reasoning: The paragraph primarily provides a materiality assessment of how cybersecurity threats and prior incidents have affected, and are reasonably likely to affect, the company's business strategy, results of operations, and financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the cross-reference and negative no-material-effect assertion do not elevate specificity.


content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This paragraph does not describe cybersecurity governance, management, processes, third-party risk, incidents, or strategy integration; it simply states that, as a blank check company with no operations, it has no operational exposure to discuss. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts under the rubric, specificity is Generic Boilerplate.

provider: openai

stage: benchmark


content_category: Third-Party Risk

fact: Members of the CCDC are involved in and review the Vendor Management Program annually.

specificity_confidence: medium

reasoning: The paragraph is primarily about how the company manages cybersecurity risks arising from vendors and suppliers, making Third-Party Risk the best fit. Specificity rises to Firm-Specific because it references the named committee CCDC; the rest of the language is mostly generic vendor-risk process description rather than domain-specific cyber terminology or externally verifiable facts.


content_category: Incident Disclosure

fact: In fiscal 2023, Fortra, LLC experienced a data security incident that affected the company.

fact: Fortra, LLC is identified as the third-party vendor involved in the incident.

fact: The affected service is the GoAnywhere managed file transfer as a service system (MFTaaS).

fact: The incident involved exploitation of a zero-day vulnerability in Fortra's systems.

fact: The company states the activity affected Fortra's systems and did not involve unauthorized access to the company's own information systems.

fact: The accessed data included protected health information as defined by HIPAA.

fact: The accessed data also included personally identifiable information.

fact: The company engaged outside experts to assist in investigating and responding to the incident.

fact: The company provided notifications to data owners, affected individuals where appropriate, and various State Attorneys General.

reasoning: This paragraph primarily describes a real cybersecurity event—its cause, affected systems and data, and response actions—so it is best classified as Incident Disclosure rather than Third-Party Risk. Specificity is Quantified-Verifiable because it includes externally checkable facts such as the named firm Fortra, LLC, the named GoAnywhere MFTaaS system, and the incident timing in fiscal 2023.


content_category: Management Role

fact: The CFO has been responsible for his oversight function as CFO to the Company for three years.

type: quantified

fact: The CFO has worked in the financial services industry for more than 30 years.

fact: The CCO has been responsible for oversight functions for the Company for three years.

fact: The current CCO has been serving since April 2025.

fact: The CCO has worked in the financial services industry for more than 35 years.

reasoning: This paragraph primarily explains how management is organized to oversee cybersecurity risk, focusing on the roles and experience of management rather than describing cybersecurity program activities. Its specificity is Quantified-Verifiable because it includes externally checkable tenure and experience claims, including specific years of service and the date April 2025.


reasoning: The paragraph primarily explains how the company oversees cybersecurity risk from third-party providers, making Third-Party Risk the best fit. Its language is generic vendor oversight boilerplate ('obtain reports,' 'ongoing monitoring,' 'cybersecurity standards') without domain-specific terminology, firm-unique details, or externally verifiable facts.


content_category: Board Governance

fact: The company has an Information Technology Committee involved in oversight of the cybersecurity program.

reasoning: The paragraph primarily describes how the Board oversees cybersecurity, including receiving updates and approving cybersecurity-related reviews, which makes Board Governance the best fit. Specificity rises to Firm-Specific because it identifies a named internal committee—the Information Technology Committee—but otherwise uses largely generic oversight language without verifiable dates, numbers, or technical cybersecurity details.


fact: DSCP contains procedures for reporting and responding to potential cybersecurity incidents and determining disclosure requirements, including timely incident reporting

fact: A Form 8-K about the incident was filed on February 29, 2024

fact: The incident referenced is the MOVEit Cybersecurity Incident

fact: The company worked together with PBI to investigate the incident

fact: Approximately 2.5 million to 2.7 million policyholders' or other customers' personal information was exposed and obtained by the threat actor

fact: The exposed personal information included social security numbers

reasoning: This paragraph primarily describes a real cybersecurity event—how it was investigated, what data was affected, and the stated operational and materiality impact—so it is best classified as Incident Disclosure. Its specificity is Quantified-Verifiable because it includes externally checkable facts such as the February 29, 2024 Form 8-K filing, the named MOVEit incident, PBI’s involvement, and the quantified estimate of 2.5 million to 2.7 million affected individuals.


reasoning: This paragraph is mainly background context about the company's information systems and data collection, rather than describing board oversight, management roles, cybersecurity processes, third-party risk, an actual incident, or business-impact assessment. Because it contains no qualifying domain-specific cybersecurity terms, firm-unique governance details, or externally verifiable cyber facts, its specificity is Generic Boilerplate.


fact: Regular assessments by the Chief Information Officer

reasoning: The paragraph primarily explains how the company manages cybersecurity risks from third-party service providers, making Third-Party Risk the best fit. Specificity rises to Firm-Specific because it includes a company-specific leadership role—the Chief Information Officer—while the rest of the language about assessments and monitoring is otherwise fairly generic.


fact: stronger privileged access policies

fact: enhanced and expanded multi-factor authentication

fact: unauthorized access

category_confidence: medium

reasoning: The paragraph is anchored to a real prior incident and describes remedial actions taken following that incident, so it primarily answers what happened and how the company responded. Its specificity is Domain-Adapted because it includes cybersecurity-specific measures like privileged access policies and multi-factor authentication, but no firm-unique or externally verifiable facts.


fact: On July 23, 2023, the company experienced a cybersecurity incident affecting certain data and IT systems

fact: The company incurred $14.3 million of costs in connection with the incident

fact: A forensic investigation was conducted in connection with the incident

reasoning: The paragraph primarily describes a real cybersecurity incident, including when it occurred and its consequences, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes externally checkable facts such as the July 23, 2023 incident date and the $14.3 million cost amount.


content_category: Risk Management Process

reasoning: The paragraph primarily describes the existence and scope of the company's cybersecurity risk management processes—how it identifies, assesses, and manages cyber risk across systems and data—so it fits Risk Management Process. Its language is broad and interchangeable with generic risk-management disclosure, with no qualifying domain-specific technical terms, firm-specific organizational details, or externally verifiable facts.


content_category: Strategy Integration

reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect its business, results, or financial condition, which fits Strategy Integration. The rest of the language is generic confidentiality and compliance boilerplate and contains no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: annual assessments of the SOC reports of third-party providers

fact: implementing complementary controls

reasoning: The paragraph primarily explains how the company manages cybersecurity risks arising from third-party service providers, making Third-Party Risk the best fit. Its specificity is elevated by cybersecurity-domain terminology such as reviewing SOC reports and implementing complementary controls, but it does not include firm-specific roles, committees, or externally verifiable claims.


fact: threat actors

reasoning: The paragraph primarily provides a materiality-oriented assessment—stating that no cybersecurity incident has had a material effect on the company’s business strategy, results of operations, or financial condition—so Strategy Integration is the best fit. Specificity rises above boilerplate only because it uses a cybersecurity-specific term ('threat actors'); the remaining statements are generic risk language and a non-verifiable negative assertion.


fact: Implements insider threat controls to identify, assess, and address risks from within the company

fact: Uses controls and tools to alert on suspicious or unusual insider activity

fact: Has controls to prevent data loss and external sharing of company information

reasoning: The paragraph primarily describes what the cybersecurity program does—controls for detecting and mitigating insider-related risks—so it fits Risk Management Process. Its specificity rises above boilerplate because it uses cybersecurity-specific concepts such as insider threats, suspicious insider activity monitoring, and data loss prevention, but it gives no firm-unique roles, committees, dates, or verifiable claims.


reasoning: The paragraph is primarily about how the company manages cybersecurity risks posed by business partners, making Third-Party Risk the best fit. It stays at Generic Boilerplate because it uses broad phrases like due diligence, continuous monitoring, and stringent standards without any cybersecurity-specific terminology, named frameworks, or firm-specific details.


reasoning: The paragraph primarily describes how the board-level Audit Committee oversees cybersecurity through discussions with management and annual program review, which is board governance. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the references to the Audit Committee and generic review activities are standard boilerplate.


reasoning: The paragraph primarily explains how the company manages cybersecurity risks from third-party providers, making Third-Party Risk the best fit. Its language is high-level and generic—describing security assessments, monitoring, and compliance without any domain-specific technical detail, firm-unique structure, or verifiable facts—so specificity is Generic Boilerplate.


reasoning: This paragraph is a definitional statement explaining what a cybersecurity threat means rather than describing governance, management, processes, third-party risk, incidents, or strategy impact. Because it is non-substantive definitional boilerplate, it is classified as None/Other and receives Generic Boilerplate specificity.


reasoning: This paragraph does not describe a substantive cybersecurity governance, management, or risk process; it mainly states that the company is a blank check company with no operations and no internal cybersecurity personnel or processes. Under the no-operations/SPAC rule, this is classified as None/Other, and such paragraphs are treated as Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality-style assessment that cybersecurity threats have not affected the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its statements are generic negative assertions about the absence of material impact or incidents and contain no qualifying domain, firm-specific, or externally verifiable facts.


reasoning: This paragraph does not describe cybersecurity governance, management, processes, third-party risk, incidents, or business-impact assessment; it only states in general terms that the company holds customer and sensitive business information. Because it contains no qualifying domain-specific, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes the Board of Directors’ role in developing and implementing cybersecurity-related policies and a future cybersecurity risk management program, so it most directly answers how the board is involved in oversight. Despite mentioning cybersecurity and risk assessment, it does so at a high level without any qualifying domain-specific terms, firm-unique governance bodies beyond the generic board, or verifiable facts, so specificity remains generic boilerplate.


reasoning: This paragraph primarily states that the company is a SPAC with no operations, no cybersecurity program, and no meaningful cyber exposure, which fits the no-operations/insufficient-substantive-disclosure None/Other bucket rather than a real governance or risk-management discussion. Under the annotation rules, None/Other paragraphs are always Generic Boilerplate, and the paragraph contains no qualifying specificity-elevating facts.


reasoning: The paragraph is a generic statement that cybersecurity is important and could negatively affect the company, but it does not describe governance, management roles, processes, third-party risk, a real incident, or a concrete business-impact assessment. Because it contains only boilerplate speculative language and no qualifying domain, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes how management is organized to oversee cybersecurity, focusing on the CEO, MIS consultant, and MIS supervisor reporting structure rather than detailing board oversight or substantive program activities. It does not include qualifying domain-specific terminology, firm-specific roles that meet the annotation rules, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes cybersecurity program activities—risk assessment, maintenance of security controls, and incident response support—so it best fits Risk Management Process. Its references to a third-party consultant and external service providers are generic and unnamed, and the wording does not include qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: third-party information technology and cybersecurity providers and consultants are used to perform regular system scans

fact: third-party providers perform threat intelligence analysis

reasoning: The paragraph is primarily about how the company uses and imposes requirements on outside providers, making third-party cyber risk the central topic despite also mentioning employee training. Specificity rises above boilerplate because it includes cybersecurity-specific practices such as system scans and threat intelligence analysis, but it contains no firm-unique roles, committees, or externally verifiable claims.


reasoning: The paragraph primarily describes how the company supports its cybersecurity program—by using outside consultants and providers as part of its risk management strategy—so it fits Risk Management Process rather than Third-Party Risk, which requires vendor-risk oversight as the central topic. Its language is generic and does not include qualifying domain-specific technical terms, firm-specific structures, or verifiable facts, so specificity is Generic Boilerplate.


reasoning: This paragraph is background about the company's reliance on IT systems and sensitive data, but it does not describe board oversight, management roles, cybersecurity processes, third-party risk, a real incident, or a materiality/business-impact assessment. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so the specificity is Generic Boilerplate.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from vendors and other external parties, making third-party risk the central topic. It does not include qualifying domain-specific cybersecurity terminology, firm-unique organizational details, or verifiable facts beyond generic third-party oversight language.


fact: The company has a named Steering Committee involved in cybersecurity oversight and review.

reasoning: Although the paragraph is framed around the Steering Committee, its main substance describes what the cybersecurity program covers and how it is monitored through updates on prevention, detection, mitigation, remediation, assessments, and policy review, which makes Risk Management Process the best fit. Specificity rises to Firm-Specific because it references a named non-generic internal committee, but it does not include externally verifiable dates, numbers, or named third parties.


reasoning: The paragraph primarily describes what the cybersecurity program does and how it fits into enterprise risk management, which makes it a risk management process disclosure. However, it uses high-level, generic language about assessments, security controls, incident response, and external service providers without any domain-specific terms, firm-unique roles, or verifiable details.


reasoning: The paragraph primarily describes how cybersecurity risk information flows through the Audit Committee to the Board and how the Board reviews material cybersecurity risks, which is board oversight. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts because references to the Audit Committee and annual review cadence are generic governance boilerplate.


reasoning: The paragraph primarily gives a materiality assessment, stating that past cybersecurity incidents have not been determined to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its remaining references to business continuity, incident response, and a risk-factor cross-reference are generic and do not add domain-specific, firm-specific, or externally verifiable facts.


fact: The company has an internal working group involved in assessing cybersecurity threats.

fact: The CTO is identified as part of cybersecurity management leadership.

fact: The CISO is identified as part of cybersecurity management leadership.

reasoning: The paragraph primarily describes management’s qualifications and roles in handling cybersecurity, especially the internal working group and the CTO/CISO. Specificity reaches Firm-Specific because it names cybersecurity-relevant leadership roles, but it does not provide named certifications or hard, externally verifiable quantities.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk, including delegation to the Audit Committee and reporting up to the board level, which makes it Board Governance. Its details are generic governance structure elements (Board, Audit Committee, CFO, broad risk oversight language) and do not include qualifying domain-specific, firm-specific, or verifiable facts.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company did not experience cybersecurity incidents in fiscal year 2025 that materially affected or are reasonably likely to materially affect its business strategy, results, cash flow, or financial condition, which fits Strategy Integration. Its language is otherwise generic, and the negative assertion is not externally verifiable, so no qualifying specificity-elevating facts are present.


reasoning: The paragraph primarily explains how management is organized to oversee cybersecurity risk, including its coordination with an external IT specialist and its responsibility for overall oversight, which fits Management Role. It does not include qualifying domain-specific cybersecurity terminology, firm-unique roles or committees, or externally verifiable facts, so specificity remains Generic Boilerplate.


reasoning: This paragraph is purely hypothetical risk language about possible cyberattacks and their potential consequences, without describing actual governance, management, processes, third-party oversight, or a real incident. Because it contains no qualifying domain-specific, firm-specific, or verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: This paragraph primarily describes how the board oversees cybersecurity by delegating oversight to a board committee and having that committee review the program, risks, and mitigations, which makes it Board Governance. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts under the rubric, since references to the Board and Audit Committee are generic governance elements.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors that handle sensitive information, making third-party oversight the central topic. Its wording is generic and does not include cybersecurity-specific domain terms, firm-unique organizational details, or externally verifiable facts.


fact: protect the confidentiality, integrity, and availability of our data

reasoning: The paragraph primarily describes the company’s cybersecurity program objective—developing and maintaining measures to protect systems and data—so it fits Risk Management Process. Its specificity rises above boilerplate because it uses the cybersecurity concept of confidentiality, integrity, and availability (the CIA triad), but it includes no firm-specific roles, structures, or verifiable claims.


reasoning: The paragraph primarily describes how cybersecurity information flows to the Audit Committee and Board of Directors, including notification and briefing practices, which makes board oversight the main topic. It does not contain qualifying domain-specific terminology, firm-unique governance structures, or externally verifiable cyber facts beyond generic oversight language.


reasoning: The paragraph is mainly generic introductory and cautionary language about cybersecurity threats and possible adverse effects, rather than describing board oversight, management roles, a concrete cyber program, vendor oversight, an actual incident, or a materiality assessment. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity is Generic Boilerplate.


fact: vulnerability management

reasoning: The paragraph primarily describes governance oversight by explaining that management reports cybersecurity matters to the Audit Committee, making board-level oversight the main focus. Its specificity rises above boilerplate because it includes the cybersecurity-specific practice of vulnerability management, but it does not contain qualifying firm-specific or externally verifiable facts.


fact: Chief Information Officer (CIO) holds primary responsibility for the cybersecurity program

fact: The CIO has more than 20 years of experience in information and operational technology

fact: operational technology

fact: critical cyber assets

fact: common and sophisticated cyber threats

reasoning: The paragraph primarily describes who in management is responsible for cybersecurity and how that responsibility is organized around the CIO and IT team, making Management Role the best fit. Specificity is Quantified-Verifiable because it includes the externally checkable claim that the CIO has more than 20 years of information and operational technology experience, along with firm-specific role information and some cybersecurity domain terminology.


fact: confidentiality, integrity, and availability

fact: information security program

reasoning: The paragraph primarily describes what the cybersecurity program is intended to do—guide ongoing evaluation and improvement of security for systems, data, and operations—so it fits Risk Management Process. Specificity is Domain-Adapted because it uses cybersecurity-domain terminology, especially the confidentiality-integrity-availability triad, but does not provide firm-specific roles, committees, numbers, dates, or other verifiable details.


fact: The cybersecurity program is led by the vice president of information technology services.

reasoning: The paragraph primarily describes how the board and its Audit Committee oversee cybersecurity risk and receive updates from management, which is board governance. Specificity rises to Firm-Specific because it identifies a company-specific VP-level role leading the cybersecurity program.


reasoning: The paragraph primarily addresses the company's assessment of cybersecurity exposure and potential business consequences, including the statement that it has not experienced incidents to date and that future events could disrupt operations and harm reputation, which fits Strategy Integration more than Incident Disclosure because no actual incident is described. Its language is generic and speculative, without domain-specific cybersecurity practices, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes who oversees cybersecurity-related risk at the company—its board of directors—even though it also notes reliance on third parties. It contains no qualifying domain terms, firm-specific roles/committees, or verifiable facts, so the specificity remains generic boilerplate.


reasoning: This paragraph is primarily regulatory/contextual and includes a cross-reference to another section rather than describing the company's cybersecurity governance, management, risk processes, third-party oversight, incident details, or strategy impact. Because None/Other paragraphs are treated as non-substantive for specificity, it is classified as Generic Boilerplate.


reasoning: The paragraph is primarily a high-level, forward-looking statement that cybersecurity threats could adversely affect the company and require resources, without describing actual governance, management, processes, third-party oversight, or a real incident. Although it mentions cyber threats, it remains speculative/boilerplate rather than a substantive Item 1C disclosure category, so specificity is Generic Boilerplate.


fact: In May 2025, the company detected unauthorized changes to its domain, DNS, and email configurations.

fact: DNS configurations were affected.

fact: Email configurations/email-routing disruption were affected.

fact: The unauthorized changes originated from administrative credentials retained by a former employee.

fact: The impact was limited to a brief email-routing disruption, while production systems remained fully operational.

fact: The company reported no evidence of data exfiltration or compromise involving customer data, financial information, or internal systems.

fact: The issue was contained on the same day it was discovered.

reasoning: This paragraph primarily describes an actual cybersecurity event—what happened, what systems were affected, and how quickly it was contained—so it is best classified as Incident Disclosure. Specificity reaches Quantified-Verifiable because it includes a concrete date ('May 2025') and a checkable timing claim ('contained on the same day'), along with technical terms such as DNS and data exfiltration.


fact: Computer malware

fact: Viruses

fact: Ransomware

fact: Phishing attacks

fact: Unauthorized access

reasoning: The paragraph primarily describes the company's cybersecurity risk environment and its ongoing monitoring and prevention activities, which best fits Risk Management Process rather than governance or incident disclosure. Its specificity is elevated by concrete cybersecurity threat terminology such as ransomware and phishing, but it lacks firm-specific roles, committees, systems, dates, or verifiable claims.


fact: The Information Technology Committee reviews the effectiveness of the company's cybersecurity controls and procedures

fact: The Chief Information Security Officer (CISO) briefs or provides reports to the Information Technology Committee on cybersecurity and information security posture and program

fact: Penetration test results are included in cybersecurity reporting to the Information Technology Committee

reasoning: This paragraph primarily describes how the board oversees cybersecurity through the full Board, the Information Technology Committee, and reporting from the CISO, so Board Governance is the best fit. Specificity rises to Firm-Specific because it includes company-specific governance facts such as the named Information Technology Committee and the CISO role; while 'penetration test results' adds domain terminology, there are no hard verifiable dates, quantities, or named external firms.


reasoning: The paragraph most directly addresses oversight by stating that management and the board intend to meet periodically to assess the situation and determine whether additional steps are needed, which fits board governance. Its wording is entirely generic and contains no domain-specific cybersecurity terms, firm-specific structures, or verifiable facts, so specificity is Generic Boilerplate.


fact: In 2023, a threat actor inserted themselves into an email exchange regarding a BTC transfer

fact: Sphere 3D Corp. was involved in the incident

fact: 26 BTC was transferred to a wallet controlled by the threat actor

fact: The 26 BTC had a value of approximately $560,000 at the time

fact: The transfer involved the Company's wallet and Sphere 3D's wallet

fact: Gryphon engaged with U.S. Federal law enforcement to attempt recovery

fact: BTC

fact: wallet

fact: threat actor

reasoning: This paragraph describes an actual cybersecurity-related incident, including how the attack occurred, what was transferred, and the failed recovery effort, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a specific year, named firms, and hard incident details including 26 BTC and an approximate dollar value.


reasoning: The paragraph primarily provides a materiality assessment that cybersecurity threats or incidents have not materially affected the company's business strategy, results of operations, or financial condition, which fits Strategy Integration. Its remaining content is a forward-looking caution and a risk-factor cross-reference, and it contains no qualifying domain-specific, firm-specific, or externally verifiable facts.


fact: educates and trains its workforce on cybersecurity leading practices

fact: internal and external penetration testing

fact: vulnerability scanning

fact: remediation steps are taken based on the criticality of the results

reasoning: The paragraph primarily describes operational cybersecurity activities the company performs—training, penetration testing, vulnerability scanning, and remediation—so it fits Risk Management Process. Its specificity is Domain-Adapted because it uses concrete cybersecurity practices and terminology, but does not include firm-unique roles, named programs, or externally verifiable facts.


reasoning: This paragraph is a cross-reference directing readers to Item 1A risk factors and does not describe cybersecurity governance, management, processes, third-party oversight, an actual incident, or a materiality assessment. Because it contains no qualifying domain-specific, firm-specific, or verifiable cybersecurity facts, its specificity is Generic Boilerplate.


fact: The company follows an annual IT Security assessment based on the IASME Cyber Essentials framework

type: framework

fact: The IASME Cyber Essentials framework is described as approved by the UK government Cyber Security NCSC

fact: The company implements policies and controls based on ISO 27001

fact: The company implements policies and controls based on the NIST framework

reasoning: The paragraph primarily describes what the cybersecurity program does—using an IT security assessment and implementing policies and controls based on recognized frameworks—so it fits Risk Management Process. Specificity is elevated by named frameworks and the verifiable claim referencing IASME Cyber Essentials approval by the UK government Cyber Security NCSC.


fact: The cybersecurity program is managed by the Chief Information Security Officer (CISO).

reasoning: The paragraph primarily describes the oversight structure for cybersecurity, culminating in the Audit Committee’s responsibility for reviewing cybersecurity risk management and the CISO’s management role, which makes Board Governance the best fit. Specificity rises to Firm-Specific because it includes the named cybersecurity leadership role of Chief Information Security Officer, while the rest of the process language is generic and the Audit Committee does not count as a specificity-elevating fact.


fact: Requests System and Organization Controls (SOC) reports from third-party vendors

reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors, making Third-Party Risk the best fit. Specificity rises above boilerplate because it cites a concrete cybersecurity evidence artifact—System and Organization Controls reports—rather than only generic vendor assessment language.


fact: completed a forensic investigation

fact: automated off-boarding and access-revocation processes

fact: established 24/7 SIEM/SOC monitoring

fact: SIEM/SOC monitoring for identity and domain anomalies

fact: domain, DNS, and email operations are now fully stabilized and secured

reasoning: The paragraph primarily describes post-incident remediation, current status, and impact from an actual cybersecurity event, so Incident Disclosure fits best. Specificity rises to Firm-Specific because it includes a firm-distinguishing operational claim—24/7 SIEM/SOC monitoring—along with several cybersecurity-domain terms such as forensic investigation, access revocation, SIEM/SOC, and DNS.


fact: ransomware groups that steal data, encrypt systems, and demand a payment

fact: threat actors targeting critical information systems infrastructure assets and disrupting operations

fact: security controls

fact: security tools

reasoning: The paragraph primarily answers whether cybersecurity has affected or could affect the business, centered on the explicit materiality statement that no cybersecurity incidents have materially impacted the company’s strategy, results, or financial condition. Its specificity rises above boilerplate because it uses cybersecurity-domain language such as ransomware, threat actors, security controls, and security tools, but it does not include firm-specific or externally verifiable facts.


fact: The company’s Executive Vice President of Technology is responsible for assessing and managing cybersecurity risks

fact: The Executive Vice President of Technology reports directly to the Chief Executive Officer

fact: The Executive Vice President of Technology has over 16 years of experience managing information technology and cybersecurity matters

reasoning: The paragraph primarily provides a materiality assessment—stating that known cybersecurity threats have not materially affected the company in the last fiscal year but are reasonably likely to materially affect it if realized—which makes Strategy Integration the best fit. Its specificity is Quantified-Verifiable because it includes a hard, externally checkable claim that the Executive Vice President of Technology has over 16 years of relevant experience, along with a firm-specific named role.


fact: At 10:25 p.m., local Hong Kong SAR time, on April 9, 2024, the Company received information indicating a possible email spoofing incident

fact: The incident involved email spoofing

fact: By April 11, 2024, the Company verified the payment issue

fact: The Company wired $30,825 to a third-party bank account on March 27, 2024

fact: The spoofed email purported to be an invoice from the Company's public auditor

fact: An internal incident report was distributed by the Company's Chief Information Security Officer

fact: The Company concluded, based on conversations with its bank and local law enforcement, that recovery of the $30,825 payment was not believed possible

fact: The Company adopted responsive actions as of April 12, 2024

fact: The Company restricted its email system so that only verified email addresses were allowed for incoming and outgoing emails

fact: The Company briefed personnel about the incident and adopted cybersecurity safeguard measures

reasoning: This paragraph primarily describes a specific cybersecurity event, including its timing, nature, monetary impact, investigation, and remediation, so it is Incident Disclosure. Specificity is Quantified-Verifiable because it contains multiple externally checkable facts, including exact dates, a precise dollar amount, and the involvement of the Chief Information Security Officer.


fact: The Manager has a Cyber Risk Committee.

fact: The Cyber Risk Committee is comprised of the CIO and other executive officers of the Fund.

fact: The CIO serves as the Fund's representative for significant information technology activities and initiatives.

fact: The CIO has more than twenty years of experience as an information technology professional.

fact: The CIO has been CIO since 2007.

fact: The CIO has periodic calls with a third-party virtual Chief Information Security Officer.

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on the CIO, the Manager's Cyber Risk Committee, and the CIO's interactions with a third-party virtual CISO. Specificity is Quantified-Verifiable because it includes checkable claims about the CIO's experience and tenure since 2007, along with firm-specific organizational details.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which makes it Strategy Integration. It contains no qualifying domain-specific technical terms, firm-unique organizational details, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: In August 2021, the company experienced a cybersecurity incident.

fact: That August 2021 incident resulted in numerous lawsuits, including mass arbitration claims and multiple class action lawsuits.

fact: In January 2023, the company experienced another cybersecurity incident.

fact: The January 2023 incident resulted in consumer class actions and regulatory inquiries.

fact: The company has incurred significant costs as a result of the August 2021 and January 2023 cyberattacks.

fact: The company references Note 18 – Commitments and Contingencies of the Notes to the Consolidated Financial Statements for additional details.

reasoning: The paragraph primarily addresses how identified cyber incidents have affected or may affect the company’s financial condition, insurance coverage, and business outcomes, so Strategy Integration fits better than pure incident description. Specificity is Quantified-Verifiable because it includes externally checkable dates and concrete claims about lawsuits, class actions, and regulatory inquiries tied to real incidents.


fact: The company identified an email spoofing effort involving a scammer impersonating one of the company's subsidiaries

fact: The incident occurred in May 2014

reasoning: This paragraph describes a real cybersecurity-related event, including what happened and the outcome, so it is primarily an incident disclosure. Specificity is Quantified-Verifiable because it includes a concrete incident date (May 2014), and it also uses the cybersecurity-specific term 'email spoofing.'


reasoning: The paragraph primarily explains management’s responsibility and qualifications for handling cybersecurity risk, which makes it a Management Role disclosure rather than a description of the underlying cybersecurity program. It does not contain qualifying domain-specific technical terminology, firm-unique cyber governance structures, or externally verifiable facts that would elevate specificity above boilerplate.


fact: Threat intelligence is used as an input to supervise cybersecurity efforts.

reasoning: The paragraph primarily explains how executive management supervises cybersecurity efforts, making it about management’s role rather than board oversight or the underlying program. Specificity rises above boilerplate because it references the cybersecurity-specific concept of threat intelligence, but it does not include firm-specific roles that count here or externally verifiable details.


fact: The company completed its forensic investigation on December 13, 2023.

fact: An unauthorized third party accessed certain systems.

fact: The threat actor deployed malware that was not self-propagating.

fact: Certain data was exfiltrated.

fact: The last confirmed date of unauthorized third-party activity in the network was November 20, 2023.

reasoning: This paragraph primarily describes the facts, timing, and scope of an actual cybersecurity event, so it is Incident Disclosure. Its specificity is Quantified-Verifiable because it includes concrete dates tied to the incident and other specific incident details such as malware deployment and data exfiltration.


fact: The Head of Resources Management has more than 30 years of overall experience.

fact: The Head of Resources Management has more than 20 years directly assessing and managing the company’s cyber information technology and human resources systems and related security concerns.

fact: The CCO has more than 30 years of overall experience as a CPA.

fact: The CCO has more than 15 years managing information technology systems and databases.

fact: The CCO has 15-plus years supporting the Adviser’s and Administrator’s resource management department.

reasoning: The paragraph primarily explains which management personnel handle cybersecurity and why they are qualified, so it is about management organization and qualifications rather than the cybersecurity program itself. Specificity reaches Quantified-Verifiable because it includes multiple checkable experience claims with concrete year thresholds for the Head of Resources Management and the CCO.


fact: management committee on cybersecurity

reasoning: The paragraph primarily explains how management is organized to oversee cybersecurity, focusing on the responsibilities and reporting relationship of the Senior Director and Head of Information Technology and the management committee on cybersecurity. Specificity rises to Firm-Specific because it identifies a named management-level cybersecurity committee, but it does not include externally verifiable numbers, dates, certifications, or named vendors.


fact: monitoring and rating services

fact: open-source intelligence risk assessments

fact: posture and intelligence reviews of vendors

fact: evaluations of critical vendors to assess security requirements

fact: service level agreements assessed so cyber controls and practices are embedded

reasoning: The paragraph is primarily about how the company manages cybersecurity risk from vendors and other third-party solutions, so Third-Party Risk is the best fit. Its specificity rises above boilerplate because it uses cybersecurity-specific concepts such as open-source intelligence assessments and vendor posture reviews, but it does not include firm-unique roles, named programs, or externally verifiable facts.


reasoning: The paragraph primarily explains how the board oversees cybersecurity risk, specifically by assigning primary oversight to the board-level Audit Committee, so it is Board Governance. Its language is otherwise generic oversight boilerplate and contains no qualifying domain-specific, firm-specific, or externally verifiable facts under the stated rules.


fact: The Technology Committee of the Board approves certain Bank-wide governing policies related to IT and information security

fact: The Board Technology Committee approves the company's Information Security Policy

reasoning: This paragraph primarily describes how the board oversees cybersecurity, including the Board's responsibility for the information security program and delegation to a Board Technology Committee, so Board Governance is the best fit. Specificity rises to Firm-Specific because it names a company-specific board committee and a specific internal policy, but it does not include externally verifiable dates, numbers, or named outside firms.


fact: The company has a CISO who leads all aspects of its global cybersecurity program

fact: The CISO joined Workday in 2010

fact: The CISO has served as CISO since April 2018

fact: The CISO has more than 15 years of experience in cybersecurity and information technology risk management

fact: The CISO has a degree in information systems management

reasoning: This paragraph is primarily about how management is organized and qualified to handle cybersecurity, centering on the CISO’s responsibilities, tenure, and background, so it fits Management Role. Specificity is Quantified-Verifiable because it includes externally checkable facts such as the CISO’s 2010 start date, service since April 2018, and more than 15 years of experience.


reasoning: The paragraph primarily provides management’s conclusion about whether cybersecurity incidents or threats have materially affected, or are reasonably likely to materially affect, the company’s operations, financial condition, strategy, or results of operations, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the statements are generic materiality assertions and a cross-reference.


fact: The Head of Information Technology for Latin America, who oversees cybersecurity, has 25 years of experience in strategic IT leadership and global project management.

reasoning: The paragraph primarily describes management organization and qualifications by identifying the management role responsible for cybersecurity and summarizing that leader’s experience. Specificity is Quantified-Verifiable because it includes a concrete, externally checkable claim: 25 years of experience.


fact: Risk Management Committee of the Board of Directors oversees risks from cybersecurity threats

fact: The Committee receives reports from and oversees the IT Risk Assessment

fact: The Committee receives reports from and oversees the Cybersecurity Risk Assessment

fact: The Committee receives reports from and oversees the Annual IT Program Status Report

fact: The Committee receives reports from and oversees the Vendor Management Risk Assessment

fact: The Committee receives Quarterly Internal Vulnerability Reports

fact: The Committee receives current Cyber Events briefings

fact: The Committee makes budgeting, procedure, and policy decisions intended to improve the Company's residual risk

reasoning: The paragraph primarily explains how a board-level committee oversees cybersecurity risk, what information it receives, and how it exercises oversight, so Board Governance is the best fit. Specificity rises above boilerplate because it names a particular board committee and several firm-specific reporting artifacts, with additional cybersecurity terminology such as vulnerability reports and residual risk.


fact: penetration testing

fact: managed detection and response services

fact: intrusion prevention and detection applications

reasoning: The paragraph is primarily about how the company oversees cybersecurity risks arising from third parties, especially through its vendor risk management program, reviews of critical third parties, and assessment of their cyber risk protocols. Specificity is Domain-Adapted because it includes cybersecurity-specific practices and technologies such as penetration testing, managed detection and response, and intrusion prevention/detection, but no firm-unique or externally verifiable facts.


reasoning: The paragraph is primarily a forward-looking caution about what a cybersecurity incident could cause, rather than describing actual governance, management structure, or concrete risk management practices. Its references to preventing, detecting, and responding are generic and do not add specificity beyond boilerplate hypothetical risk language.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk, including delegation of oversight to a board committee and reporting from management, which makes it Board Governance. It contains only generic governance language and excluded generic roles/committees, with no qualifying domain-specific, firm-specific, or externally verifiable facts.


reasoning: This paragraph is background context about the company's reliance on internal and third-party technology, but it does not describe governance, management structure, cybersecurity processes, vendor-risk management practices, incident details, or business impact assessments. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: The company announced the cybersecurity incident on October 28, 2023.

fact: The incident impacted certain internal operations and information technology systems.

fact: The incident adversely affected the company's ability to ship orders in the first quarter of fiscal 2024.

fact: All facilities were operational by mid-December 2023 and returned to normalized operations.

fact: The company incurred $1.5 million of expenses related to the cybersecurity incident in the first fiscal quarter of fiscal 2024.

reasoning: This paragraph primarily describes an actual cybersecurity incident, including when it was identified, what operations were affected, operational recovery timing, and related costs, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it contains externally checkable dates and a specific dollar amount ($1.5 million).


fact: Chief Technology Officer (CTO) provides reports on cybersecurity risks and mitigation activities to the Audit Committee

fact: Chief Information Security Officer (CISO) provides reports on cybersecurity risks and mitigation activities to the Audit Committee

fact: vulnerability assessments

fact: threat environment

reasoning: The paragraph primarily explains how the board oversees cybersecurity risk, including delegation to the Audit Committee and information flow from management, so Board Governance is the best fit. Specificity reaches Firm-Specific because it identifies named senior roles (CTO and CISO), and it also includes some domain-adapted cybersecurity terms such as vulnerability assessments and threat environment.


fact: The Company has a Chief Technology Officer

fact: The Chief Technology Officer reports to the Executive Vice President – Operations

fact: The Company has a technology services team that manages cybersecurity needs

reasoning: The paragraph primarily explains management’s cybersecurity organization and reporting lines—specifically the CTO’s role, reporting relationship, and which internal groups are involved—so it fits Management Role. Its specificity is Firm-Specific because it includes company-specific leadership roles and team structure, but no externally verifiable quantified facts.


reasoning: The paragraph is primarily about how the company addresses cybersecurity risks arising from vendors and third-party systems, so Third-Party Risk is the best fit. It stays at Generic Boilerplate because it describes third-party risk management only at a high level and includes no qualifying domain-specific technical terms, firm-specific organizational details, or verifiable facts.


fact: The company references its ISIRP as the plan that includes responses to third-party cybersecurity threats and incidents.

fact: The vendor management program uses System and Organization Control (SOC) reports in information security reviews.

reasoning: This paragraph primarily explains how the company manages cybersecurity risk from vendors and other external providers, making Third-Party Risk the best fit. Specificity rises to Firm-Specific because it names the ISIRP, and it also includes domain-adapted detail through use of SOC reports.


reasoning: The paragraph primarily addresses how cybersecurity relates to financial risk mitigation by noting the existence and limits of cyber risk insurance, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts beyond a generic insurance statement, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that past cyber incidents did not have a material adverse effect on the company's business strategy, operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the cross-reference to Item 1A is boilerplate.


fact: The company experienced a ransomware attack

fact: The attack occurred in May 2020

fact: A cybercriminal removed a copy of a subset of data

fact: The data was taken from the company’s self-hosted environment

fact: The company is currently subject to legal proceedings, claims, and investigations related to the Security Incident

reasoning: This paragraph primarily discloses a real cybersecurity incident, including its nature, timing, and consequences, so Incident Disclosure is the best fit. Specificity reaches Quantified-Verifiable because it includes a concrete incident type and a specific date ('May 2020'), along with distinct factual details about data exfiltration and resulting legal matters.


fact: The company completed its forensic investigation on December 13, 2023.

fact: An unauthorized third party accessed certain company systems.

fact: The intruder deployed malware that was not self-propagating.

fact: Certain data was exfiltrated.

fact: The last confirmed date of unauthorized third-party activity in the network was November 20, 2023.

reasoning: This paragraph primarily describes what occurred in a real cybersecurity incident, including the nature of the intrusion, malware deployment, data exfiltration, and the incident timeline, so it is Incident Disclosure. Specificity is Quantified-Verifiable because it includes concrete incident dates that could be independently checked, along with technical incident details such as malware deployment and data exfiltration.


fact: The company announced the cybersecurity incident on October 28, 2023.

fact: The incident impacted certain internal operations and information technology systems and adversely affected the company’s ability to ship orders in the first quarter of fiscal 2024.

fact: All facilities were operational by mid-December 2023 and had returned to normalized operations.

fact: The company incurred $1.5 million of expenses related to the cybersecurity incident in the first fiscal quarter of fiscal 2024.

reasoning: This paragraph primarily describes a real cybersecurity incident, including when it was announced, what operations were affected, when operations normalized, and the related costs, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes concrete dates and a specific dollar amount tied to the incident.


fact: The Cybersecurity Committee is primarily responsible, along with executives and IT management, for assessing and managing material risks from cybersecurity threats.

fact: Cybersecurity risk management is overseen by a senior IT executive.

fact: The senior IT executive has ten years of cybersecurity experience.

fact: The senior IT executive has thirty-five years of experience in technology domains including IT Infrastructure, Cloud, Cybersecurity, and Application Development.

reasoning: This paragraph primarily describes how management is organized and who within management is responsible for cybersecurity oversight, including the Cybersecurity Committee and a senior IT executive, so Management Role is the best fit. Specificity is Quantified-Verifiable because it includes hard, externally checkable experience claims of ten years in cybersecurity and thirty-five years in technology domains.


reasoning: This paragraph is a cross-reference to Risk Factors and contains only hypothetical/forward-looking language about possible adverse effects, not a substantive cybersecurity governance, management, process, third-party, incident, or strategy assessment disclosure. Because it provides no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that the company is not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition, which fits Strategy Integration. Its language is broad and hypothetical, with no qualifying domain-specific, firm-specific, or externally verifiable facts beyond standard risk-factor boilerplate.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and other external service providers, making Third-Party Risk the best fit. Its language is high-level and generic—contractual requirements for risky third parties is common boilerplate and does not include domain-specific cyber practices, firm-unique structures, or verifiable facts.


reasoning: The paragraph primarily gives a cybersecurity materiality assessment—stating that the company is not aware of cyber risks or incidents during 2024 that have materially affected or are reasonably likely to materially affect its business, results, or financial condition—which fits Strategy Integration under the materiality rule. The added third-party sentence is generic vendor oversight language, and the paragraph contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity is Generic Boilerplate.


fact: The paragraph describes cybersecurity incident response across the lifecycle of identifying, protecting from, detecting, responding to, and recovering from incidents

fact: The company maintains a cybersecurity and incident response program

reasoning: The paragraph primarily explains how the company’s cybersecurity incident response program operates, including escalation, coordination, tracking, and testing, which makes it a Risk Management Process disclosure rather than a management-organization paragraph. Its specificity rises above boilerplate because it uses cybersecurity-specific incident response lifecycle terminology, but it lacks qualifying firm-unique names or externally verifiable facts.


reasoning: This is a high-level introductory statement about the company’s commitment to a secure trading environment, but it does not describe board oversight, management roles, cybersecurity processes, third-party risk, incidents, or business impact. Because it contains no qualifying domain-specific, firm-specific, or verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality-oriented assessment that the company has not had any known material cybersecurity incidents, which falls under Strategy Integration rather than describing an actual incident or a risk management process. Its specificity remains Generic Boilerplate because the dated statement is still a negative self-assertion and the rest is standard cautionary language and a risk-factor cross-reference, with no qualifying domain, firm-specific, or verifiable facts.


reasoning: The paragraph primarily gives a materiality assessment that cybersecurity risks and prior incidents have not materially affected, and are not reasonably likely to materially affect, the company's business strategy, results of operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the statements are generic and include a non-verifiable negative assertion about lack of material effect.


reasoning: The paragraph primarily gives a backward-looking materiality/impact assessment, stating that the company is not aware of cybersecurity incidents that materially impaired operations or financial reporting, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; this is a generic negative assertion and remains Generic Boilerplate.


fact: The cybersecurity program is designed and assessed based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF).

fact: NIST CSF

reasoning: The paragraph primarily describes how the company structures its cybersecurity risk management program, specifically the framework it uses to identify, assess, and manage cyber risks, so it fits Risk Management Process. Specificity is Domain-Adapted because it cites the NIST CSF, a recognized cybersecurity framework, but does not include firm-unique organizational details or externally verifiable quantified claims.


fact: The Risk Committee of the Board of Directors provides oversight for cybersecurity and other information technology risks.

reasoning: The paragraph primarily describes how the board oversees cybersecurity risk, specifically delegating that oversight to a board-level Risk Committee, so it is Board Governance. Its specificity rises above boilerplate because it identifies a company-specific named board committee, but it includes no externally verifiable quantified claim.


reasoning: The paragraph primarily provides a materiality assessment about whether known cybersecurity threats have affected or are reasonably likely to affect the company’s operations, strategy, results, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the negative assertion and generic cross-reference do not elevate specificity.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk from third parties, making Third-Party Risk the best fit. Its language is high-level and generic, and it does not include qualifying domain-specific controls, distinctive firm-specific details, or externally verifiable facts that would raise specificity above boilerplate.


reasoning: This paragraph is a cross-reference directing readers to risk factor disclosures in Item 1A rather than providing substantive cybersecurity governance, management, process, third-party risk, incident, or strategy disclosure itself. Because it contains no qualifying domain-specific, firm-specific, or externally verifiable cybersecurity facts, its specificity is Generic Boilerplate.


fact: quarterly vulnerability scanning

fact: PCI DSS compliance requirements

fact: annual penetration testing

fact: vulnerability scans as part of the cyber insurance underwriting process

reasoning: The paragraph primarily describes cybersecurity program activities—external assessments, vulnerability scanning, and penetration testing—so it is best classified as Risk Management Process rather than Third-Party Risk. Its specificity is Domain-Adapted because it uses cybersecurity-specific practices and frameworks such as vulnerability scanning, penetration testing, and PCI DSS, but does not include firm-unique or externally verifiable facts.


reasoning: This paragraph does not provide substantive cybersecurity governance, management, process, third-party, incident, or strategy details; it merely cross-references a risk-factor disclosure about potential cyber impacts. Because it contains no qualifying domain-specific, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


fact: The company describes a "layered security model" within its information security program.

fact: The program is designed to ensure the "confidentiality, integrity, and availability" of information systems and data.

reasoning: The paragraph primarily explains what the cybersecurity program does—deploying an information security program with layered protections—so it fits Risk Management Process. Its specificity rises above boilerplate because it uses cybersecurity-specific concepts such as a layered security model and the confidentiality-integrity-availability triad, but it does not include firm-unique roles, committees, or externally verifiable facts.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not expected to significantly affect the business, results of operations, or financial condition, which fits Strategy Integration. It contains no domain-specific cybersecurity terminology, firm-specific organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily gives a materiality assessment, stating that cybersecurity threats and prior incidents have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the negative assertion about no material impact does not elevate specificity.


reasoning: The paragraph primarily provides a business-impact/materiality assessment of cybersecurity matters, stating that cyber threats could materially affect the Partnership and that prior incidents have not had a material adverse effect, which fits Strategy Integration. It does not include qualifying domain-specific technical terms, firm-unique organizational details, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: The Company’s CISO provides cybersecurity updates to the Board’s Audit Committee.

reasoning: This paragraph primarily describes how the Board, through its Audit Committee and related reporting flows, oversees cybersecurity risk, which makes it Board Governance. Specificity rises above boilerplate because it identifies a firm-specific cybersecurity leadership role (the CISO), but it does not include externally verifiable quantitative facts.


reasoning: The paragraph primarily describes efforts to build and improve the company’s cybersecurity program and response capabilities, which fits Risk Management Process rather than third-party risk because the outside parties are assisting the company’s internal program. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts beyond generic references to counsel, service providers, processes, and a response plan.


fact: The company maintains a third party service provider management program.

fact: The company's Risk Management, Legal and/or Information Security Departments review higher risk and material contracts with third party service providers.

fact: The review includes service organization controls reports provided by third parties.

fact: Initial and continuing due diligence is conducted on third party service providers regarding contractual obligations and data security requirements.

reasoning: The paragraph is primarily about how the company evaluates and oversees cybersecurity risks from vendors and service providers, so Third-Party Risk is the best fit. Specificity rises to Firm-Specific because it names the company's internal departments involved in contract review and describes a distinct third-party service provider management program; it also includes domain-adapted detail through reference to service organization controls reports.


fact: Visa's current CISO

fact: The current CISO has over 30 years of industry experience leading enterprise cybersecurity teams

fact: The current CISO joined Visa in November 2015

fact: Visa's Zero Trust Architecture

fact: VisaNet

fact: Visa's President of Technology

fact: The President of Technology joined Visa in November 2013

fact: The President of Technology has over 30 years of experience leading development, deployment, and operations of technology platforms

reasoning: This paragraph primarily explains how management is organized and qualified to oversee cybersecurity, focusing on the CISO and President of Technology's backgrounds, responsibilities, and roles. Specificity is Quantified-Verifiable because it includes externally checkable claims such as over 30 years of experience and specific join dates, along with firm-specific roles and Visa-specific references like VisaNet.


fact: Security awareness training is provided to educate employees about cybersecurity threats

reasoning: The paragraph primarily describes what the cybersecurity program does—employee training and integration of cyber risk tracking into risk management—so Risk Management Process is the best fit. Its specificity is elevated by the concrete cybersecurity practice of security awareness training, while the ERM language itself is otherwise fairly generic.


fact: The Bank's Information Security Department is led by the Chief Information Security Officer (CISO).

fact: The CISO reports to the Chief Information Officer (CIO).

fact: The Bank has an internal cross-functional Technology and Operations Committee.

fact: The Technology and Operations Committee reports to the Bank's Management Committee.

reasoning: The paragraph primarily describes how management is organized to handle cybersecurity, focusing on reporting lines and management-level committee structure rather than the details of the cybersecurity program itself. Specificity is Firm-Specific because it includes firm-unique organizational facts such as the CISO/CIO reporting relationship and the named Technology and Operations Committee and Management Committee.


reasoning: The paragraph primarily describes the oversight chain for cybersecurity—management identifies material threats and escalates them to the Board, with the Audit Committee overseeing the CEO's role—so Board Governance is the best fit. It contains no qualifying domain-specific terminology, firm-unique cyber roles/committees, or externally verifiable facts; references to the Audit Committee, CEO, and unnamed third-party consultants are too generic to elevate specificity.


reasoning: The paragraph primarily explains how the company oversees cybersecurity risks arising from suppliers, vendors, and service providers, making third-party risk the central topic. It uses only generic oversight language and mentions no qualifying domain-specific terminology, firm-unique structures, or externally verifiable facts, so the specificity remains generic boilerplate.


reasoning: The paragraph primarily addresses the potential business and financial impact of cybersecurity threats, including possible material adverse effects, liability, and reputational harm, and it also includes the negative assertion that the company has not had a cybersecurity incident to date. Its process language is high-level and generic, without domain-specific cybersecurity terminology, firm-specific organizational details, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: The company has a CISO responsible for coordinating cybersecurity risk management activities.

fact: The CISO coordinates with an Executive Steering Committee on cybersecurity matters.

reasoning: The paragraph primarily explains how management is organized to handle cybersecurity—centered on the CISO, the Executive Steering Committee, and internal teams—while board reporting is secondary. Its specificity is Firm-Specific because it includes company-distinct organizational facts such as the CISO role and the named Executive Steering Committee, but no externally verifiable quantitative claim.


fact: vulnerability assessments

reasoning: The paragraph primarily describes how cybersecurity oversight is allocated to the Audit Committee and Board and how information is discussed with management, which is board-level governance. Specificity rises above boilerplate only because it mentions the cybersecurity-specific practice of vulnerability assessments; the other details are largely generic oversight language.


fact: The CISO reports to the full Board on cybersecurity matters.

reasoning: The paragraph primarily explains how the Board oversees cybersecurity risk, including the flow of reporting from management to the Board, which makes Board Governance the best fit. Specificity rises to Firm-Specific because it identifies a company cybersecurity leadership role—the CISO—even though the rest of the paragraph is largely generic oversight language.


fact: The Chief Financial Officer is the primary person responsible for overseeing the company's cybersecurity risk management program.

fact: The Chief Financial Officer has had oversight of the company's cybersecurity and risk management programs since the second half of 2021.

reasoning: The paragraph primarily explains how management is organized for cybersecurity by identifying the CFO as the responsible executive and describing his oversight role and reliance on outside IT support. Specificity is elevated by the firm-specific management role assignment and the time-bound claim that this oversight has existed since the second half of 2021.


reasoning: This paragraph is primarily forward-looking, hypothetical risk language about possible breaches and potential adverse effects, rather than a substantive description of governance, management, risk processes, third-party risk, incidents, or a materiality conclusion. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts, so specificity remains generic boilerplate.


reasoning: The paragraph primarily describes how the board oversees cybersecurity risk, including delegation to and reporting from a board committee, so it is Board Governance. Its language is generic oversight and ERM framing without qualifying domain-specific terminology or allowed firm-specific/verifiable facts, so specificity remains Generic Boilerplate.


reasoning: The paragraph primarily describes an element of the company's cybersecurity program—employee training and awareness—so it fits Risk Management Process. Its language is high-level and generic, with no domain-specific cybersecurity terms that pass the ERM test and no firm-specific or externally verifiable facts.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risk arising from third-party service providers, making Third-Party Risk the best fit. Its language is generic and contains no qualifying domain-specific terminology, firm-unique organizational details, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily explains how the company addresses cybersecurity risks arising from third-party service providers, making Third-Party Risk the best fit. It remains generic boilerplate because it mentions only high-level reliance on third parties and a generic third party risk management program, without any domain-specific controls, firm-unique structures, or verifiable details.


reasoning: The paragraph primarily describes that the Fund and its Adviser have processes and a cybersecurity program in place to assess, identify, and manage cyber risk, which is a risk management process disclosure. Its language is entirely generic and does not include qualifying domain-specific terminology, firm-unique organizational details, or externally verifiable facts.


fact: The Board receives periodic updates from Prudential's CISO.

fact: The Board receives periodic updates from Prudential's CIO.

fact: The Board receives periodic updates from Prudential's Operational Risk Management.

reasoning: This paragraph primarily describes how the Board oversees cybersecurity through periodic briefings, annual updates, and information flow from management, which makes it Board Governance. Its specificity is Firm-Specific because it identifies firm-linked roles and functions involved in reporting to the Board, namely Prudential's CISO, CIO, and Operational Risk Management, but includes no hard verifiable numbers or dates.


reasoning: This paragraph is only a cross-reference directing readers to the Risk Factors section for more information, rather than providing a substantive cybersecurity disclosure itself. Because it contains no qualifying domain-specific, firm-specific, or verifiable cybersecurity facts, its specificity is Generic Boilerplate.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats or incidents did not materially affect and are not reasonably likely to materially affect the partnership’s business strategy, results of operations, or financial condition, which fits Strategy Integration. Its specificity remains Generic Boilerplate because the statement is a standard negative assertion and the years referenced do not make the claim externally verifiable.


reasoning: The paragraph primarily provides a business-impact/materiality assessment by stating that cybersecurity challenges have not materially impaired operations or financial standing, and it also mentions cyber liability insurance. Its details remain generic: the negative assertion is not externally verifiable, the insurance reference is generic rather than firm-specific, and no domain-specific technical terminology or unique organizational facts are provided.


reasoning: The paragraph primarily explains how the company handles cybersecurity risk arising from third-party service providers, making Third-Party Risk the best fit. It remains generic boilerplate because it gives only high-level statements about assessing, communicating, and mitigating threats without any domain-specific security practices, firm-specific structures, or verifiable details.


fact: InfoSec Director regularly updates the eRISC committee on cybersecurity risks and incidents

fact: eRISC committee

fact: direct communication with the CTO for escalation of incidents to the Board

reasoning: The paragraph primarily explains how cybersecurity information flows upward to senior leadership and the Board, which makes it a board oversight/governance description. Its specificity is elevated by firm-unique organizational details, including the InfoSec Director, the named eRISC committee, and the CTO, but it contains no externally verifiable quantified claim.


fact: The information security program is managed by a dedicated CISO.

fact: The CISO has more than 20 years of experience.

fact: The CISO has experience across application and product security, cyber defense, information governance, and information technology compliance.

fact: The RACC appoints the CISO and oversees implementation, monitoring, and testing of the information security program.

reasoning: The paragraph primarily describes the board-level oversight structure: the RACC appoints and oversees the CISO, receives regular reporting, and is part of the escalation path for incidents, so Board Governance is the best fit. Specificity reaches Quantified-Verifiable because it includes the externally checkable claim that the CISO has more than 20 years of experience, along with firm-specific roles and committee details.


fact: The security team is led by a Chief Information Security Officer (CISO).

reasoning: The paragraph primarily describes management organization and responsibility by identifying the CISO as the leader of the security team and outlining that role’s responsibilities. Its specificity is elevated to Firm-Specific because it includes the firm-specific leadership role of Chief Information Security Officer, but no quantified or externally verifiable facts are provided.


reasoning: The paragraph primarily describes how the company’s cybersecurity program uses outside experts to evaluate and improve its internal risk management processes, which fits Risk Management Process rather than Third-Party Risk because the third parties are service providers, not vendors being overseen. It remains generic boilerplate because it gives no firm-specific details, named frameworks, tools, roles, vendors, dates, or other verifiable cybersecurity facts.


fact: On October 3, 2024, the Company identified unauthorized activity within its information technology computer networks and systems.

fact: The unauthorized activity identified on October 3, 2024 was determined to be the result of a cybersecurity incident.

reasoning: The paragraph primarily answers what happened in a real cybersecurity event by identifying a specific incident, its timing, and the nature of the activity, so Incident Disclosure is the best fit. Specificity is Quantified-Verifiable because it includes a concrete incident date and a definite claim that unauthorized activity was determined to be a cybersecurity incident.


reasoning: The paragraph primarily describes what the cybersecurity program does—maintaining and periodically testing incident response and recovery plans—so it fits Risk Management Process. However, it uses generic process language without domain-specific technical terms, firm-specific structures, or verifiable details, so specificity remains Generic Boilerplate.


reasoning: This paragraph is a generic statement that the company relies on IT systems and that failures could harm the business; it does not describe cybersecurity governance, management, processes, third-party risk, a real incident, or a materiality assessment. It contains no domain-specific cybersecurity terminology, firm-specific organizational facts, or verifiable claims, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily gives a business-impact/materiality assessment of cybersecurity risks and notes cyber insurance, so it is best classified as Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the insurance reference is generic and the negative materiality assertion is not independently verifiable.


reasoning: The paragraph is primarily about how the company manages cybersecurity risk arising from vendors, suppliers, and other external partners, so Third-Party Risk is the best fit. Its language is generic and does not include qualifying cybersecurity domain terms, firm-unique organizational details, or externally verifiable facts, so specificity remains Generic Boilerplate.


fact: The company is an externally managed company and relies on its Manager's information systems for day-to-day operations.

fact: The company relies on its Manager's processes for assessing, identifying, and managing material risks from cybersecurity threats.

fact: All of the company's executive officers are executive officers, directors, and employees of Bimini.

reasoning: The paragraph is primarily about dependence on an external manager for cyber-related systems and risk processes, making third-party cyber reliance the central topic. Specificity rises because it includes firm-specific organizational facts and names Bimini, an externally identifiable firm, which makes the disclosure externally checkable.


reasoning: The paragraph is a generic statement that the company may face cybersecurity-related risks and depends on system security, but it does not describe oversight, management roles, risk processes, third-party risk, a real incident, or a materiality assessment. Because it contains no qualifying domain-specific, firm-specific, or verifiable facts, its specificity is Generic Boilerplate.


fact: In 2021, the Bank was the target of a ransomware attack

fact: The incident involved an external actor illegally accessing and/or acquiring certain data on the Bank's network

fact: The Bank was sued in a purported class action lawsuit as a result of the attack

fact: The lawsuit is in the process of settlement, subject to final court approval

fact: ransomware attack

reasoning: The paragraph primarily describes an actual cybersecurity event—its occurrence, nature, and resulting litigation—so Incident Disclosure is the best fit. Specificity reaches Quantified-Verifiable because it includes a time-bound incident claim ('In 2021') and concrete, externally checkable statements about the ransomware attack and related class action lawsuit.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors and service providers, making Third-Party Risk the best fit. Its descriptions of pre-engagement assessment and contractual cybersecurity requirements are generic and do not include domain-specific terminology, firm-unique structures, or externally verifiable details.


fact: The cybersecurity program is designed and assessed based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

fact: NIST CSF

reasoning: The paragraph primarily describes how the company structures its cybersecurity risk management program, specifically the framework it uses to identify, assess, and manage cyber risks, so it is a Risk Management Process paragraph. Specificity is Domain-Adapted because it references the named cybersecurity framework NIST CSF, but it does not include firm-unique roles/committees or externally verifiable quantified claims.


reasoning: The paragraph primarily gives a materiality assessment about whether cybersecurity threats have affected or are reasonably likely to affect the company’s business and financial outcomes, which fits Strategy Integration. Its statements are generic and include only a non-verifiable negative assertion plus a cross-reference, so there are no qualifying specificity-elevating facts.


reasoning: The paragraph primarily describes how management is organized to handle cybersecurity by assigning responsibilities to the Chief Financial Officer and Head of IT. It does not include qualifying domain-specific cybersecurity terminology that passes the ERM test, firm-specific roles that count under the rules, or externally verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes a cybersecurity activity the company undertook—external assessments of its network and IT environment and resulting upgrades—so it is best classified as Risk Management Process rather than Third-Party Risk. Its details remain generic because the firms are unnamed and the activities described (cyber risk assessment, network upgrades, comprehensive assessment) do not add qualifying domain-specific, firm-specific, or externally verifiable facts under the rubric.


fact: timely incident detection

fact: containment

fact: remediation

reasoning: The paragraph primarily describes elements of the company’s cybersecurity program—how incidents are detected and handled—so it fits Risk Management Process. Its specificity rises above boilerplate because it references cyber-operational concepts such as incident detection, containment, and remediation, but it includes no firm-specific roles, committees, dates, numbers, or other verifiable details.


reasoning: The paragraph primarily describes how cybersecurity-related risk information flows to the board and when the board would be informed, which is board oversight/governance. It does not include qualifying domain-specific terminology, firm-specific cybersecurity roles or committees, or externally verifiable facts, so specificity remains generic boilerplate.


fact: The company has a Cybersecurity Steering Committee

fact: The CISO serves as chair of the Cybersecurity Steering Committee

fact: The Board of Directors receives regular updates and reports on cybersecurity risks, threats, incidents, and trends

reasoning: The paragraph primarily explains how cybersecurity information flows to and is overseen by the board, including board updates, education, and director expertise, so Board Governance is the best fit. Specificity is Firm-Specific because it includes company-specific governance structures and roles such as the Cybersecurity Steering Committee and the CISO's chair role, but no hard externally verifiable numbers, dates, or named outside entities.


fact: The company states it does not carry a separate cybersecurity commercial insurance policy covering potential financial losses from a cybersecurity incident.

reasoning: The paragraph primarily provides a materiality assessment of cybersecurity incidents and discusses cybersecurity insurance, both of which address how cybersecurity affects the business and finances. Its specificity rises above boilerplate because it includes a company-specific claim about the absence of separate cyber insurance, but it does not include externally verifiable dates, numbers, or named third parties.


reasoning: The paragraph primarily explains how the company manages cybersecurity risk from vendors by requiring third-party service providers to maintain security measures and report suspected breaches. It contains no qualifying domain-specific terminology, firm-unique structures, or externally verifiable facts, so the specificity remains generic boilerplate.


fact: The Advisory Committee of the Board of Managers has oversight responsibility for cybersecurity risks and incidents and reports findings and recommendations to the full Board of Managers.

reasoning: This paragraph primarily describes how the board oversees cybersecurity, including delegation to a board committee and reporting up to the full board, so it is Board Governance. Specificity is Firm-Specific because it identifies a non-generic board committee—the Advisory Committee—as part of the company’s oversight structure, but it does not provide externally verifiable dates, numbers, or named certifications/firms.


reasoning: The paragraph primarily describes one component of the company's cybersecurity program—using outside parties to help assess or test cybersecurity controls—so it fits Risk Management Process rather than Third-Party Risk. It contains no qualifying domain-specific terminology beyond generic process language and no firm-specific or verifiable facts, so specificity is Generic Boilerplate.


reasoning: The paragraph primarily describes what the company's cybersecurity program does—risk assessments, backups, external assistance, and awareness training—so it is best categorized as Risk Management Process. Its language remains high-level and generic, with no qualifying domain-specific terms, firm-unique organizational details, or externally verifiable facts that would raise specificity above boilerplate.


reasoning: This paragraph provides only generic background about cyber threats in general and does not describe the company's governance, management, risk processes, third-party risk, strategy impact, or any actual incident. It contains no qualifying domain-specific, firm-specific, or verifiable facts, so specificity is Generic Boilerplate.


fact: The cybersecurity program includes penetration testing.

fact: The cybersecurity program includes offensive testing.

fact: The program includes regular cyber phishing tests to measure employee awareness of phishing threats.

reasoning: The paragraph primarily describes what the cybersecurity program does—assessments, incident response preparation, employee training, and monitoring—so it is best categorized as Risk Management Process rather than Third-Party Risk. Its specificity is Domain-Adapted because it uses cybersecurity-specific practices such as penetration testing, offensive testing, and phishing tests, but does not include firm-unique roles/committees or externally verifiable facts.


reasoning: The paragraph primarily describes the company's general approach to maintaining and updating cybersecurity safeguards, which fits risk management process. Its language is highly generic, and the mention of unnamed third-party consultants does not add firm-specific, domain-adapted, or verifiable detail.


reasoning: The paragraph primarily explains how the company depends on and evaluates third-party service providers' cybersecurity protections, making third-party risk the central topic. It does not include qualifying domain-specific cybersecurity terminology, firm-unique cyber governance details, or externally verifiable claims, so specificity remains generic boilerplate.


fact: Chief Information Security Officer is primarily responsible for assessing and managing cybersecurity risks

fact: Chief Information Security Officer has over 25 years' experience in cybersecurity

fact: Chief Technology Officer provides oversight of the Chief Information Security Officer

fact: prevention, detection, mitigation, and remediation of cybersecurity incidents

reasoning: The paragraph primarily describes management’s cybersecurity organization by identifying the CISO’s responsibility, reporting oversight, and qualifications, so it is best categorized as Management Role. Specificity reaches Quantified-Verifiable because it includes the externally checkable claim that the CISO has over 25 years of cybersecurity experience, along with firm-specific executive roles and some domain terminology.


fact: The company's virtual Chief Information Security Officer (vCISO) compiles the summary

reasoning: The paragraph primarily explains how cybersecurity-related information flows to management and the Board, which makes it a board oversight/governance disclosure rather than a process description. Its specificity is elevated by the firm-specific leadership role of a vCISO; the rest of the language about quarterly summaries and third-party risk is otherwise fairly generic.


fact: The information security team is led by the Chief Information Security Officer (CISO)

fact: The CISO has served in the role since 2015

fact: The CISO has experience in application security

fact: The CISO has experience in intrusion detection

fact: The CISO has experience in penetration testing

fact: The CISO has experience in complex threat modeling

fact: The CISO has experience in unconventional cyber-attack vectors

fact: The CISO oversees a team of information security professionals devoted full time to cybersecurity threat management

fact: The CISO attends meetings of the RCOC to brief members on information security matters and cybersecurity risks

reasoning: The paragraph primarily explains how management is organized for cybersecurity, focusing on the CISO’s role, qualifications, and reporting responsibilities, so Management Role is the best fit. Specificity reaches Quantified-Verifiable because it includes an externally checkable tenure claim ('since 2015'), along with firm-specific details such as the CISO role and the RCOC.


fact: continuous system monitoring

fact: threat detection

fact: cybersecurity assessments using third-party service providers

reasoning: The paragraph primarily describes how the company’s cybersecurity program operates—using employees and outside firms for monitoring, threat detection, assessments, and mitigation support—so Risk Management Process fits best. Specificity is Domain-Adapted because it includes cybersecurity-specific practices such as continuous system monitoring and threat detection, but does not provide firm-unique roles, committees, dates, numbers, or other externally verifiable facts.


fact: On July 10, 2024, the company detected unauthorized occurrences on a portion of its information technology systems.

fact: The company believes the threat actor was ejected from its IT systems on July 10, 2024.

reasoning: This paragraph primarily describes an actual cybersecurity event, including detection, containment, remediation, and the timing of response, so it is best classified as Incident Disclosure. Its specificity is Quantified-Verifiable because it includes concrete, externally checkable dates tied to the incident.


reasoning: The paragraph primarily provides a materiality assessment, stating that cybersecurity threats and incidents have not materially affected and are not reasonably likely to materially affect the company’s business strategy, results of operations, or financial condition, which fits Strategy Integration. It contains no qualifying domain-specific, firm-specific, or externally verifiable facts; the negative assertion and cross-reference do not elevate specificity.


fact: The company is continuously hardening its environment, systems, and infrastructure to reduce vulnerability to attack.

reasoning: The paragraph primarily describes activities within the cybersecurity program—internal audits, readiness evaluation, environment hardening, and employee training—so it is best categorized as Risk Management Process. Its specificity rises above boilerplate because it uses the cybersecurity-specific concept of hardening systems and infrastructure, but it lacks firm-specific roles, committees, numbers, dates, or other verifiable details.


fact: access controls

fact: firewalls

fact: vulnerability management processes

fact: patch management processes

fact: phishing tests

reasoning: The paragraph primarily describes the company’s cybersecurity program activities and safeguards—i.e., what controls and processes it uses to manage cyber risk—so it fits Risk Management Process. Its specificity is Domain-Adapted because it includes cybersecurity-specific technical measures such as firewalls, intrusion detection and prevention systems, vulnerability/patch management, and phishing tests, but no firm-unique or externally verifiable facts.


fact: The CIO is responsible for implementing the company's cybersecurity program

reasoning: The paragraph primarily describes how management is organized to execute cybersecurity responsibilities: the CIO leads the program, coordinates with other executives, and uses the CIO's team and management communications to handle threats and incidents. Specificity rises to Firm-Specific because it includes the firm-specific leadership role of the CIO; the remaining language about incident response, monitoring, and reporting is otherwise generic.