This paragraph primarily describes how management is organized and qualified to lead cybersecurity, focusing on the CDO and interim CISO roles, reporting line, and experience rather than on cybersecurity program activities. Specificity reaches Quantified-Verifiable because it includes checkable experience claims such as the CDO having over 20 years of relevant experience, along with concrete educational credentials and firm-specific leadership roles.


fact: Marco Technologies is the organization's Managed IT provider

fact: Red Canary provides 24/7 monitoring on all end points

fact: High Point Networks provides physical and cloud-based network data backup solutions

fact: 24/7 monitoring on all end points

fact: end points

fact: Return to Operations objectives of less than 24 hours

reasoning: The paragraph primarily describes what the cybersecurity program does operationally—monitoring endpoints, updating systems, training personnel, and backing up data—even though those activities are performed by external providers, so it fits Risk Management Process rather than Third-Party Risk. Specificity is Quantified-Verifiable because it includes named firms and hard, checkable claims such as 24/7 monitoring and recovery objectives of less than 24 hours.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks from third-party service providers, including diligence, monitoring, contractual requirements, and audits, so Third-Party Risk is the best fit. However, it uses generic vendor-risk language without domain-specific technical terms, firm-unique structures, or externally verifiable facts, so the specificity is Generic Boilerplate.


fact: The CDIO chairs a security council that supports cybersecurity risk management and strategy.

fact: The company has a Security Council.

fact: The Security Council includes senior leaders from Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting, Risk, and IT Infrastructure.

fact: The company cites a reported April 2024 cyber-attack as an example of incident review, disclosure, and mitigation.

reasoning: The paragraph primarily describes how management is organized to oversee cybersecurity, centered on the CDIO-led Security Council, cross-functional membership, and internal response teams, even though it also mentions escalation to the board's Audit Committee. Specificity reaches Quantified-Verifiable because it includes firm-specific management structures and a concrete, externally checkable reference to an April 2024 cyber-attack.


fact: On June 30, 2024, the Company detected a cybersecurity incident.

fact: An unauthorized third party gained access to certain Company information systems.

reasoning: The paragraph primarily describes an actual cybersecurity incident—when it was detected, what happened, and part of the response—so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a concrete incident date (June 30, 2024), and also gives incident-specific facts about unauthorized access to Company systems.


reasoning: The paragraph primarily states a forward-looking materiality assessment that cybersecurity threats are reasonably likely to materially affect the company, which fits Strategy Integration under the materiality rule. It contains no qualifying domain-specific terminology, firm-specific organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality-oriented business impact assessment, stating that certain cybersecurity threats are reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its wording is otherwise high-level and generic, without qualifying domain-specific technical terminology, firm-unique organizational details, or externally verifiable facts that would elevate specificity.


fact: Use of penetration testing firms as third-party service providers

fact: Use of forensic investigators as third-party service providers

fact: Security documentation reviews for certain vendors

fact: Review of security questionnaires for certain vendors

fact: Security audits of certain vendors

fact: Contractual obligations related to cybersecurity imposed on providers

reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and other external providers, making Third-Party Risk the best fit. Its specificity is Domain-Adapted because it includes cybersecurity-specific vendor oversight practices like penetration testing, forensic investigation, security reviews, and security audits, but no firm-unique roles, committees, names, dates, or verifiable quantified claims.


fact: The Committee receives reports from the Vice President and Chief Information Security Officer (CISO), together with other senior managers, on cybersecurity risks.

reasoning: The paragraph primarily describes how the board oversees cybersecurity through delegated committee oversight and reporting flows from management, which makes it Board Governance. Its specificity rises to Firm-Specific because it identifies a company-specific cybersecurity leadership role—the Vice President and Chief Information Security Officer (CISO)—while the rest is largely generic governance language.


reasoning: The paragraph is a speculative cautionary statement about possible breaches and operational disruptions, not a substantive description of governance, management, processes, third-party risk, incidents, or business impact assessment. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: In November 2022, Kroll conducted a security maturity assessment of the company's security system.

fact: Kroll was the external firm engaged to conduct the assessment and peer review incident response materials.

fact: Past security assessments and penetration tests were reviewed as part of the assessment.

fact: Documentation regarding network architecture was reviewed.

fact: The Century Communities Information Security Team worked with Kroll to identify deficiencies and close gaps.

fact: The company developed an Information Security Incident Response Policy.

fact: Kroll assisted the company in conducting tabletop exercises, most recently in September 2023.

reasoning: The paragraph primarily describes cybersecurity program activities—assessment, remediation, policy development, and testing of incident response capabilities—so it is best classified as Risk Management Process rather than Third-Party Risk. Specificity is Quantified-Verifiable because it includes externally checkable facts such as the named firm Kroll and specific dates in November 2022 and September 2023, along with domain-specific terms like penetration tests and network architecture.


fact: The CIO/CDO informs the Audit Committee on cybersecurity matters, including incident prevention, detection, mitigation, remediation, and information security vulnerabilities.

fact: information security vulnerabilities

reasoning: The paragraph primarily describes the board-level oversight chain for cybersecurity, focusing on how the Board and Audit Committee receive information and oversee management, which makes Board Governance the best fit. Its specificity rises above boilerplate because it includes a firm-specific management role (the CIO/CDO), and also uses some cybersecurity-specific terminology, but it does not provide externally verifiable dates, quantities, or named vendors.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from vendors, service providers, and other external parties, making Third-Party Risk the best fit. It stays at Generic Boilerplate because it provides only high-level, non-distinct language and includes no qualifying domain-specific technical terms, firm-unique structures, or verifiable facts.


reasoning: The paragraph is primarily about how the company addresses cybersecurity risks arising from suppliers and subcontractors, making Third-Party Risk the best fit. Its statements are generic vendor-risk controls and reporting expectations without domain-specific cybersecurity terminology, firm-unique organizational details, or externally verifiable facts.


fact: The company was targeted by a complex criminal scheme early in Fiscal 2024 that resulted in fraudulently induced outbound wire transfers to a third-party account.

fact: The company contacted dispute resolution experts and conducted an independent forensic investigation in response to the incident.

fact: The company recognized $2.7 million of loss, net of funds recovered and including professional fees related to the forensic investigation and recovery efforts.

reasoning: This paragraph primarily describes an actual cyber/fraud event, the company’s response, and the resulting loss, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a concrete, externally checkable financial impact of $2.7 million, along with incident-specific details and a forensic investigation.


fact: On September 14, 2023, the company announced that an unauthorized actor had gained access to its information technology network

fact: The access resulted from a social engineering attack on an outsourced IT support vendor used by the company

fact: The actor acquired a copy of the company's loyalty program database

fact: The incident was referred to internally as the "Data Incident"

fact: After detecting suspicious activity, the company activated its IRP and implemented containment measures

fact: The company notified law enforcement and state gaming regulators

reasoning: This paragraph primarily describes a specific cybersecurity event, including how the unauthorized access occurred, what data was involved, and the response actions taken, so it is Incident Disclosure. Specificity is Quantified-Verifiable because it includes a concrete date and multiple event-specific, externally checkable claims about the incident and response.


fact: National Institute of Standards & Technology Cybersecurity Framework (NIST CSF)

fact: Global Information Security Policy

fact: CISO responsible for oversight of the cybersecurity program

fact: documented security architecture program

fact: endpoint detection

fact: security incident response and event management and recovery

fact: privileged access management

reasoning: The paragraph primarily explains what the company’s cybersecurity program consists of—its policy framework and layered security measures—so it is best categorized as Risk Management Process rather than Management Role. Specificity reaches Firm-Specific because it includes firm-unique facts such as the CISO role and the named Global Information Security Policy, alongside domain-specific cybersecurity terms like NIST CSF, endpoint detection, and privileged access management.


reasoning: The paragraph primarily explains how the company evaluates and contracts with vendors, suppliers, and service providers, making third-party cyber risk the central topic. Its details remain high-level and generic—vendor assessments, review of sensitive data access, and security contract terms—without domain-specific technical terminology, firm-unique structures, or externally verifiable facts.


fact: The corporate cybersecurity program is led by the chief information officer (CIO).

fact: The CIO is responsible for information security strategy, policy, security engineering, operations, and cyber threat detection and response.

fact: The company's information systems are owned and operated by Contran and provided through the ISA.

fact: The CIO also serves as the Kronos CIO and reports to the company's and Kronos' chief executive officers, respectively.

fact: CompX's cybersecurity program is led by its director of information technology.

fact: Cybersecurity risks are reviewed and tested annually through third-party assessments and internal and external information technology audits.

reasoning: The paragraph primarily explains how management is organized to run cybersecurity across the company and its affiliates, emphasizing leadership roles, reporting lines, and responsibilities rather than board oversight or program mechanics. Specificity rises to Firm-Specific because it includes firm-unique organizational details such as the CIO role, affiliate structure involving Kronos/CompX/Contran, and the shared CIO arrangement, while the technical references add domain-adapted detail but do not clearly reach externally verifiable quantified claims.


reasoning: The paragraph primarily describes how the company evaluates and monitors cybersecurity risk arising from vendors and other third-party providers, making Third-Party Risk the best fit. Its language stays at a generic process level—due diligence, contractual rights, periodic assessments, and monitoring—without domain-specific technical terminology or sufficiently distinctive firm-specific or verifiable facts.


fact: The company's cybersecurity function is led by its Chief Information Officer (CIO).

fact: The CIO has led Century Communities' IT efforts since 2016.

fact: The CIO has more than 20 years of experience as an IT leader in the homebuilding industry.

fact: The CIO oversees initiatives and teams including IT operations, cybersecurity, business systems, mergers and acquisitions, communications, and business intelligence.

fact: The CIO reports to the Corporate General Counsel.

reasoning: This paragraph primarily explains how management is organized for cybersecurity by focusing on the CIO’s leadership role, experience, responsibilities, and reporting line. Specificity reaches Quantified-Verifiable because it includes externally checkable facts such as the CIO leading IT since 2016 and having more than 20 years of experience.


reasoning: This paragraph is an executive biography describing Mr. Shear’s business roles and career history, not cybersecurity governance, management, risk processes, third-party risk, incidents, or strategy impacts. Because it contains no substantive cybersecurity disclosure, it is classified as None/Other and defaults to Generic Boilerplate.


fact: Applies controls from best practices such as The Business Continuity Institute (BCI)

fact: Applies controls from best practices such as Disaster Recovery Institute International (DRII)

fact: Applies controls from best practices such as ISO 22301

fact: Develops and maintains threat-agnostic plans

reasoning: The paragraph primarily describes what the company’s resilience/cyber program does—planning for disruption, conducting analyses, and running exercises—so it fits Risk Management Process rather than governance or management structure. Its specificity is elevated by named resilience standards/framework references (BCI, DRII, ISO 22301), but it does not include firm-unique organizational details or externally verifiable quantified claims.


fact: References specific cybersecurity threat types including malware, ransomware, and computer viruses

reasoning: The paragraph primarily answers how cybersecurity risks and incidents affect the company’s business, operations, and financial condition, including an explicit statement that no such risks or incidents have materially affected the business as of the filing date, which makes Strategy Integration the best fit. Its specificity rises above boilerplate because it names concrete cyber threat types (malware, ransomware, computer viruses), but it does not include firm-specific organizational details or externally verifiable positive claims.


reasoning: The paragraph primarily explains how the company manages cybersecurity-related risks from vendors and other third-party service providers, so Third-Party Risk is the best fit. Its language remains high-level and generic (e.g., vendor diligence, risk-based assessment, access to systems/data, supply chain risk) without domain-specific cyber terminology, firm-unique structures, or verifiable details.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk relating to external service providers, especially by imposing security and breach-reporting requirements on them, so Third-Party Risk is the best fit. It remains generic boilerplate because it contains no qualifying domain-specific technical terms, no firm-unique roles or committees, and no quantified or otherwise externally verifiable facts.


reasoning: This paragraph is only a cross-reference to the Risk Factors section for potential effects of cybersecurity threats and does not itself provide substantive disclosure about governance, management, processes, incidents, third-party risk, or strategy assessments. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


fact: Under agreements with NEE Management and NEER, NEE affiliates provide or arrange substantially all of NEP's information technology functions, including cybersecurity-related functions.

fact: NEE Management

fact: NEER

reasoning: The paragraph primarily answers who oversees cybersecurity-related services at the board level, stating that NEP's board oversees the provision of outsourced IT and cybersecurity services. Specificity is Quantified-Verifiable because it includes named counterparties—NEE Management and NEER—which are externally identifiable, verifiable entities.


reasoning: The paragraph primarily describes how the Audit Committee and Board oversee cybersecurity through briefings, dialogue, strategic guidance, and annual program review, which is board-level oversight rather than management organization. Its details are largely generic governance language, and the mentions of the Chief Operating Officer, Audit Committee, annual frequency, and broad topic areas do not qualify as domain-specific, firm-specific, or externally verifiable facts under the rubric.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from third-party service providers, making Third-Party Risk the best fit. Its language remains generic—e.g., risk-based approach, due diligence, and oversight of third parties—without domain-specific technical terms, firm-unique structures, or verifiable facts.


reasoning: This paragraph is a cross-reference directing readers to the Risk Factors section for additional discussion, rather than describing cybersecurity governance, management, processes, third-party risk practices, incidents, or strategy impacts. Because it contains no substantive cybersecurity measures or concrete qualifying facts, it is generic boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition, which fits Strategy Integration. Its language is otherwise generic and speculative, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


reasoning: The paragraph primarily describes how the board oversees cybersecurity by stating that the Board has delegated oversight of cybersecurity risk to the Audit Committee, which is a board-governance structure. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts under the rubric, so specificity remains generic boilerplate.


reasoning: This paragraph is a cross-reference to the Risk Factors section rather than a substantive cybersecurity disclosure; it does not itself explain governance, management, processes, third-party risk management, an actual incident, or a materiality assessment conclusion. Because None/Other paragraphs are treated as generic and the text contains no qualifying specificity-elevating facts under the rules, the specificity is Generic Boilerplate.


reasoning: This paragraph primarily describes management organization and responsibilities by explaining what the Director, IT is responsible for, so Management Role is the best fit. It does not contain qualifying domain-specific cybersecurity terminology beyond generic risk and incident language, and the title 'Director, IT' is not a firm-specific security-qualified role under the rubric, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily describes how the board-level Audit Committee is educated and what expertise its members have, which is a board oversight/governance topic. It does not include qualifying domain-specific cybersecurity practices, firm-unique governance facts that count under the rules, or externally verifiable claims, so specificity remains generic.


fact: VP of Information Technology is part of the senior management team leading cybersecurity risk management and strategy processes

reasoning: The paragraph primarily explains which members of management lead cybersecurity efforts and emphasizes their organizational role and experience, so it fits Management Role. Specificity rises to Firm-Specific because it includes a qualifying company-specific leadership role—the VP of Information Technology—but no externally verifiable dates, numbers, certifications, or named firms.


fact: The Company's cybersecurity strategy and risk management processes align with the National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework.

reasoning: Although the paragraph opens with board/audit committee oversight, most of the substantive content describes how the company integrates cybersecurity into its broader risk management framework and aligns its processes to NIST, which is primarily about the cybersecurity program's operation. Specificity is Domain-Adapted because the paragraph includes a named cybersecurity framework (NIST), but does not include qualifying firm-specific or externally verifiable facts.


fact: Uses the National Institute of Standards and Technology Cybersecurity Framework

fact: Employs multi-layered defenses

fact: Monitors information systems for potential vulnerabilities

fact: Includes physical, administrative, and technical safeguards

fact: Maintains plans and procedures to prevent, detect, respond to, and recover from cybersecurity incidents

fact: Addresses monitoring and patching of vulnerabilities

fact: Regularly updates information systems

fact: Evaluates new countermeasures against evolving threats

reasoning: The paragraph primarily explains what the company’s cybersecurity program does—risk assessment, monitoring, safeguards, incident response, patching, and countermeasures—so Risk Management Process is the best fit. Its specificity is elevated by concrete cybersecurity framework and program terminology such as NIST Cybersecurity Framework, vulnerability monitoring, patching, and layered defenses, but it does not include firm-specific or externally verifiable facts.


fact: Vendors for hosted applications are required to maintain a SOC 1 report or SOC 2 report

fact: If a vendor cannot provide a SOC 1 or SOC 2 report, the company performs additional assessment of the vendor's cybersecurity preparedness

reasoning: The paragraph is primarily about how the company manages cybersecurity risk from third-party service providers, making Third-Party Risk the best fit. Its specificity is Domain-Adapted because it includes cybersecurity-specific evidence and standards (SOC 1/SOC 2 reports) but no firm-unique roles, committees, named systems, or externally verifiable claims.


reasoning: The paragraph primarily explains how the company's cybersecurity risk management program is structured within its broader risk management framework, which makes it a Risk Management Process disclosure. It contains only high-level ERM integration language and generic governance references, without cybersecurity domain terminology, firm-unique cyber facts, or externally verifiable claims.


reasoning: The paragraph primarily describes who oversees cybersecurity risk—senior leadership, the Audit Committee, and the Board—so it is best categorized as Board Governance. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the oversight language is generic boilerplate.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk from vendors and other service providers, making Third-Party Risk the best fit. Its details remain generic vendor-oversight language—assessments, questionnaires, program reviews, and contractual obligations—without domain-specific technical terms, firm-unique structures, or externally verifiable facts.


fact: The company has a CISO who leads cybersecurity risk management efforts and the dedicated information security team

fact: The CISO has over 20 years of information security experience

fact: The CISO has over four years of experience as a director in the information security management practice of a big four accounting firm

fact: The CISO holds a B.S. in Network Security

fact: The CISO leads the Information Security Steering Committee (ISSC)

fact: The ISSC is comprised of key executives and operating personnel from across the company

reasoning: This paragraph primarily explains how management is organized for cybersecurity, centered on the CISO’s reporting line, qualifications, and leadership of the ISSC, so Management Role fits best. Specificity is Quantified-Verifiable because it includes externally checkable tenure claims such as over 20 years of information security experience and over four years at a big four accounting firm, along with firm-specific organizational details like the ISSC.


fact: CBIZ's IT Security Director reports to CBIZ's Chief Information Officer

fact: The IT Security Director is the head of the Company's cybersecurity team

fact: CBIZ has a cybersecurity team

fact: The team relies on threat intelligence

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on the IT Security Director's reporting line, leadership role, and team responsibilities rather than the mechanics of the cybersecurity program itself. Specificity rises to Firm-Specific because it names company-specific management roles and team structure; although it includes the domain term 'threat intelligence,' the experience and certification statements are too vague to be verifiable.


fact: ERMC is part of the management team responsible for assessing and managing cybersecurity risks

fact: Vice President of Information Technology is part of the management team responsible for cybersecurity risk management

fact: The management team includes the legal and compliance function in cybersecurity oversight

fact: A key employee has over 20 years of experience in information technology and cybersecurity

fact: Senior management members have training in cyber incident response

reasoning: This paragraph primarily describes how management is organized to handle cybersecurity, including which management bodies and roles are responsible and the experience of personnel, so Management Role fits best. Specificity reaches Quantified-Verifiable because it includes a concrete, checkable claim that a key employee has over 20 years of relevant experience, along with firm-specific roles and committees.


fact: personally identifiable information

fact: cloud-based technology

fact: information security addenda

fact: obtaining overviews of network infrastructure

reasoning: The paragraph primarily explains how the company manages cybersecurity risks from vendors and service providers, making Third-Party Risk the best fit. Its specificity rises above boilerplate because it includes cybersecurity-specific third-party review elements such as information security addenda, network infrastructure review, cloud-based technology, and personally identifiable information, but it does not include firm-unique or externally verifiable facts.


fact: penetration testing firms

fact: managed cybersecurity service providers

reasoning: The paragraph primarily describes how the company’s cybersecurity program operates by using external specialists to help identify, assess, and manage cyber risks, which fits Risk Management Process rather than Third-Party Risk because the third parties are service providers to the company. Specificity is Domain-Adapted because it includes cybersecurity-specific terms such as penetration testing firms and managed cybersecurity service providers, but no firm-unique or externally verifiable facts.


fact: The CISO provides updates to the Audit, Risk and Finance Committee.

fact: The Audit, Risk and Finance Committee receives updates on the Information Security Program, cybersecurity risks, and recommended program changes.

fact: Senior members of the Information Security and Internal Audit functions report to the Audit, Risk and Finance Committee on information security and privacy matters.

reasoning: This paragraph primarily describes how cybersecurity information flows to a board-level committee and how that committee is kept informed, which makes it Board Governance rather than Management Role. Specificity is Firm-Specific because it includes company-specific governance actors such as the CISO and the named Audit, Risk and Finance Committee, but no externally verifiable hard facts.


reasoning: This paragraph is a cross-reference to Item 1A risk factors and contains forward-looking/speculative language about potential cybersecurity harms rather than describing governance, management, processes, third-party risk, an actual incident, or a materiality assessment conclusion. Because it provides no substantive cybersecurity program or incident details, it is generic boilerplate.


fact: A designated internal "Task Force" provides information to the Audit Committee on cybersecurity-related activities

reasoning: The paragraph primarily describes how cybersecurity information flows to a board committee and how the committee is informed about incidents and the cyber risk management program, which is board oversight. Specificity rises to Firm-Specific because it identifies a particular internal governance body—the Task Force—while the remaining details are otherwise generic oversight language.


fact: One member of the audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023.

fact: The company has a Chief Information Security Officer (CISO).

fact: The board receives updates on metrics about cyber threat response preparedness and program maturity milestones.

reasoning: This paragraph primarily describes how the board and its audit committee oversee cybersecurity, how information flows upward, and how incidents are escalated, which makes it Board Governance. Specificity reaches Quantified-Verifiable because it includes an externally checkable claim that an audit committee member earned the NACD CERT Certificate in Cybersecurity Oversight in 2023, along with the firm-specific CISO role and some cybersecurity-domain terminology.


reasoning: The paragraph primarily describes how the board oversees cybersecurity through delegation to the Audit Committee and reporting back to the full Board, which is a board oversight structure. It contains no qualifying domain-specific terminology, firm-specific facts, or externally verifiable claims under the stated specificity rules, so it remains generic boilerplate.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making Third-Party Risk the best fit. Its details remain generic process language—such as risk assessments, questionnaires, annual reviews, and contractual obligations—without domain-specific cyber terminology, firm-unique structures, or externally verifiable facts.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats have not materially affected the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its references to threats, breaches, and third-party vendors are generic and non-verifiable, and the cross-reference/risk language does not add specificity.


reasoning: This paragraph primarily provides regulatory background about applicable privacy laws, banking-agency oversight, and SEC disclosure requirements rather than describing the company’s cybersecurity governance, management, processes, third-party risk, incidents, or strategy impact. Under the annotation rules, such contextual legal/regulatory framing is None/Other, and None/Other paragraphs are classified as Generic Boilerplate.


fact: malware

fact: computer virus attacks

reasoning: The paragraph primarily answers whether cybersecurity has affected the company’s business strategy, results of operations, or financial condition, which makes it a Strategy Integration disclosure even though it also references actual threats and breaches. Its specificity rises above boilerplate because it names specific cyber threat types—malware and computer virus attacks—but includes no firm-specific roles, committees, dates, numbers, or other externally verifiable facts.


fact: The CIO has primary responsibility for the development, operation, and maintenance of the Company's information security program.

fact: The CIO has 19 years of experience in technology risk management.

fact: 11 of the CIO's 19 years of experience have been with the Company or its affiliates.

fact: The CIO has received SANS Global Information Security Leader certification.

fact: The CIO has received Certified Information Systems Auditor certification.

reasoning: This paragraph primarily describes how management is organized for cybersecurity by identifying the CIO's responsibility, qualifications, and the information security team's reporting structure. Specificity is Quantified-Verifiable because it includes externally checkable facts such as the CIO's 19 years of experience, 11 years with the company or affiliates, and named certifications.


reasoning: This paragraph is only a cross-reference to another section discussing potential risks and does not itself describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy impacts. Because it contains no qualifying domain-specific, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes part of the company's cybersecurity risk management approach—using outside advisors to help identify, assess, and manage cyber risks—rather than vendor oversight requirements or board/management structure. Its language is generic and contains no qualifying domain-specific technical terms, firm-unique organizational details, or externally verifiable facts.


fact: The CISO reports to the CIO

fact: The CISO is generally responsible for management of cybersecurity risk and the protection and defense of the company's networks and systems

fact: The CISO has served in information technology and information security roles for over 20 years

fact: The CISO holds an undergraduate degree in Information Systems from Xavier University

fact: The CISO holds an MBA from Michigan State

fact: The CISO and regional security leaders have a combined total of over 25 Information Technology and Cybersecurity certifications

fact: The certifications include Certified Information Systems Security Professional (CISSP)

fact: The certifications include Certified Cloud Security Professional (CCSP)

fact: The certifications include Certified Information Security Manager (CISM)

reasoning: This paragraph is primarily about how management is organized and qualified to oversee cybersecurity, focusing on the CISO's reporting line, responsibilities, and credentials, so Management Role fits best. Specificity is Quantified-Verifiable because it includes externally checkable claims such as over 20 years of experience, over 25 certifications, and named certifications and degrees.


fact: The paragraph references cybersecurity "vulnerabilities" as part of the reporting to the Board and Audit Committee.

fact: The Company's Chief Information Officer (CIO) is responsible for developing and implementing the information security program and reporting cybersecurity matters to the Board and Audit Committee.

fact: The Company's CIO has 25 years of experience in the information technology industry.

reasoning: This paragraph primarily explains how the Board and Audit Committee oversee cybersecurity risk and receive information from management, so Board Governance is the best fit. Its specificity reaches Quantified-Verifiable because it includes the externally checkable claim that the CIO has 25 years of IT experience, along with the firm-specific CIO role.


reasoning: The paragraph primarily describes management responsibility and qualifications by explaining that the Director of Operations & Information Technology evaluates cyber risk and leads mitigation strategy development. Its details do not rise above boilerplate specificity because the title is not a qualifying firm-specific security role, the experience is only approximate, and the certifications are unnamed and therefore not independently verifiable.


fact: Franchisees, licensees, or other counterparties are responsible for information security at certain non-owned, non-leased, and non-managed properties under their direction and control

fact: Franchisees and licensees are required to comply with Marriott brand standards relating to information security

fact: Those brand standards include an obligation for franchisees and licensees to report relevant information security incidents to Marriott

reasoning: The paragraph primarily explains how Marriott manages cybersecurity responsibilities and requirements for franchisees and licensees, making third-party risk the central topic. Its specificity is firm-specific because it describes Marriott’s own brand-standard requirements and incident-reporting obligations for counterparties, but it does not include externally verifiable dates, numbers, or named certifications.


fact: On December 15, 2020, the company detected a ransomware incident

fact: The incident is identified as the "Ransomware Incident"

fact: The ransomware incident impacted the company’s operational and information technology systems

fact: The incident caused service delays for customers

reasoning: This paragraph primarily describes an actual cybersecurity event—when it was detected, what type of incident it was, what systems were affected, and its operational impacts—so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a concrete, externally checkable date tied to a real ransomware incident.


reasoning: The paragraph primarily describes how the board, through the Audit Committee, oversees cybersecurity risk and receives information from management, which squarely fits Board Governance. Its details are generic oversight language—items like quarterly updates, third-party assessments, incident response plans, and business continuity are not qualifying domain-specific, firm-specific, or externally verifiable facts under the rubric.


fact: Regular internal and external vulnerability scanning of systems and applications

fact: Penetration testing conducted by independent security professionals using simulated cyberattacks

fact: Threat intelligence monitoring through threat intelligence feeds

fact: Review of vendors' third-party attestation as part of vendor due diligence

reasoning: The paragraph primarily describes what the company's cybersecurity program does—how it identifies, assesses, and mitigates cyber risk through scanning, penetration testing, threat intelligence, and risk assessment—so Risk Management Process is the best fit. Specificity is Domain-Adapted because it uses cybersecurity-specific practices and terminology, but it does not include firm-unique roles/committees or externally verifiable quantified facts.


fact: data exfiltration

fact: forensic and remediation costs

reasoning: The paragraph primarily explains how the company assesses the materiality of cybersecurity incidents by evaluating potential business, financial, operational, and reputational impacts, which fits Strategy Integration. Its specificity rises above boilerplate because it uses cybersecurity-specific concepts such as data exfiltration and forensic/remediation costs, but it does not include firm-specific or externally verifiable facts.


fact: Firewalls are deployed to monitor and filter network traffic

fact: Intrusion detection/prevention systems (IDS/IPS) are deployed

fact: Data loss prevention (DLP) solutions are deployed

fact: Antivirus controls are implemented on company devices

fact: Anti-malware controls are implemented on company devices

fact: Mobile Device Management solutions are implemented on company devices

fact: Access is restricted based on the principle of least privilege

fact: Encryption is used to protect data at rest and in transit

fact: Security awareness training covers phishing attempts

reasoning: This paragraph primarily describes the company’s cybersecurity controls and operational practices, so it is a Risk Management Process disclosure. Its specificity is Domain-Adapted because it uses concrete cybersecurity terminology and control types (e.g., IDS/IPS, DLP, MDM, least privilege, encryption at rest/in transit) but does not include firm-specific or externally verifiable facts.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its references to threats, breaches, a third-party vendor, and the December 31, 2023 date do not add qualifying domain-specific, firm-specific, or externally verifiable facts under the rubric, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity risks and prior incidents have not materially affected the company’s business strategy, results of operations, or financial condition, which squarely fits Strategy Integration. It contains no qualifying domain-specific terms, firm-specific organizational details, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: Vice President of IT is responsible for Li-Cycle's information security program

fact: denial-of-service attacks

fact: phishing

fact: ransomware

fact: malware

fact: social engineering

fact: vendor software supply chain compromises

fact: confidentiality, availability, and integrity of crucial information

reasoning: The paragraph primarily describes the company's cybersecurity risk environment and the kinds of threats and operational impacts its program is intended to address, so Risk Management Process is the best fit despite some governance references. Specificity reaches Firm-Specific because it includes the firm-unique role 'Vice President of IT' overseeing the information security program, along with several cybersecurity domain terms.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from vendors and other third parties, making Third-Party Risk the best fit. Its language remains generic—security assessments, ongoing monitoring, and compliance with cybersecurity standards are common boilerplate descriptions and do not include domain-specific technical terms, firm-specific structures, or verifiable details.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its remaining content is a generic cross-reference to risk factors, and it contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company's business strategy, results of operations, or financial condition, which fits Strategy Integration. It does not include qualifying domain-specific terminology, firm-specific organizational details, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: The Chief Information Officer briefs the Board on the cybersecurity program.

reasoning: The paragraph primarily describes how the Board oversees cybersecurity risk, including the flow of information from management to the Board and its supporting committee, so Board Governance is the best fit. Its specificity rises above boilerplate because it identifies a firm-specific cybersecurity leadership role—the Chief Information Officer—even though most other details are generic oversight language.


fact: Change Healthcare, a subsidiary of UnitedHealth Group, was identified as the entity that experienced the cybersecurity incident

fact: The incident involved a cybersecurity threat actor gaining access to some of Change Healthcare's information technology systems

fact: The affected company processes certain reimbursement claims related to the company's Exogen device

fact: The incident disrupted certain patient billing and collections processes

fact: The company identified an alternative claim processing intermediary and resumed claim submissions to some payers

fact: UnitedHealth Group was still investigating the incident and its potential impact on claims and patient data as of the filing date

fact: On March 7, 2024, UnitedHealth Group issued a statement about recovery efforts

fact: UnitedHealth Group said it expected to begin testing and reestablish connectivity to the affected claims network beginning March 18, 2024

reasoning: The paragraph primarily describes a real third-party cybersecurity incident, its operational effects, and the response timeline, so Incident Disclosure is the best fit even though it also includes materiality language. Specificity is Quantified-Verifiable because it includes named firms and specific dates tied to the incident and recovery efforts.


reasoning: The paragraph primarily states a materiality conclusion that cybersecurity threats or incidents have not materially affected the company during the reported periods, which makes it Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the negative assertion and cross-reference do not elevate specificity.


fact: The Board of Directors has delegated oversight of the cybersecurity program to the Risk and Governance Committee.

fact: The company's Head of Information Technology is a Certified Information Systems Security Professional (CISSP).

reasoning: The paragraph primarily describes the board oversight structure for cybersecurity, especially the delegation of responsibility to the Risk and Governance Committee and the flow of updates to that committee, so Board Governance is the best fit. Specificity reaches Quantified-Verifiable because it includes a named committee and an externally verifiable certification claim that the Head of Information Technology holds CISSP.


reasoning: This paragraph is a cross-reference to a risk factor and contains only general, forward-looking statements about potential cybersecurity harms rather than describing governance, management, processes, third-party risk practices, strategy integration, or a specific incident. Because it includes no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily explains how the board oversees cybersecurity risk, including that the full Board has primary oversight responsibility and receives reports from management and the Audit Committee. However, it contains no qualifying domain-specific terms, firm-specific cybersecurity roles/committees, or externally verifiable facts, so its specificity remains generic boilerplate.


fact: external and internal penetration testing

fact: SOC reports (service organization controls reports)

fact: vendor independent testing of data protection controls

fact: results of vulnerability and penetration testing

fact: incident response processes

fact: access reviews and controls

fact: encryption standards

fact: vendor risk rating based on information security review

reasoning: The paragraph is primarily about how the company evaluates and manages cybersecurity risk posed by third-party service providers, making Third-Party Risk the best fit. Its specificity is Domain-Adapted because it uses concrete cybersecurity terminology such as penetration testing, SOC reports, vulnerability testing, encryption standards, and vendor risk ratings, but does not include firm-unique or externally verifiable facts.


reasoning: The paragraph primarily describes how the Board of Directors and Audit Committee oversee cybersecurity through updates and briefings, which is board-level oversight. Its details remain generic because the named bodies and quarterly cadence do not count toward specificity here, and the remaining language describes standard oversight topics without domain-specific or firm-unique facts.


fact: The paragraph references advanced persistent threats (APTs)

fact: In September 2022, the company experienced a network intrusion

fact: An unauthorized third party accessed and downloaded confidential information from Rockstar Games' systems

fact: The accessed information included early development footage for the next Grand Theft Auto

fact: Also in September 2022, an unauthorized third party accessed credentials for a vendor platform used by 2K Games for help desk support

fact: The unauthorized party sent communications to certain players containing a malicious link

fact: 2K Games immediately notified affected users and restricted further unauthorized activity until service was restored

reasoning: This paragraph primarily describes actual cybersecurity incidents—their timing, nature, affected systems, and remediation—so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes concrete dated events in September 2022 and named entities such as Rockstar Games and 2K Games, which are externally checkable.


reasoning: The paragraph primarily describes how cybersecurity information is reported to the Audit Committee and Board of Directors, which is board-level oversight. It contains no qualifying domain-adapted, firm-specific, or externally verifiable facts because the references to the security team, quarterly updates, incidents, testing, and third parties are all generic.


reasoning: The paragraph primarily describes a component of the company’s cybersecurity program—using outside service providers to help evaluate and improve information security policies and procedures—so it is best categorized as Risk Management Process. It remains generic boilerplate because it does not name any specific provider, framework, tool, role, standard, or other qualifying firm-specific or verifiable detail.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats have not materially affected and are not reasonably likely to materially affect the company’s business strategy, financial condition, or results of operations, which fits Strategy Integration. Its references to possible cyber impacts and the Item 1A cross-reference are standard disclosure language and do not add domain-specific, firm-specific, or externally verifiable facts.


fact: The company has an Incident Response Team that identifies, assesses, responds to, and coordinates resources during a cybersecurity incident.

reasoning: The paragraph primarily describes how the company handles and escalates cybersecurity incidents, which is a cybersecurity process rather than board oversight or management qualifications. Its specificity is elevated by the reference to a named internal team, the Incident Response Team, but it contains no externally verifiable dates, numbers, or named third parties.


fact: The Audit Committee receives presentations on cybersecurity risks from the Chief Information Officer

fact: The Audit Committee receives presentations on cybersecurity risks from the vCISO

reasoning: The paragraph primarily describes how the board and its committee oversee cybersecurity, how reporting flows upward, and how incident updates reach the board structure, which makes it Board Governance. Its specificity is elevated to Firm-Specific because it identifies company-specific management roles involved in that governance process, particularly the Chief Information Officer and vCISO.


fact: Technology & Operations Committee receives cybersecurity updates

fact: The company's CISO provides cybersecurity updates to board committees

fact: The company's CIO provides cybersecurity updates to board committees

fact: Cybersecurity reporting involves a cross-functional group including information technology, legal, and internal audit functions

reasoning: The paragraph primarily describes how board committees oversee cybersecurity through regular reporting and updates from management, so it is Board Governance. Its specificity is Firm-Specific because it includes company-distinguishing governance details such as the Technology & Operations Committee and the involvement of the CISO and CIO; the quarterly cadence does not elevate it to Quantified-Verifiable.


reasoning: The paragraph primarily provides a materiality/business-impact assessment by stating that no material cybersecurity incidents occurred and that related expenses were immaterial, which fits Strategy Integration. Its statements are negative self-assessments without externally verifiable hard facts, so specificity remains Generic Boilerplate.


fact: CBIZ's Vice President, IT Security and Compliance reports to the Chief Information Officer and is the head of the cybersecurity team

fact: The IT Security Director is responsible for assessing and managing CBIZ's cyber risk management program and informing senior management regarding prevention, detection, mitigation, and remediation of cybersecurity incidents

fact: threat intelligence

reasoning: The paragraph primarily explains how management is organized to handle cybersecurity, focusing on leadership roles, reporting lines, and responsibilities rather than the broader program itself. Specificity is Firm-Specific because it includes company-specific management titles and structure, while also using cybersecurity domain terminology such as threat intelligence, but it does not provide sufficiently concrete verifiable details like named certifications, exact years, or quantified team size.


reasoning: The paragraph primarily describes how a board-level committee oversees cybersecurity through reports and presentations about significant threats, risks, and mitigation, which makes it Board Governance. It contains no qualifying domain-specific cybersecurity terminology beyond generic risk language and no firm-specific or externally verifiable facts that elevate specificity.


reasoning: The paragraph primarily states the objectives of the company's cybersecurity efforts—maintaining continuity and protecting technology and data—so it most directly fits Risk Management Process. It contains no qualifying domain-specific terminology, firm-unique organizational details, or externally verifiable facts, making it Generic Boilerplate.


reasoning: This paragraph is only a cross-reference directing readers to Item 1A for more information and does not itself describe cybersecurity governance, management, processes, third-party risk, incidents, or business impact. Because it contains no qualifying domain, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


fact: advanced persistent threats

reasoning: The paragraph primarily provides a materiality-oriented business impact assessment, including the statement that the company has not experienced a material cybersecurity incident and discussion of how a material incident could affect operations, reputation, litigation, and regulatory exposure, which fits Strategy Integration. Its specificity is elevated above boilerplate by the use of the cybersecurity-specific term "advanced persistent threats," but it contains no qualifying firm-specific or externally verifiable cybersecurity facts.


fact: The Audit and Finance Committee oversees risks from cybersecurity threats

fact: The Chief Information Security Officer discusses cybersecurity topics with the Audit and Finance Committee

fact: The Chief Technology and Digital Officer discusses cybersecurity topics with the Audit and Finance Committee

reasoning: The paragraph primarily describes how the board, through its Audit and Finance Committee and separate board discussions, oversees cybersecurity risk, so Board Governance is the best fit. Specificity rises to Firm-Specific because it identifies a company-specific committee and named senior cybersecurity/technology roles, but it does not include externally verifiable dates, numbers, or certifications.


fact: penetration testing

fact: threat monitoring

reasoning: The paragraph primarily answers how the company manages cybersecurity risks involving outside parties, especially by using third-party cybersecurity firms and imposing security-control requirements on vendors. Its specificity rises above boilerplate because it names cybersecurity-specific practices like penetration testing and threat monitoring, but it does not provide firm-unique or externally verifiable details.


reasoning: This paragraph is a high-level introductory summary about cybersecurity risk management and governance rather than a substantive description of board oversight, management roles, or program activities. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so its specificity is Generic Boilerplate.


fact: A forensic investigation was conducted following the incident.

reasoning: The paragraph primarily describes an actual cybersecurity incident—its nature, containment, and assessed impact—so Incident Disclosure is the best fit. Specificity rises above boilerplate because it references a cybersecurity-specific forensic investigation, but it does not include firm-unique organizational details or externally verifiable dates, numbers, or named third parties.


fact: The Risk Management Committee of the Board of Directors oversees the design, implementation, and operation of the enterprise risk management framework, including cybersecurity risk oversight.

fact: Management, including the EVP ERM and his team, provides reporting on the cybersecurity risk domain to the Risk Management Committee.

fact: The paragraph references payment of a ransom as a potential consequence of a cybersecurity breach.

reasoning: The paragraph primarily explains how the board oversees cybersecurity through the Risk Management Committee and the reporting flow from management to that committee and then to the full Board, which makes Board Governance the best fit. Specificity rises to Firm-Specific because it names a specific board committee and a firm role (EVP ERM); the 2024 statement about no materially impacting events is a negative self-assertion and does not qualify as externally verifiable.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its specificity is Generic Boilerplate because the paragraph contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts; the negative assertion and cross-reference to risk factors do not elevate specificity.


fact: Framework based on ISO 27001

fact: Adheres to the principle of least-privilege for access provisioning

fact: Phishing awareness exercises

fact: Security-by-design principles for securely developing and managing software systems

reasoning: The paragraph primarily describes what the cybersecurity program does—framework alignment, access control practices, and employee training—so it fits Risk Management Process. Its specificity is Domain-Adapted because it uses cybersecurity-specific concepts such as ISO 27001, least privilege, phishing exercises, and security-by-design, but does not include firm-unique or externally verifiable facts.


fact: Change Healthcare experienced a cybersecurity incident in which a threat actor gained access to some of its information technology systems

fact: Change Healthcare is identified as a subsidiary of UnitedHealth Group

fact: Change Healthcare acted as an intermediary for processing certain reimbursement claims related to the company's EXOGEN device

fact: The incident disrupted certain patient billing and collections processes

fact: The company identified an alternative claim processing intermediary and resumed claims submissions

fact: The incident delayed a portion of claims submissions to some commercial payers, delaying related cash remittances

fact: UnitedHealth Group was still investigating the incident as of the date of the Annual Report

reasoning: The paragraph is primarily about a real cybersecurity incident—what happened at Change Healthcare, how it affected the company’s operations, and the response—so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes externally checkable named entities and concrete incident-related claims involving Change Healthcare, UnitedHealth Group, and the EXOGEN device.


reasoning: The paragraph primarily describes how the Board, through the Audit Committee, oversees cybersecurity risk and receives information about the cybersecurity program, which fits Board Governance. It contains no qualifying specificity-elevating facts under the rules because Audit Committee references, annual review cadence, and unnamed third-party experts are generic rather than domain-specific, firm-specific, or externally verifiable.


fact: The CTO provides cybersecurity reports to the Board of Directors.

reasoning: The paragraph primarily explains how the board oversees cybersecurity through reporting from management, so it is best categorized as Board Governance. Its specificity is Firm-Specific because it identifies the CTO as the management role responsible for briefing the board; the rest of the language is otherwise generic governance description.


reasoning: The paragraph primarily addresses how a potentially material cybersecurity incident would be evaluated and disclosed in terms of impact on the company’s financial condition and results of operations, which fits Strategy Integration rather than describing an actual incident. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so its specificity is Generic Boilerplate.


reasoning: The paragraph does not describe an actual incident, governance structure, or risk-management activity; instead, it provides a company assessment that no cybersecurity incidents have occurred that affected operations, which fits Strategy Integration rather than Incident Disclosure. Its specificity is Generic Boilerplate because the paragraph contains only a negative self-assertion and reporting-period reference, neither of which counts as a qualifying specific fact.


fact: The company is externally managed by its Manager under a management agreement

fact: The company depends on the communications and information systems of its Manager, its affiliates, and third-party service providers

fact: The Manager is an affiliate of ORIX USA

fact: ORIX USA is described as a subsidiary of ORIX

fact: The company and its Manager participate in and are subject to ORIX USA's cybersecurity program

reasoning: The paragraph primarily explains that cybersecurity risk management is handled through external parties—the Manager, its affiliates, and ORIX USA—so third-party dependence is the central topic. Specificity is elevated by firm-specific and externally checkable facts, especially the named firms ORIX USA and ORIX and the described reliance on ORIX USA’s cybersecurity program.


fact: Our CISO provides more in-depth reporting on cybersecurity risks to the Audit Committee and the Board.

reasoning: The paragraph primarily describes how the Board oversees cybersecurity risk, including delegation to the Audit Committee and reporting flows from management to the Board, which makes it Board Governance. Its specificity is elevated to Firm-Specific by the mention of the CISO, a firm-specific senior cybersecurity role; the remaining details are largely generic governance language.


reasoning: The paragraph primarily addresses the business materiality of cybersecurity incidents, stating that prior incidents were not material and that future incidents could materially affect the company’s business, operations, and reputation. It remains generic boilerplate because it provides no qualifying domain-specific cybersecurity terminology, firm-specific organizational details, or externally verifiable facts.


fact: monitors information systems for potential vulnerabilities

fact: scanning internal network and infrastructure

fact: conducting third-party vulnerability testing

reasoning: The paragraph primarily describes what the cybersecurity program does—risk assessment, system monitoring, vulnerability scanning, testing, and incident handling—so it is best classified as Risk Management Process. Its specificity rises above boilerplate because it uses cybersecurity-specific practices such as vulnerability monitoring, network scanning, and vulnerability testing, but it does not include firm-unique roles/committees or externally verifiable claims.


fact: Chief Technology Officer (CTO) is primarily responsible for assessing and managing material risks from cybersecurity threats

fact: Chief Operating Officer (COO) is primarily responsible for assessing and managing material risks from cybersecurity threats

fact: The CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations

fact: The COO has over 5 years of experience overseeing cybersecurity and IT functions

reasoning: This paragraph primarily describes how the board oversees cybersecurity through delegation to the Audit Committee and reporting from management, so Board Governance is the best fit. Specificity reaches Quantified-Verifiable because it includes externally checkable experience claims for the CTO and COO, along with firm-specific named management roles.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk posed by external parties, especially by imposing security and breach-reporting requirements on third-party service providers. It does not include qualifying domain-specific technical terms, firm-unique organizational details, or externally verifiable facts, so the specificity remains generic boilerplate.


fact: In October 2023, the company experienced a cybersecurity incident

fact: Certain information of users was accessed and downloaded from individual 23andMe.com accounts without authorization

fact: The company implemented changes to its information systems and processes following the incident

fact: Enhancements were made to Security Operations

fact: Customer passwords were reset

fact: Two-step verification was required for new and existing customers

fact: Detection tools and capabilities were enhanced

fact: New tools and processes were implemented after the incident

reasoning: The paragraph primarily describes a real cybersecurity incident, including when it occurred, what happened, and the remediation steps taken, so it is best classified as Incident Disclosure. Specificity is Quantified-Verifiable because it includes a specific date and concrete incident details tied to identifiable accounts, along with several cybersecurity-specific remediation measures.


reasoning: This paragraph is a cross-reference directing the reader to Risk Factors for discussion of potential cybersecurity-related impacts, rather than describing governance, management, process, third-party risk, an actual incident, or a substantive materiality assessment itself. Because it contains no qualifying domain, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making Third-Party Risk the best fit. Although it includes a brief statement that cybersecurity threats have not materially impaired operations or finances, the disclosure remains generic and does not contain qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: The cybersecurity strategy includes defense in depth controls.

fact: The cybersecurity strategy includes zero trust based controls.

fact: The company conducts phishing email simulations for employees and contractors with access to corporate email systems.

fact: The company employs a cyber risk management and quantification system customized to its environment.

reasoning: The paragraph primarily explains what the company’s cybersecurity program does to assess, identify, and manage cyber risk, so it is best classified as Risk Management Process. Its specificity is elevated by cybersecurity-specific terminology and practices such as defense in depth, zero trust, phishing simulations, and cyber risk quantification, but it does not include firm-unique roles, named committees, or externally verifiable facts.


fact: Director of IT Security and Compliance

fact: IT Steering Committee

fact: vulnerability assessments

fact: defensive and continuous monitoring techniques

reasoning: The paragraph primarily describes what the cybersecurity program does—assessing readiness, testing controls, monitoring for threats, and escalating vulnerabilities—so Risk Management Process is the best fit. Specificity rises to Firm-Specific because it includes firm-unique organizational facts such as the Director of IT Security and Compliance and the IT Steering Committee, alongside domain-adapted terms like vulnerability assessments and continuous monitoring.


reasoning: The paragraph primarily provides a materiality-oriented assessment that no known cybersecurity incidents have materially affected the company to date, while warning that future incidents could materially affect business strategy, results of operations, or financial condition, which fits Strategy Integration. It does not include qualifying domain-specific cybersecurity terminology, firm-specific organizational details, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: The company incorporates intelligence sharing about emerging threats.

fact: The company collaborates with the Arizona Cyber Threat Response Alliance (ACTRA).

fact: The company collaborates with The Internet and Television Association (NCTA).

fact: The company uses public-private partnerships with government intelligence agencies for threat intelligence sharing.

reasoning: The paragraph primarily describes a cybersecurity activity—using threat intelligence sharing and external collaboration to inform the company’s security program—so it fits Risk Management Process. Specificity rises to Quantified-Verifiable because it names external organizations (ACTRA and NCTA) whose involvement could be independently checked, and it also includes cybersecurity-domain concepts like emerging threat intelligence sharing.


fact: The forensic investigation of the 2025 Cybersecurity Incident is complete

fact: Between approximately August 5-8, 2025, a threat actor gained unauthorized access to the Company's systems

fact: The incident may have involved acquisition of certain data

fact: The company has identified the likely scope of the incident

reasoning: This paragraph primarily describes an actual cybersecurity event—its timing, nature, investigation status, and ongoing impact evaluation—so Incident Disclosure is the best fit. Specificity reaches Quantified-Verifiable because it includes a concrete incident window of August 5-8, 2025, along with incident-specific technical details such as threat-actor access and forensic investigation.


reasoning: The paragraph primarily explains how the company identifies and assesses cybersecurity risk within its broader risk management processes, so it is best categorized as Risk Management Process. Its language remains generic—describing integration, assessments, testing, audit, and reviews without using cybersecurity-specific domain terminology, firm-unique structures, or verifiable facts—so specificity is Generic Boilerplate.


fact: Chief Information Officer reports line above the CISO

fact: Chief Information Security Officer (CISO) leads the company's cybersecurity efforts

reasoning: The paragraph primarily describes how the board and its committee oversee cybersecurity through reporting and briefings, so Board Governance is the best fit. Specificity rises to Firm-Specific because it includes firm-level organizational details about the CIO/CISO leadership structure; excluded items like the Audit Committee and quarterly cadence do not elevate specificity.


fact: The Company's Chief Technology Officer is responsible for developing and implementing the information security program and reporting on cybersecurity matters.

reasoning: The paragraph primarily explains how the board oversees cybersecurity, including the board’s ultimate oversight role, the audit committee’s assistance, and information flow from management to the board, so Board Governance is the best fit. Specificity rises to Firm-Specific because it includes a company-specific cybersecurity leadership role—the Chief Technology Officer—with defined responsibilities; the remaining details are largely generic governance language.


fact: The Senior Director of Information Technology has over 20 years of cybersecurity experience.

fact: The Senior Director of Information Technology has spent the last 10 years in leadership positions.

fact: Active association with US Cyber Army Command (ARCYBER).

fact: Active association with the Information Systems Security Association (ISSA).

fact: Active association with the Forum of Incident Response and Security Teams (FIRST).

fact: Holds Strategic Planning, Policy, and Leadership (GSTRT) certification.

fact: Holds Certified Information Systems Security Professional (CISSP) certification.

fact: Holds Certified Cloud Security Professional (CCSP) certification.

fact: Third-party vendors include assessors, consultants, and auditors with certifications such as CISSP-ISSAP.

fact: Third-party vendors include certifications such as CGEIT.

fact: Third-party vendors include certifications such as CDPSE.

fact: Third-party vendors include certifications such as CEH.

reasoning: This paragraph primarily describes who in management is responsible for cybersecurity and emphasizes the qualifications and experience of that leadership, so Management Role is the best fit. Specificity reaches Quantified-Verifiable because it includes externally checkable claims such as over 20 years of experience, 10 years in leadership roles, named professional associations, and named certifications.


reasoning: The paragraph primarily describes operational cybersecurity activities—monitoring the environment, using tools to detect suspicious behavior, and responding to possible incidents—so it fits Risk Management Process. However, it uses generic language without domain-specific security terminology, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides the company's materiality assessment, stating that cybersecurity threats and incidents have not materially affected and are not reasonably likely to materially affect the business, results, or financial condition, which fits Strategy Integration. Its statements are generic negative assertions about absence of material impact/incidents, and the dated reporting-period reference does not count as a qualifying specific cybersecurity fact.


fact: Results of information security program reviews are reported to senior management, including the ELT

reasoning: The paragraph primarily explains how cybersecurity-related review results flow up to senior management and ultimately the board, which makes board oversight the central topic. Specificity rises above boilerplate because it names a firm-specific internal team (the ELT), but otherwise uses mostly generic governance and process language.


reasoning: The paragraph primarily describes the company's general cybersecurity measures and objectives—safeguarding systems, data, and infrastructure—so it best fits Risk Management Process. Its language is fully generic and contains no qualifying domain-specific terms, firm-specific structures, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes management's oversight responsibility for cybersecurity strategy, which fits Management Role more than board governance or process. It contains only generic statements about executive management and risk oversight, with no qualifying domain-specific, firm-specific, or verifiable facts.


fact: Evaluates third-party cybersecurity practices through SOC 2 report reviews

fact: Reviews SOC 2 criteria including security, availability, processing integrity, confidentiality, and privacy controls

reasoning: The paragraph primarily explains how the company manages cybersecurity risk arising from service providers, operators, managers, vendors, and suppliers, so Third-Party Risk is the best fit. Its specificity rises above boilerplate because it references SOC 2 evaluations and specific control domains, but it does not include firm-unique roles/committees or externally verifiable quantified facts.


reasoning: The paragraph primarily explains how the company considers cybersecurity in reviewing vendors, so its main question is third-party cyber risk management. It contains no qualifying domain-specific terminology, firm-unique organizational details, or externally verifiable facts beyond generic vendor review language.


reasoning: The paragraph primarily gives a backward-looking materiality assessment that the company has not experienced a cybersecurity incident with a material adverse impact, which fits Strategy Integration under the materiality rule. Its remaining content is generic policy language, future-risk cautionary language, and a cross-reference, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: In 2024, the company became aware of a cybersecurity incident.

fact: The incident involved unauthorized access to an employee's email account.

fact: The threat actor fraudulently diverted company funds to its bank account through the compromised email access.

reasoning: The paragraph primarily describes an actual cybersecurity event, including what happened and the company's response and impact assessment, so Incident Disclosure is the best fit. Specificity reaches Quantified-Verifiable because it includes a real incident tied to a specific time period (2024) and concrete, externally checkable details about the compromised email account and diverted funds.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from suppliers, service providers, and other business partners, making Third-Party Risk the best fit. Its statements are generic vendor-risk practices and limitations without domain-specific technical terms, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily gives a materiality-style assessment that cybersecurity incidents have not materially affected the company’s operations, reputation, or financial performance, which fits Strategy Integration under the SEC disclosure rules. Its remaining statements about exposure to threats and investing in technologies and partnerships are generic and contain no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: threat intelligence

reasoning: The paragraph primarily describes how cybersecurity information flows upward to the Audit Committee and full Board, with management discussed as part of that oversight chain, so Board Governance is the best fit. Specificity rises above boilerplate because it includes the cybersecurity-specific term 'threat intelligence,' but it does not include qualifying firm-specific roles, named programs, or externally verifiable claims.


reasoning: The paragraph primarily describes what the cybersecurity program does—its framework and procedures for detecting threats, responding to incidents, and mitigating risk—so it fits Risk Management Process. Its language remains high-level and generic, with no qualifying domain-specific tools, standards, firm-unique roles/programs, or verifiable facts that would elevate specificity.


reasoning: The paragraph primarily describes the company's cybersecurity program activities and how cyber risk management is integrated into broader risk management, even though it briefly mentions leadership and board oversight. Its language is largely generic and process-oriented, without qualifying domain-specific technical terms, firm-specific cybersecurity roles/committees that count, or externally verifiable facts.


reasoning: This is a cross-reference to the Risk Factors section and contains only forward-looking, non-substantive language about possible future effects rather than any actual cybersecurity governance, management, process, incident, or strategy disclosure. Because it provides no qualifying domain, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


fact: Management includes a Senior Director, Global Information Security

reasoning: The paragraph primarily describes how the Audit Committee oversees cybersecurity through management reporting and strategy evaluation, which is board-level oversight. Its specificity is elevated by the firm-specific management role 'Senior Director, Global Information Security'; the remaining details are otherwise generic governance language.