fact: system alerts of potential malicious cyber activity

fact: real-time dashboards that monitor and assess our systems

fact: potential new attack vectors and vulnerabilities

fact: Mr. Dennis

fact: Director of Information Technology

fact: since June 2019

fact: over 20 years of experience in the data management space

reasoning: Paragraph primarily describes cybersecurity monitoring processes (alerts, dashboards, reports, provider communications) that remain substantive after person-removal test, making it RMP over MR despite leadership bio; mixed but process details dominate text. Specificity reaches Quantified-Verifiable due to verifiable facts like 'June 2019' start date and 'over 20 years' experience, plus domain terms and firm-specific elements like named individual.


content_category: Management Role

fact: CSO

category_confidence: high

specificity_confidence: high

reasoning: Paragraph primarily describes the CSO's role and responsibilities in implementing the cybersecurity program, along with executive leadership and multidisciplinary teams, answering 'How is management organized?' (MR per person-removal test, as it focuses on roles over program activities). Specificity driven by firm-specific named role 'CSO' (Level 3), with no domain terms or verifiable facts elevating higher.

provider: x-ai

stage: benchmark


content_category: Risk Management Process

fact: vulnerability scans

fact: penetration tests

reasoning: The paragraph primarily describes the cybersecurity program's activities including risk assessment, tools/methodologies testing, monitoring, vulnerability scans, and penetration tests, directly answering 'What does the cybersecurity program do?' (RMP). Specificity reaches Domain-Adapted due to cybersecurity-specific practices like vulnerability scans and penetration tests that demonstrate domain expertise beyond generic ERM language.


fact: NSA's Cybersecurity Collaboration Center

fact: CISA's Critical Partnership

fact: FBI InfraGard

fact: U.S. Coast Guard Area Maritime Security Committees and Cybersecurity Subcommittees

fact: Cyber-Hawaii Maritime Transportation System Information Sharing and Analysis Center (MTS-ISAC)

category_confidence: medium

reasoning: Paragraph lists specific cybersecurity collaboration centers and partnerships (e.g., NSA CCC, FBI InfraGard, MTS-ISAC), primarily describing elements of the cybersecurity program such as threat intelligence sharing, fitting Risk Management Process over other categories like Third-Party Risk (not vendors) or None/Other (substantive cyber measures). Specificity is Domain-Adapted due to multiple domain-specific terms passing the ERM test (cybersecurity-specific entities not naturally used by general ERM professionals), with no firm-specific or verifiable facts.


reasoning: Paragraph describes the company's cybersecurity strategy and processes for assessing, identifying, and managing risks, including use of third-party specialists for internal reviews, which aligns with Risk Management Process as the central topic (third-party assessors are internal program components per Rule 3). No domain-specific terminology, firm-specific details, or verifiable facts present, resulting in Generic Boilerplate specificity.


fact: National Institute of Standards and Technology (NIST)

type: framework

fact: Center for Internet Security Controls (CIS Controls)

reasoning: Paragraph describes the cybersecurity program's adoption of specific frameworks like NIST and CIS Controls, directly answering 'What does the cybersecurity program do?' under Risk Management Process. Specificity is Domain-Adapted due to named cybersecurity frameworks that demonstrate domain expertise beyond generic ERM language.


content_category: None/Other

reasoning: This paragraph discusses regulatory oversight by federal banking agencies and cross-references another section, which fits None/Other as it provides no substantive cybersecurity disclosure on internal processes, governance, or incidents. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


content_category: Strategy Integration

reasoning: The paragraph primarily states conclusions about the lack of material past or likely future impacts from cybersecurity incidents on business outcomes and mentions insurance, directly answering a Strategy Integration question per materiality rule. No domain terms passing ERM test, firm-specific facts, or verifiable claims (negative assertions are not verifiable), resulting in Generic Boilerplate specificity.


content_category: Board Governance

reasoning: Paragraph describes oversight flow from IT employee to CEO to Board, answering 'how does the board oversee cybersecurity?' via governance chain, defaulting to BG per Rule 1. No domain terms passing ERM test, no firm-specific roles beyond generic CEO/Board, and no verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states that past cybersecurity incidents have not materially affected the company, directly answering how cybersecurity affects business outcomes (SI per Rule 5 backward-looking materiality). No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


content_category: Incident Disclosure

fact: experienced a single cybersecurity event in June of 2023

fact: unauthorized third party gained access to the email accounts of two of our employees

type: quantified

fact: notified the affected customers of the incident in early September 2023

fact: incurred expenses of approximately $25,000 related to the cybersecurity incident

reasoning: The paragraph primarily describes a specific cybersecurity incident including its nature (unauthorized access to two employees' email accounts), timing (June 2023 detection, early September 2023 notification), remediation, and costs, directly answering 'What happened in a cybersecurity incident?' (Incident Disclosure). Specificity reaches Quantified-Verifiable due to multiple verifiable facts like specific dates (June 2023, early September 2023) and quantified elements (two employees, ~$25,000 expenses).


fact: On February 23, 2023, DISH Network experienced a network outage that affected its internal servers and IT telephony

fact: On February 28, 2023, we further disclosed that certain data had been extracted from the DISH Network IT systems

reasoning: The paragraph primarily describes a specific past cybersecurity incident including timing, nature (network outage, data extraction), response (incident plans, experts, law enforcement notification), fitting Incident Disclosure over Strategy Integration as the event details dominate. Specificity reaches Quantified-Verifiable due to two specific dates tied to verifiable events, listed in specific_facts.


fact: threat actors

fact: unlawfully accessed certain computer systems

fact: exfiltrated images of video meetings and computer screens

fact: point of unlawful access

reasoning: Paragraph details a specific cybersecurity incident including access, exfiltration, public release due to non-payment of ransom, scope limits, and remediation actions, directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Domain-Adapted due to cybersecurity-specific terminology like 'threat actors,' 'exfiltrated,' and 'point of unlawful access' that demonstrate domain expertise beyond generic ERM language, with no firm-specific roles/committees or quantified verifiable facts like dates/numbers.


fact: The Company's IT Committee

fact: Executive Vice President and Chief Accounting Officer (CAO)

fact: Co-Chief Operating Officer (COO)

reasoning: Paragraph primarily describes board oversight structure, including how management roles brief the board on cybersecurity risks, briefing frequency, and topics covered, fitting Board Governance per Rule 1 governance-chain default. Specificity reaches Firm-Specific due to named IT Committee and VP-level roles like Senior Vice President of Information Technology involved in cybersecurity oversight, with no domain terms or verifiable claims elevating higher.


reasoning: The paragraph primarily describes the incident response plan's purpose and generic components (roles, responsibilities, recovery steps), answering 'What does the cybersecurity program do?' thus fitting Risk Management Process per RMP definition and person-removal test. No domain terms passing ERM test (e.g., 'incident response plan' is generic L1), no firm-specific elements, and no verifiable facts, yielding empty specific_facts and Generic Boilerplate specificity.


fact: Chief Information Security Officer ("CISO")

fact: Chief Risk Officer ("CRO")

fact: over 18 years of experience in information technology leadership

fact: eight years of which is experience in leading information security oversight

reasoning: Paragraph primarily describes management roles (CISO and CRO), their responsibilities, reporting lines, and qualifications, fitting Management Role per person-specific organization focus (MR via Rule 2). Specificity reaches Quantified-Verifiable due to verifiable quantified experience claims ('over 18 years', 'eight years') and firm-specific named roles like CISO and CRO.


fact: DISH TV and SLING TV services remained operational

fact: As of March 31, 2023, all significant systems had been restored

reasoning: This paragraph describes the scope, impact (services operational), timeline (restoration as of March 31, 2023), and conclusion of a specific cybersecurity incident, directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to the verifiable specific date of system restoration and named firm-specific services.


reasoning: The paragraph primarily states a conclusion on cybersecurity's lack of material impact on business strategy, results of operations, or financial condition, directly matching Strategy Integration per materiality rule; the cross-reference to Risk Factors is secondary. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: Chief Information Officer

fact: Information Security Officer

fact: information security team

fact: combined over 35 years of IT management experience

reasoning: Paragraph primarily describes cybersecurity program activities (strategy/policy/standards/architecture, awareness training, third-party risk processes like onboarding assessments and monitoring), passing person-removal test for RMP over MR; third-party is embedded, not central (per Rule 3). Specificity reaches Quantified-Verifiable due to 'over 35 years' experience (verifiable lower bound) and named senior roles/team (L3), with no domain terms elevating to L2 independently.


fact: vulnerability assessments

fact: threat environment

fact: Executive Director of IT

reasoning: This paragraph primarily describes how the Board and Audit Committee oversee cybersecurity risks through reports, presentations, and discussions, directly answering the Board Governance question. Specificity is Firm-Specific due to the named 'Executive Director of IT' role, with supporting domain terms like 'vulnerability assessments' and 'threat environment'.


reasoning: The paragraph primarily states a materiality conclusion about cybersecurity risks not being reasonably likely to materially affect business outcomes, directly answering the Strategy Integration question per the materiality rule. No specific facts elevate specificity: generic references to management, consultants, processes, and risks lack domain terms, firm-unique details, or verifiable claims.


reasoning: This paragraph provides a materiality assessment stating no awareness of material past or likely future cybersecurity incidents affecting business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5. No domain terms, firm-specific facts, or verifiable claims (negative assertions are not externally verifiable) are present, resulting in Generic Boilerplate specificity.


fact: Head of IT reports directly to Chief Financial Officer

fact: over twenty years of experience managing information technology and cybersecurity matters

fact: holds a Master of Science degree in Telecommunications and Computer Networks

fact: Project Management Professional certified

fact: Certified Scrum Master

fact: IT Infrastructure Library certified

reasoning: Paragraph primarily describes the Head of IT's reporting line, qualifications, experience, and responsibilities with senior leadership for managing cybersecurity risks, fitting Management Role despite ERM and materiality touches; specificity driven by multiple verifiable facts like quantified experience, specific degree, and named certifications elevating to Quantified-Verifiable.


fact: On February 23, 2023, we experienced a network outage that affected its internal servers and IT telephony

fact: On February 28, 2023, we further disclosed that certain data had been extracted from the DISH Network IT systems

fact: network outage affecting internal servers and IT telephony

fact: data extracted from DISH Network IT systems

reasoning: This paragraph primarily describes a real cybersecurity incident including timing (Feb 23 and 28, 2023), nature (network outage, data extraction), scope (internal servers, IT telephony, DISH systems), and response (incident plans, experts, law enforcement) → Incident Disclosure. Specificity is Quantified-Verifiable due to specific dates and verifiable event details like affected systems.


reasoning: This paragraph is a cross-reference to Item 1A risk factors with vague mentions of general risks and unspecified past threats, fitting None/Other as it lacks substantive cybersecurity disclosure or measures. No specific facts of any level are present, confirming Generic Boilerplate specificity.


reasoning: Paragraph mentions generic use of third-party IT services for operations and exploration of vendors for cybersecurity without describing oversight, requirements, processes, or any substantive cybersecurity program element, making it None/Other per Rule 6. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes generic cybersecurity processes integrated into ERM, directly answering 'What does the cybersecurity program do?' (RMP); no domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


content_category: Third-Party Risk

fact: reviewing relevant cybersecurity certifications and third-party audit results

fact: assessing technical and organizational controls

reasoning: This paragraph centrally describes the process for assessing cybersecurity risks from third-party suppliers, including specific evidence reviewed like certifications and audits, making Third-Party Risk the primary category. Specificity reaches Domain-Adapted due to domain-specific terms like 'cybersecurity certifications,' 'third-party audit results,' and 'technical and organizational controls' that demonstrate cybersecurity expertise beyond generic risk management.


fact: Interagency Guidance on Third-Party Relationships: Risk Management

reasoning: Paragraph centrally describes the Company's Third-Party Risk Management Program, Vendor Management Policy, onboarding, reviews, and auditing for vendor risks, directly answering how third-party risks are managed → Third-Party Risk. Specificity at Domain-Adapted due to named regulatory framework (Interagency Guidance) demonstrating cybersecurity domain expertise beyond generic ERM language.


fact: targeted by a complex criminal scheme in March 2023

fact: $2.7 million of loss, net with funds recovered, and professional fees

fact: independent forensic investigation

fact: see Note 18 to the accompanying consolidated financial statements

reasoning: Paragraph details a real cybersecurity incident (March 2023 fraud scheme, discovery, response, investigation, $2.7M loss), directly answering 'what happened' for Incident Disclosure. Specificity is Quantified-Verifiable from verifiable facts like the specific date, quantified loss amount, and financial note reference, plus domain term 'forensic investigation'.


reasoning: Paragraph describes information flow and escalation from cybersecurity team through CFO to CEO, senior management, Audit Committee, and Board, primarily answering how the board oversees cybersecurity via governance-chain structure (BG per Rule 1). No domain terminology passing ERM test, no firm-specific roles/committees beyond generics (CFO, CEO, Audit Committee), and no verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes third-party involvement in the company's internal risk assessment, policy design, implementation, monitoring, and testing, which are core cybersecurity program activities (RMP per Rule 3, as these are hired assessors/service providers, not supply chain vendors). No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: managed security service monitoring

fact: penetration testing

fact: vulnerability assessment

fact: Management Enterprise Risk Committee

fact: Vendor Management Committee

reasoning: The paragraph centrally describes vendor oversight processes including due diligence, risk assessments, contractual requirements, and committees managing third-party cyber risks, directly answering 'How are third-party cyber risks managed?' Named committees (Management Enterprise Risk Committee, Vendor Management Committee) elevate to Firm-Specific, with domain terms like penetration testing providing supporting detail but not exceeding Level 3.


fact: IT Committee

reasoning: Paragraph primarily describes oversight by the IT Committee, including meeting frequency ('regularly') and scope (improvements, security layers, new technologies), answering 'How does the board/committee oversee cybersecurity?' per BG definition and Rule 1 governance-chain default. Specificity reaches Firm-Specific due to the named non-generic 'IT Committee'; no domain terms pass ERM test and no verifiable facts present.


reasoning: The paragraph primarily describes the cybersecurity program's components (mechanisms, controls, etc.) and activities (assessing, identifying, managing risks) with external advisors, answering 'What does the cybersecurity program do?' and classifying as Risk Management Process per person-removal test showing substantive program details remain. No domain terminology passing ERM test, firm-specific elements, or verifiable facts present anywhere, yielding Generic Boilerplate specificity.


reasoning: This paragraph provides generic boilerplate about handling sensitive information, its importance to business, and existence of a vague 'cybersecurity program' without answering any substantive category question like oversight structure, roles, processes, or incidents. No specific facts, domain terms passing ERM test, firm-specific details, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: vulnerability assessments

fact: In January 2024, our board of directors participated in a cybersecurity training session

reasoning: Paragraph primarily describes board and audit committee oversight of cybersecurity risks, including delegation, updates, engagements, and training, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity reaches Quantified-Verifiable due to the specific dated training session (January 2024), with domain term 'vulnerability assessments' also present.


fact: Security & Technology Committee

reasoning: This paragraph describes how the Board and its Security & Technology Committee receive information on cybersecurity incidents, directly answering the Board Governance question about oversight and information flow. The named 'Security & Technology Committee' is a firm-specific fact elevating specificity to Firm-Specific; no domain terms or verifiable claims present.


fact: ISO

reasoning: This paragraph describes how the ISO reports to the board annually on program status, compliance, and material findings, directly answering the Board Governance question of oversight structure, briefing frequency, and information flow to the board. Specificity reaches Firm-Specific due to the named cybersecurity role 'ISO' and reference to the specific regulatory framework 'Interagency Guidelines for Safeguarding Customer Information'.


fact: Chief Information Officer

reasoning: This paragraph describes board-level oversight of cybersecurity risks, including update frequency and content from the CIO, directly answering 'How does the board oversee cybersecurity?' (BG per governance-chain rule). Specificity reaches Firm-Specific due to the named CIO role (Level 3 fact), with no higher verifiable claims or domain terms passing the ERM test.


reasoning: Paragraph centrally describes third-party cybersecurity risk assessment, contractual addendums, and remediation with suppliers, directly answering 'How are third-party cyber risks managed?' per TP category and Rule 3. No domain terms passing ERM test (e.g., 'backdoor' is incidental, not elevating vocabulary to expertise), no firm-specific facts, no verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: This paragraph states a conclusion about no material past or reasonably likely future cybersecurity impacts on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments). No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


fact: Information Security Officer

fact: Information Technology Steering Committee

reasoning: Paragraph primarily describes the Information Security Officer's role, responsibilities, and reporting lines to management and board committees, fitting Management Role per person-removal test and Rule 1 (focus on management organization over board oversight structure). Specificity reaches Firm-Specific due to named cybersecurity leadership role (ISO) and named IT Steering Committee, with no domain terms or verifiable claims elevating further.


reasoning: This paragraph describes the Audit Committee's oversight of cybersecurity risks and receipt of periodic reports from management, directly answering the Board Governance question about board oversight structure. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: Software Approval Board

fact: cross-functional members from Quality, Internal Audit, Information Security, Business Systems, and R&D

reasoning: The paragraph primarily details diligence, monitoring, software evaluation via a board, and contractual requirements for high-risk third parties providing software or access, centrally addressing third-party cyber risk management (TP). Specificity is Firm-Specific due to the named 'Software Approval Board' and its composition from specific departments like Information Security.


fact: services agreement with LMC

fact: Information Security Steering Committee ("ISSC")

fact: executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments

reasoning: Paragraph describes the establishment and composition of a management-level Information Security Steering Committee (ISSC) with executives from specific departments, focusing on organizational structure and oversight responsibilities, fitting Management Role per Rule 1 (management committee structure/membership). Specificity reaches Quantified-Verifiable due to the named firm LMC and named committee ISSC with detailed team composition.


reasoning: The paragraph primarily describes evaluation, monitoring, contractual requirements, and onboarding processes for third-party vendors' cybersecurity risks, making Third-Party Risk the central topic over Risk Management Process per Rule 3 (requirements imposed ON vendors). No domain terms passing the ERM test, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph states a conclusion on no material past impacts from cybersecurity incidents ('no such incident has had any such impact to date') and cross-references risks likely to materially affect business outcomes, directly matching SI materiality rule 5; contains only generic speculation, boilerplate phrases, and cross-references with no domain terms, firm-specific facts, or verifiable claims.


fact: successful phishing attempt in 2019

fact: phishing

reasoning: Paragraph primarily describes a real past cybersecurity incident (phishing attempt in 2019 with no material losses), fitting Incident Disclosure despite the trailing forward-looking materiality statement that pulls toward Strategy Integration; mixed but incident frame dominant per Rule 4. Specificity reaches Quantified-Verifiable due to the verifiable specific year (2019) tied to the event, with phishing as a supporting domain term.


reasoning: This paragraph describes the audit committee's oversight role, reporting frequencies, and information flow to the board, directly answering 'How does the board oversee cybersecurity?' making it Board Governance. No domain terms passing ERM test, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: CISO

fact: CIO

reasoning: Paragraph primarily describes Board and Audit Committee oversight of cybersecurity risks, including semi-annual reviews and periodic updates from specific leaders, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1). Firm-specific named roles (CISO, CIO, Security & Resiliency global practice leader) elevate specificity to Firm-Specific (Level 3); no domain terms or verifiable claims found.


reasoning: The paragraph primarily assesses the past and potential material impact of cybersecurity on business strategy, operations, and financial condition, with backward-looking negative assertions (no material impacts for >5 years, no penalties) and forward-looking statements, fitting Strategy Integration per Rule 5. No specific facts elevate specificity: the '>5 years' timeframe is a soft negative assertion not independently verifiable, and there are no domain terms, firm-specific details, or quantified claims.


reasoning: Paragraph centrally describes due diligence, contractual requirements, and mitigation for third-party cybersecurity risks, directly answering the Third-Party Risk question per Rule 3 (requirements imposed on vendors). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes vendor due diligence, ongoing monitoring of third-party cybersecurity practices, and risk-based assessments, making third-party risk management the central topic despite a brief mention of internal assessments. No domain terms passing the ERM test, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to the Risk Factors section, providing no substantive cybersecurity disclosure, so it fits None/Other. No specific facts, domain terms, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: on June 30, 2024, the Company detected a cybersecurity incident

reasoning: Paragraph details a real cybersecurity incident's detection date, unauthorized access to systems, investigation via external experts, and expenses, directly answering 'What happened?' for Incident Disclosure per rules. Specificity is Quantified-Verifiable from the verifiable specific date tied to the event.


reasoning: The paragraph centrally describes diligence, monitoring, contractual requirements, and audits for third-party service providers' cybersecurity risks, directly answering the Third-Party Risk question and qualifying under TP rules over RMP. No domain terminology passing the ERM test, firm-specific facts (e.g., 'currently none' is a non-verifiable negative assertion), or quantified/verifiable claims found anywhere, yielding Generic Boilerplate.


fact: Third Party Cyber Risk Management Plan

fact: SOC2 T2

fact: penetration testing

fact: ISO 27001 certification

reasoning: Paragraph centrally describes vendor due diligence, assessments, required documentation (SOC2 T2, pen testing, ISO 27001), contractual clauses, and ongoing reviews, making Third-Party Risk the primary category per Rule 3 (requirements imposed on vendors). Specificity reaches Firm-Specific due to the named 'Third Party Cyber Risk Management Plan' (firm-unique program) plus domain terms like SOC2 T2, penetration testing, and ISO 27001, with no verifiable claims like hard numbers or specific dates.


reasoning: Paragraph details audit committee oversight via periodic reports from the CISO on threats, risks, and mitigation processes, directly answering board governance question. Specificity reaches Firm-Specific due to the CISO named role, with no higher verifiable facts.


fact: National Institute of Standards and Technology ("NIST") Cybersecurity Framework

fact: Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbooks

fact: FFIEC Cybersecurity Assessment Tool

fact: Information Technology Officer

reasoning: Paragraph primarily describes the cybersecurity program's objectives, framework alignments (NIST, FFIEC), and review processes, answering 'What does the cybersecurity program do?' (RMP); person-removal test confirms substantive program content remains. Specificity reaches Firm-Specific due to named leadership roles (Information Security Officer, Information Technology Officer), with domain terms like NIST CSF elevating from boilerplate but not to verifiable.


reasoning: Paragraph primarily describes Audit Committee (board-level) oversight via periodic reports on threats, risks, and mitigation processes, fitting Board Governance; the materiality conclusion is secondary. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph focuses on the forward-looking potential material impact of cybersecurity threats on business strategy, results of operations, and financial condition, directly matching Strategy Integration per Rule 5 for 'reasonably likely to materially affect'; it lacks any domain terminology passing the ERM test, firm-specific details, or verifiable facts, making it Generic Boilerplate.


fact: applying vendor-provided software fixes, commonly called patches

fact: vulnerability scanning

fact: intrusion detection tools

reasoning: Paragraph describes specific cybersecurity program activities like patch management, vulnerability scanning, and intrusion detection in response to risks, directly answering 'What does the cybersecurity program do?' (RMP); no roles or governance structure mentioned. Specificity driven by multiple domain terms (patches, vulnerability scanning, intrusion detection) that demonstrate cybersecurity expertise beyond generic ERM language, reaching Domain-Adapted with no firm-specific or verifiable facts.


reasoning: Paragraph primarily describes management of cyber risks from third-party technology providers through outreach to ascertain downstream implications of known breaches, making Third-Party Risk the central topic per category rules (vendor oversight as focus, not general program). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes the Audit Committee's oversight of cybersecurity risks, including periodic updates and notifications from the Chief Business Officer and a consultant, directly answering 'How does the board oversee cybersecurity?' with no substantive cybersecurity measures; no domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph states a conclusion about no material cybersecurity incidents in 2023 affecting business outcomes (backward-looking) and none reasonably likely (forward-looking), directly matching SI materiality rule for assessments; cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph states a conclusion about no material cybersecurity impacts on business strategy, results of operations, or financial condition, directly answering a Strategy Integration question per Rule 5 (backward-looking materiality assessment). No specific facts elevate specificity: negative assertions about absence of material incidents or risks are not verifiable, domain-specific, or firm-unique.


reasoning: Paragraph describes use of third-party providers for cybersecurity containment and remediation, which are internal program activities (third parties serving the company), fitting RMP per Rule 3; no specific facts, domain terms, firm-specific details, or verifiable claims found, resulting in Generic Boilerplate.


fact: Chief Information Officer (CIO)

fact: led the Century Communities IT efforts since 2016

fact: more than 20 years of experience as an IT leader

fact: reports to our Corporate General Counsel

reasoning: This paragraph details the CIO's leadership of the Information Security team, his qualifications, experience, and reporting line, directly answering 'How is management organized to handle cybersecurity?' (Management Role per person-removal test). Specificity is Quantified-Verifiable due to verifiable facts like tenure since 2016 and >20 years experience.


fact: targeted by a complex criminal scheme early in Fiscal 2024

fact: fraudulently-induced outbound wire transfers

fact: $2.7 million of loss, net with funds recovered, and professional fees

fact: independent forensic investigation

reasoning: This paragraph primarily describes a specific past cybersecurity incident including timing, nature (fraudulent wire transfers), response actions, investigation, and financial impact, directly matching Incident Disclosure; incident details dominate over financial framing. Specificity reaches Quantified-Verifiable due to the verifiable $2.7 million loss amount (tied to financial statements) and specific timing ('early in Fiscal 2024').


reasoning: This paragraph describes how management reports cybersecurity risks to the Audit Committee, directly addressing board oversight and information flow, fitting Board Governance per governance-chain rules. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: data encryption

fact: protect our data from the unauthorized incorporation in large language models or other artificial intelligence systems

reasoning: Paragraph primarily describes board oversight via Audit Committee and full Board receiving quarterly and annual reports on cybersecurity, fitting Board Governance per Rule 1 (board-level committee oversight structure), though initial generic measures suggest some RMP overlap. Specificity at Domain-Adapted due to cyber-specific terms like 'data encryption' and AI/LLM data protection passing ERM test, with no firm-specific roles or verifiable facts.


fact: CIO/CDO

reasoning: Paragraph describes board and Audit Committee oversight of cybersecurity risks, reporting frequency, and information flow from CIO/CDO, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1 as board-level). Specificity reaches Firm-Specific due to named VP-level cybersecurity leadership role (CIO/CDO); no domain terms or verifiable facts elevate further.


reasoning: This paragraph directly states a forward-looking materiality assessment ('reasonably likely to materially affect') matching SEC Item 106(b)(2) language, classifying as Strategy Integration per Rule 5. No domain terms passing ERM test, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


fact: subsequent to June 30, 2024

reasoning: Describes board responsibility for cybersecurity oversight and identifies senior management (CEO/CFO) as responsible for practices, qualifying as governance-chain oversight structure under Rule 1 for BG over MR. Specificity reaches Quantified-Verifiable due to the concrete, verifiable date reference 'subsequent to June 30, 2024' tied to management's cybersecurity actions.


fact: Vice President and Chief Information Security Officer (CISO)

reasoning: This paragraph describes board and Audit Committee oversight of cybersecurity risks, including delegation, reporting frequency, and information flow, directly answering the Board Governance question. Specificity reaches Firm-Specific due to the named VP-level CISO role, with no domain terms or verifiable facts present.


reasoning: Paragraph describes board-level oversight and delegation to the Audit Committee, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1); no domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centrally describes oversight of third-party service providers through vendor diligence and risk assessments based on service nature, data/system access, and supply chain risk, making Third-Party Risk the primary category. It lacks any domain terminology passing the ERM test, firm-specific elements like named roles or committees, or verifiable facts such as numbers or dates, warranting Generic Boilerplate specificity.


reasoning: The paragraph primarily details management of third-party cybersecurity risks through diligence, monitoring, contracts, and audits, directly answering the Third-Party Risk question as the central topic per Rule 3 (requirements imposed on vendors). No domain terms passing the ERM test (e.g., generic diligence/audits interchangeable with non-cyber), firm-specific facts, or verifiable claims found anywhere, yielding Generic Boilerplate specificity.


fact: September 14, 2023

fact: social engineering attack

fact: loyalty program database (Data Incident)

fact: state gaming regulators

reasoning: Paragraph describes a real past incident with timing, cause (social engineering via vendor), data affected (loyalty database), detection, and response (IRP activation, notifications, third-party engagement), directly answering 'What happened?' for Incident Disclosure. Specificity is Quantified-Verifiable due to the verifiable date and other concrete details like the named database.


reasoning: This paragraph is a cross-reference to the Risk Factors section, providing no substantive cybersecurity disclosure and matching the N/O category for cross-references per Rule 5 and 6. No specific facts, domain terms, or verifiable claims are present anywhere in the text, resulting in Generic Boilerplate specificity.


fact: February 2023 cyberattack

reasoning: Paragraph primarily assesses the lack of material business/financial impact from the February 2023 cyberattack and third-party incidents, plus forward-looking materiality conclusions, answering how cybersecurity affects business outcomes (SI per materiality rule). Specificity reaches Quantified-Verifiable due to the verifiable specific date of the cyberattack incident.


reasoning: The paragraph primarily describes contractual security requirements and incident reporting instructions imposed on third-party suppliers and subcontractors, making third-party risk management the central topic. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: Kroll conducted a security maturity assessment in November 2022

fact: Kroll (named third-party firm)

fact: past security assessments and penetration tests

fact: documentation regarding network architecture

fact: Century Communities Information Security Team

fact: Information Security Incident Response Policy

fact: tabletop exercises in September 2023

reasoning: Paragraph describes security assessments, document reviews, gap remediation, policy development, and tabletop exercises conducted with Kroll, primarily answering 'What does the cybersecurity program do?' (RMP); third-party assessor integrated into internal program per Rule 3. Specificity reaches Quantified-Verifiable due to specific dates (November 2022, September 2023) and named firm Kroll, with additional domain terms and firm-specific elements like named team and policy.


fact: advanced and persistent threat actors

specificity_confidence: medium

reasoning: Paragraph describes generic cybersecurity threats, potential impacts, and high-level resource expenditure without addressing any core question (no oversight structure, roles, processes, incidents, etc.), fitting None/Other per Rule 6. Specificity at Domain-Adapted due to 'advanced and persistent threat actors' passing ERM test as cyber-specific terminology, with no firm-specific or verifiable facts.


reasoning: The paragraph centrally describes a risk-based approach to identifying, overseeing, and monitoring cybersecurity threats from third-party vendors, service providers, and their systems, directly answering the Third-Party Risk question. No domain-specific terminology, firm-unique facts, or verifiable claims are present; all language is generic and boilerplate.


reasoning: Paragraph details qualifications, degrees, and experience of senior executives (SVPs, CFO, General Counsel, Chief Accounting Officer) in managing risks including cybersecurity, directly answering 'How is management organized to handle cybersecurity?' via credentials and career history (MR per rules). No domain terms passing ERM test, no firm-specific cybersecurity roles/committees/teams, and 'approximately 20 years or more' is a soft/hedged number (not QV), yielding empty specific_facts and Generic Boilerplate.


fact: Kroger's CDO reports to the CEO

fact: Kroger's CDO leads technology and digital capabilities including cybersecurity strategy

fact: Kroger's interim CISO

fact: CDO has over 20 years of experience

fact: interim CISO brings nearly 20 years of experience

fact: master's degree from Ecole Supérieure de Commerce de Chambéry, Rhône-Alpes, France

fact: bachelor's degree from Miami University in management information systems and marketing

reasoning: Paragraph primarily describes management roles, reporting lines, qualifications, and experience of CDO and interim CISO, directly answering 'How is management organized to handle cybersecurity?' (MR per person-removal test); specificity reaches Quantified-Verifiable due to hard facts like 'over 20 years of experience' (lower bound), specific degrees, and named educational institutions verifiable externally.


reasoning: Paragraph centrally describes vendor due diligence, contractual rights, compliance monitoring, and assessments, directly answering how third-party cyber risks are managed (TP per Rule 3). No domain-specific terminology passing ERM test, no firm-specific roles/teams/committees, and no quantified/verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is solely a cross-reference to Item 1A Risk Factors with a quoted heading, providing no substantive cybersecurity disclosure, so it fits None/Other per category rules. It contains no domain terms, firm-specific facts, or verifiable claims, warranting Generic Boilerplate specificity.


fact: National Institute of Standards and Technology (NIST) governance requirements and cybersecurity framework

reasoning: Paragraph primarily describes board-level oversight of cybersecurity risks through the Audit Committee and integration into the broader risk management framework, fitting Board Governance per governance-chain rule. Specificity is Domain-Adapted due to reference to NIST framework as a domain-specific standard passing the ERM test; no firm-specific roles/committees or verifiable claims present.


reasoning: This paragraph describes Audit Committee education and member expertise on information security, directly answering how the board oversees cybersecurity risks (BG). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


fact: corporate cybersecurity program is led by our chief information officer ("CIO")

fact: CIO also serves as the Kronos CIO and reports to our and Kronos' chief executive officers

fact: CompX's cybersecurity program is led by the director of information technology ("IT")

fact: cyber threat detection and response

fact: security engineering, operations

reasoning: Paragraph primarily describes management roles, responsibilities, reporting lines, and qualifications for cybersecurity leadership across subsidiaries (CIO, Director of IT), fitting Management Role per person-removal test and Rule 1. Specificity reaches Firm-Specific due to named VP+-level roles like CIO with cybersecurity duties and domain terms like 'cyber threat detection and response'; no verifiable hard facts like numbers or dates.


fact: Chief Technology Officer (CTO)

fact: Chief Information Security Officer (CISO)

reasoning: Paragraph details board oversight of cybersecurity program implementation, periodic reports from executives, and incident reporting, directly answering Board Governance question. Specificity reaches Firm-Specific due to named VP-level cybersecurity roles (CTO, CISO).


fact: NIST CSF

fact: endpoint detection

fact: security incident response and event management

fact: privileged access management

fact: CISO

fact: Global Information Security Program

fact: Global Information Security Policy

reasoning: Paragraph primarily describes the cybersecurity program's policies, framework adoption (NIST CSF), and specific measures (endpoint detection, SIEM, PAM), passing the person-removal test for RMP over MR. Specificity reaches Firm-Specific due to named role (CISO) and internal programs/policies, with domain terms supporting but not exceeding.


reasoning: The paragraph primarily states conclusions about no material past or likely future impacts from cybersecurity on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments). No specificity-elevating facts: generic language with no domain terms passing ERM test, no firm-specific elements, and negative assertions that are not externally verifiable.


reasoning: Paragraph centrally describes third-party risk management including risk-based mitigation, selection, oversight, and due diligence on vendors with access to critical systems, directly answering the Third-Party Risk question per Rule 3 (requirements imposed ON vendors). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


fact: Koichi (named individual in cybersecurity context)

reasoning: Paragraph is speculative forward-looking disclaimer about potential breaches with no substantive cybersecurity processes or measures described, fitting None/Other per Rule 5 and 6. Specificity driven by named individual 'Koichi' in security measures context, qualifying as firm-specific Level 3 fact with no higher verifiable or domain elements.


fact: Marco Technologies as the organization's Managed IT provider

fact: Red Canary to provide 24/7 monitoring on all end points

fact: High Point Networks provides physical and cloud-based network data backup solutions

fact: cyber security trainings... on a monthly basis

fact: 24/7 monitoring on all end points with triggers to isolate and mitigate

fact: Return to Operations objectives of less than 24 hours

reasoning: Paragraph primarily describes the cybersecurity program's activities including monitoring, training, backups, and incident response via specific third-party tools and services, fitting Risk Management Process per Rule 3 (third parties hired to serve the company). Specificity reaches Quantified-Verifiable due to multiple named firms (Marco Technologies, Red Canary, High Point Networks) and hard numbers like monthly trainings, 24/7 monitoring, and RTO <24 hours.


fact: Franklin Templeton

reasoning: Paragraph centrally describes third-party vendor cybersecurity requirements and diligence (questionnaires), making Third-Party Risk the primary category over RMP as vendor oversight is the focus. Specificity reaches Quantified-Verifiable due to the named firm 'Franklin Templeton' as the entity imposing requirements, a verifiable claim anywhere in the text.


fact: Deutsche Bank Group's security incident management

fact: DWS

reasoning: Paragraph centrally describes third-party (Deutsche Bank Group and DWS) incident management processes and notification protocols affecting the company, fitting TP as vendor/affiliate cybersecurity oversight over generic RMP; specificity reaches Quantified-Verifiable due to named firms that are externally verifiable affiliations in this context.


reasoning: Paragraph primarily describes management's leadership roles (CEO and SVP Finance/CFO), their responsibilities for cybersecurity risk assessment and strategy, qualifications via experience, reporting/meetings with IT, and sponsorship of training, directly answering 'How is management organized to handle cybersecurity?' (MR per Rule 2 person-removal test shows role focus). No qualifying specific_facts: uses only generic L1 terms (risk assessment, strategy, threats, awareness training); CEO/CFO are generic roles not firm-specific per rules; no domain terms passing ERM test, no verifiable claims or firm-unique details.


reasoning: Paragraph details the responsibilities of the Director, IT role, directly answering 'How is management organized to handle cybersecurity?' per MR definition and person-removal test showing role-focused content. No domain terms passing ERM test, no firm-specific elements like security-qualified titles or committees, and no verifiable facts, resulting in Generic Boilerplate specificity.


fact: penetration testing firms

reasoning: Paragraph describes third parties hired to assist the company's internal cybersecurity risk management (e.g., penetration testing), fitting RMP per Rule 3 (hired assessors → RMP, not vendor oversight → TP); includes domain term 'penetration testing' that passes ERM test, setting specificity to Domain-Adapted with no higher facts.


reasoning: This paragraph outlines a high-level oversight structure involving the Board, Audit Committee, and senior leadership supporting the cybersecurity process, directly answering the Board Governance question per governance-chain rules. It contains no domain-specific terminology, firm-unique facts, or verifiable claims, making it Generic Boilerplate.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with a quoted hypothetical risk statement, matching N/O for cross-references and lacking substantive cybersecurity disclosure per Rule 5 and 6. No specific facts of any level are present, confirming Generic Boilerplate specificity.


fact: SOC 1 report

fact: SOC 2 report

reasoning: Paragraph centrally describes vendor oversight for hosted software platforms, including monitoring, audits, and SOC report requirements, making Third-Party Risk the primary category per Rule 3 (requirements imposed on vendors). Specificity reaches Domain-Adapted due to named standards SOC 1 and SOC 2 that demonstrate cybersecurity domain expertise via ERM test; no firm-specific roles/committees or quantified verifiable claims present.


fact: malicious look-alike phishing sites

reasoning: Paragraph describes a real cybersecurity event (phishing targeting online banking platform at the beginning of the year, no losses, subsided after security improvements), directly answering 'what happened in a cybersecurity incident' per ID definition. Specificity driven by domain term 'malicious look-alike phishing sites' passing ERM test (cybersecurity-specific threat description); no firm-specific roles/committees or verifiable quantities/dates/names.


fact: forensic investigators

fact: security audits

reasoning: Paragraph centrally describes vendor management processes for cybersecurity risks, including assessments and contractual obligations on providers, directly answering 'How are third-party cyber risks managed?' (TP per Rule 3). Specificity driven by domain terms like 'penetration testing firms' and 'forensic investigators' passing ERM test (Level 2), with no firm-specific roles/committees or verifiable quantities/names (no Level 3/4).


reasoning: Paragraph centrally describes vendor oversight processes like assessments, questionnaires, security program reviews, and contracts, directly answering how third-party cyber risks are managed (TP). No domain terms passing ERM test (e.g., generic vendor assessments common in ERM), no firm-specific elements (e.g., named programs/roles), and no verifiable facts (no numbers/dates/names), so Generic Boilerplate.


reasoning: Paragraph describes using third-party providers to assist in internal risk identification, assessment, and management, which fits RMP per Rule 3 (third parties hired to serve the company, not managing vendor risks). No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: CISO

fact: Audit, Risk and Finance Committee

fact: Information Security group

fact: Senior members of our Information Security and Internal Audit functions

reasoning: Paragraph describes oversight by the Audit, Risk and Finance Committee via quarterly CISO updates on program status, risks, and changes, plus reports from Information Security and Internal Audit, answering 'How does the board oversee cybersecurity?' (BG). Specificity driven by firm-specific elements like CISO role and named committee/team, reaching Firm-Specific with no verifiable claims.


fact: ransomware incident

fact: December 15, 2020

fact: Ransomware Incident

reasoning: Paragraph primarily describes a specific past cybersecurity incident including date, nature (ransomware), scope (operational/IT systems), and impacts (service delays, costs), fitting Incident Disclosure; specificity reaches Quantified-Verifiable due to the verifiable date and named incident.


fact: malware

fact: ransomware

fact: computer viruses

reasoning: Paragraph primarily states a conclusion on no material past impacts from cybersecurity risks or incidents on business strategy, results, or financial condition (SI per Rule 5), with vague references to past threats framed non-materially and a cross-reference (not ID due to lack of incident specifics). Specificity driven by domain-specific threat terms (malware, ransomware, viruses) passing ERM test for Level 2, no firm-specific or verifiable facts.


fact: CISO reports to CIO

fact: CISO has served in various roles... for over 20 years

fact: undergraduate degree in Information Systems from Xavier University

fact: MBA from Michigan State

fact: combined total of over 25 Information Technology and Cybersecurity certifications

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Cloud Security Professional (CCSP)

fact: Certified Information Security Manager (CISM)

reasoning: Paragraph focuses on CISO's role, reporting to CIO, team management, experience, education, and certifications, primarily describing management organization and qualifications (MR per person-removal test); multiple verifiable facts including quantified experience (>20 years, >25 certs), named universities (Xavier, Michigan State), and specific certifications (CISSP, CCSP, CISM) elevate to Quantified-Verifiable.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: multi-layered defenses

fact: physical, administrative, and technical safeguards

fact: monitoring and patching of vulnerabilities

reasoning: The paragraph primarily describes the cybersecurity program's components, processes, and activities like risk assessment, NIST CSF adoption, safeguards, vulnerability monitoring/patching, and incident response planning, answering 'What does the cybersecurity program do?' (RMP); the brief mention of Audit Committee oversight is subordinate. Specificity is Domain-Adapted due to domain terms like NIST CSF, multi-layered defenses, and vulnerability patching that demonstrate cybersecurity expertise beyond generic ERM language, with no firm-specific roles/teams or verifiable quantities.


fact: security questionnaires

fact: information security addenda

fact: procuring results of audits and compliance reviews

fact: obtaining overviews of network infrastructure

reasoning: This paragraph centrally describes the company's third-party service provider management program for cybersecurity risks, including specific oversight and contractual measures, directly answering the Third-Party Risk question per Rule 3 (requirements imposed on vendors). Specificity reaches Domain-Adapted due to cyber-domain terms like 'information security addenda' and 'network infrastructure overviews' that pass the ERM test, showing expertise beyond generic risk management.


fact: agreements with NEE Management and NEER

fact: NEE's affiliates provide...information technology functions, including those relating to cybersecurity

fact: NEP's board oversees the provision of these services

reasoning: Paragraph describes board oversight of cybersecurity services provided via third-party affiliates, directly answering board governance question (BG per Rule 1). Specificity reaches Quantified-Verifiable due to named firms/affiliates (NEE Management, NEER) and NEP board oversight, which are externally verifiable firm-specific entities.


fact: Task Force

reasoning: This paragraph primarily describes the oversight structure, information flow, and briefing frequency from the Task Force to the Audit Committee on cybersecurity risks, directly answering the Board Governance question. Specificity is Firm-Specific due to the named 'Task Force' as a distinguishing committee, with no higher-level verifiable facts.


reasoning: This paragraph is solely a cross-reference to Item 1A Risk Factors, which qualifies as None/Other per category rules for cross-references lacking substantive cybersecurity disclosure. No specific facts of any level are present anywhere in the text, confirming Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A risk factors with a quoted hypothetical risk statement, matching the N/O category for cross-references and non-substantive content per Rule 5 and Rule 6. No specific facts, domain terms, firm-specific details, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph centers on managing cybersecurity risks from third-party service providers via initial and annual risk assessments and ensuring contractual obligations, directly answering the Third-Party Risk question as the central topic. It lacks domain-specific cybersecurity terminology beyond generic risk processes, firm-specific roles or structures, or any verifiable facts like numbers, dates, or named entities, warranting Generic Boilerplate specificity.


reasoning: Paragraph describes oversight structure via Audit Committee briefings from the COO, including frequency, topics, and annual review, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1 for board-level committee flow); no domain terms passing ERM test, no firm-specific roles/committees (COO and Audit Committee are generic), and no verifiable facts, yielding Generic Boilerplate.


fact: ERMC

fact: Vice President of Information Technology

fact: key employee with over 20 years of experience in information technology and cybersecurity

reasoning: Paragraph primarily describes management's organizational roles, responsibilities, team composition (ERMC, VP of IT, legal/compliance), and qualifications for handling cybersecurity, fitting Management Role per person-removal test as it focuses on who rather than program activities. Specificity reaches Quantified-Verifiable due to the verifiable claim of a key employee with over 20 years of experience, plus firm-specific named committee (ERMC) and VP-level role.


fact: One member of our audit committee earned the NACD's CERT Certificate in Cybersecurity Oversight in 2023

fact: our Chief Information Security Officer, which we refer to as our CISO

fact: cyber threat response preparedness

fact: program maturity milestones

reasoning: Paragraph primarily describes board and audit committee oversight of cybersecurity, including briefing frequency, expertise, and information flow, fitting Board Governance per governance-chain rule. Specificity reaches Quantified-Verifiable due to the verifiable claim of a board member earning a specific cybersecurity oversight certificate in 2023, alongside firm-specific CISO role and domain terms.


fact: VP of Information Technology

fact: President, Chief Executive Officer and Chairman of the Board

fact: Senior Vice President, Chief Financial Officer and Treasurer

fact: Senior Vice President, General Counsel and Secretary

reasoning: Paragraph primarily describes management team's leadership roles and collective experience in cybersecurity, fitting Management Role per person-removal test (collapses without roles); firm-specific VP-level IT role elevates to Firm-Specific, no verifiable facts or domain terms beyond L3.


reasoning: This paragraph primarily states a conclusion about no material past or likely future cybersecurity impacts on business strategy, operations, or finances, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments); the cross-reference to Risk Factors is secondary. No specific facts elevate specificity: negative assertions are not verifiable, no domain terms, roles, or quantifiable claims present, resulting in Generic Boilerplate.


fact: Chief Information Officer ("CIO")

fact: CIO has 25 years of experience in the information technology industry

fact: dedicated cybersecurity team within our information systems department

fact: multidisciplinary incident response team

reasoning: Paragraph primarily describes Board and Audit Committee oversight of cybersecurity risks, including reports and updates from management, fitting Board Governance per governance-chain default (Rule 1); it secondarily mentions CIO role but in oversight context. Specificity reaches Quantified-Verifiable due to verifiable '25 years of experience' and firm-specific elements like named CIO role and dedicated teams.


fact: information security team

fact: enterprise risk management teams

reasoning: Paragraph primarily details ongoing monitoring, pre-contract cybersecurity risk assessments of vendors (including data access evaluation and security program review), and required contract terms, centrally addressing third-party risk management per Rule 3 (requirements imposed on vendors). Specificity is Firm-Specific due to named internal teams ('information security team' and 'enterprise risk management teams') involved in assessments, distinguishing the company's structure.


reasoning: Paragraph primarily states a conclusion that cybersecurity risks have not materially affected business outcomes (SI per Rule 5), with vague mention of past threats/breaches lacking incident details (not ID) and a cross-reference; non-cyber content at end does not change primary focus. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: Chief Risk Officer oversees enterprise risk management program including cybersecurity

reasoning: Paragraph describes integration of cybersecurity program into ERM with shared methodologies and processes, directly answering 'What does the cybersecurity program do?' via ERM integration (RMP); person-removal test leaves substantive program description. Specificity driven by firm-specific named role (Chief Risk Officer overseeing cyber-inclusive ERM), elevating to Firm-Specific with no higher verifiable facts.


fact: Change Healthcare incident where a cybersecurity threat actor gained access to some of its information technology systems

fact: Change Healthcare, a subsidiary of UnitedHealth Group

fact: processing certain of our claims for reimbursement related to our Exogen device

fact: March 7, 2024, UnitedHealth Group issued a statement

fact: expects to begin testing and reestablish connectivity... beginning March 18, 2024

reasoning: The paragraph primarily describes a specific cybersecurity incident involving Change Healthcare, including its nature, scope, timing, impact, and response, directly answering 'What happened in a cybersecurity incident?' (ID over SI due to incident frame dominance). Specificity reaches Quantified-Verifiable due to named firms (Change Healthcare, UnitedHealth), product (Exogen), and specific dates (March 7 and 18, 2024).


fact: The Business Continuity Institute (BCI)

fact: Disaster Recovery Institute International (DRII)

reasoning: Paragraph describes the business resilience program including framework adoption (BCI, DRII, ISO 22301), risk assessments, business impact analyses, continuity strategies, and exercises like tabletops, directly answering 'What does the cybersecurity program do?' (RMP via person-removal test: substantive processes remain); specificity at Domain-Adapted due to named resilience frameworks demonstrating domain expertise beyond generic ERM language.


reasoning: Paragraph describes regulatory oversight and SEC disclosure rules without addressing any substantive cybersecurity questions like governance, processes, or incidents, fitting None/Other. No specificity-elevating facts qualify under None/Other rules, resulting in Generic Boilerplate.


reasoning: Paragraph primarily states conclusions about no material past or likely future cybersecurity impact on business strategy, results, or financial condition, directly matching Strategy Integration materiality rule (backward- and forward-looking assertions); contains only generic speculation, cross-references, and no domain terms, firm-specific facts, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a biography of David Shear detailing his career history in marketing and executive roles at RBI and Burger King, with no reference to cybersecurity, board oversight, management roles in cyber, processes, incidents, or strategy, making it non-cybersecurity content (None/Other). No domain terms, firm-specific cyber roles, or verifiable cyber facts are present anywhere, resulting in empty specific_facts and Generic Boilerplate specificity.


reasoning: This paragraph describes the board's oversight of cybersecurity risks, delegation to the Audit Committee, reporting flows, and updates on incidents, directly answering 'How does the board oversee cybersecurity?' making it Board Governance per governance-chain rules. No domain terms passing ERM test, no firm-specific roles/committees beyond generic Audit Committee, and no verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: The paragraph states a conclusion that no cybersecurity threats or incidents have materially affected the company during the reporting periods, directly answering how cybersecurity affects business outcomes (SI per materiality rule for backward-looking negative assertions). No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: Vice President of IT is responsible for Li-Cycle's information security program

fact: ransomware

fact: malware

fact: denial-of-service attacks

fact: hacking

fact: phishing

fact: computer viruses

fact: social engineering

fact: vendor software supply chain compromises

reasoning: Paragraph primarily describes board and Audit Committee oversight of cybersecurity risks with VP of IT responsibility in the governance chain, defaulting to BG per Rule 1 despite some MR elements; specificity driven by firm-specific VP of IT role (L3) and multiple domain threat terms (L2), with no verifiable facts for L4.


reasoning: Paragraph centrally describes vendor security assessments and ongoing monitoring for compliance, directly answering how third-party cyber risks are managed (TP). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


fact: Regular vulnerability scanning: internal and external vulnerability scans

fact: Penetration testing: engage independent security professionals for simulated cyberattacks

fact: Threat intelligence monitoring: subscribe to threat intelligence feeds for real-time information

reasoning: Paragraph primarily describes the cybersecurity program's activities like vulnerability scanning, penetration testing, threat intelligence, and risk assessment framework (including vendor due diligence as a component), answering 'What does the cybersecurity program do?' → RMP; contains multiple domain-specific cybersecurity practices that pass the ERM test (e.g., vulnerability scans, pen testing, threat intel feeds) for Domain-Adapted, but no firm-specific roles/committees or verifiable quantities/names.


fact: CDIO chairs a security council

fact: security council

fact: comprised of senior leaders from Legal and Regulatory, Corporate Security, Network Engineering, Internal Audit, Finance & Accounting and Risk and IT Infrastructure

fact: April 2024 cyber-attack

reasoning: Paragraph primarily describes management organization including the CDIO-chaired security council's structure, membership from specific departments, response teams' roles in incident materiality assessment, and escalation to Audit Committee, fitting Management Role per Rule 1 (management-level committee structure). Specificity reaches Quantified-Verifiable due to the verifiable 'April 2024 cyber-attack' reference and firm-specific elements like CDIO, named security council, and detailed department list.


reasoning: Paragraph describes using third-party consultants and service providers to assist with internal cybersecurity activities like risk assessment, policy design/implementation, monitoring, and testing safeguards, which fits RMP as third parties hired to support the company's program (per Rule 3); the requirements imposed on them are secondary. No domain terms pass the ERM test (all generic processes like 'risk assessment' and 'security measures' could apply to non-cyber risks), no firm-specific facts, and no verifiable claims, so Generic Boilerplate.


fact: Firewalls, intrusion detection/prevention systems (IDS/IPS), and data loss prevention (DLP) solutions

fact: Antivirus, anti-malware, and Mobile Device Management solutions

fact: User access controls ... based on the principle of least privilege

fact: Encryption solutions ... at rest and in transit

fact: security awareness training ... on cybersecurity best practices and phishing attempts

reasoning: Paragraph details specific cybersecurity tools, controls, and training practices, directly answering 'What does the cybersecurity program do?' (RMP). Specificity is Domain-Adapted due to multiple cyber-specific terms like IDS/IPS, DLP, MDM, least privilege, and encryption at rest/in transit that demonstrate domain expertise beyond generic ERM language; no firm-specific roles/committees or verifiable quantities/names.


reasoning: This paragraph is a cross-reference to Item 1A risk factors with speculative language about potential cyber risks and impacts, fitting None/Other as it provides no substantive cybersecurity disclosure or answers none of the six core questions. No specific facts, domain terms, or verifiable claims are present, confirming Generic Boilerplate specificity.


reasoning: Paragraph states a materiality conclusion about past and potential future cybersecurity impacts on business outcomes, directly matching Strategy Integration per materiality rule (backward-looking negative assertion and forward-looking caveat). No domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes future disclosure policy for material incidents without referencing any real event, process, or assessment, making it a forward-looking disclaimer fitting None/Other. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: IT Security Director

fact: Chief Information Officer

fact: cybersecurity team

fact: threat intelligence

reasoning: Paragraph primarily describes management roles, reporting lines (IT Security Director to CIO), responsibilities, and team qualifications, fitting Management Role per person-centric focus and Rule 2. Specificity reaches Firm-Specific due to named roles (IT Security Director, CIO) and named team, with no verifiable quantified facts for Level 4.


reasoning: The paragraph primarily assesses the lack of material impact from past cybersecurity threats and incidents on business strategy, operations, and financial condition, directly matching Strategy Integration per materiality rules (backward- and forward-looking assertions). No domain terms, firm-specific facts, or verifiable claims (e.g., vague 'from time to time' breaches and reporting date not qualifying as cybersecurity facts) found, resulting in Generic Boilerplate specificity.


fact: malware and computer virus attacks

reasoning: Paragraph primarily assesses that cybersecurity risks and past threats/breaches have not materially affected business strategy, results of operations, or financial condition (SI per Rule 5 backward-looking materiality). Specificity driven by domain-specific threat types 'malware and computer virus attacks' passing ERM test for Level 2; no firm-specific or verifiable facts.


reasoning: This paragraph primarily describes how the Board of Directors and Audit Committee oversee cybersecurity through quarterly updates on the program, risks, incidents, assessments, third-party risk, and evolving risks, directly answering the Board Governance question. It contains no domain-specific terminology beyond generic phrases, no firm-specific roles or committees beyond standard ones like Audit Committee, and no verifiable facts like hard numbers or dates, warranting Generic Boilerplate specificity.


fact: ISO (Information Security Officer)

fact: penetration testing

fact: vulnerability and penetration testing

fact: SOC reports

fact: incident response processes

fact: access reviews and controls

fact: encryption standards

reasoning: Paragraph centrally describes assessments of third-party service providers' security controls (SOC reviews, pen testing results, encryption, etc.), making Third-Party Risk the primary category over RMP (initial hiring of assessors is minor). Specificity reaches Firm-Specific due to named role 'ISO' and multiple domain terms like penetration testing and SOC reports.


reasoning: This paragraph is an introductory overview or section header that provides no substantive details on cybersecurity processes, governance, or any specific question from the categories, defaulting to None/Other per Rule 6. No specific facts, domain terms, roles, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph states general goals for handling cyber incidents without describing any oversight structure, roles, processes, incidents, or business impacts, making it None/Other per Rule 6 as pure speculation without substantive measures. No domain terms, firm-specific facts, or verifiable claims are present anywhere, confirming Generic Boilerplate specificity.


fact: data exfiltration

reasoning: Paragraph describes the methodology for assessing materiality of cybersecurity incidents, including specific factors like data exposure and exfiltration, directly answering 'What does the cybersecurity program do?' under risk assessment (RMP); not a conclusion on business impact (SI) or other categories. Specificity driven by 'data exfiltration' as a domain term passing ERM test (cyber-specific vocabulary), no firm-specific roles/committees or verifiable claims.


reasoning: Paragraph states a conclusion on cybersecurity risks' lack of material impact on business strategy, financial condition, or operations (backward- and forward-looking), fitting Strategy Integration per Rule 5; cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims (negative assertions and reporting date not qualifying), so Generic Boilerplate.


reasoning: Paragraph describes Audit Committee oversight of cybersecurity risks, including quarterly briefings on specific topics and board-level discussions, directly answering 'How does the board oversee cybersecurity?' (BG). No domain terms passing ERM test (e.g., 'data security posture' and 'incident response plan' are generic), no firm-specific facts (Audit Committee is universal), and no verifiable claims, resulting in Generic Boilerplate.


reasoning: Paragraph describes how the board/Audit Committee receives quarterly updates on cybersecurity risks, activities, incidents, and testing, directly answering 'How does the board oversee cybersecurity?' with focus on briefing frequency and scope; no domain terms pass ERM test (e.g., 'cybersecurity systems testing' is generic), no firm-specific roles/committees beyond standard Audit Committee/Board, and no verifiable facts, resulting in Generic Boilerplate.


fact: CISO

fact: Information Security Steering Committee (ISSC)

fact: over 20 years of information security experience

fact: over four years as a director in the information security management practice of a big four accounting firm

fact: holds multiple information security certifications

fact: B.S. in Network Security

fact: dedicated information security team

fact: annual cybersecurity risk assessments

fact: internal and third-party information security audits and assessments

reasoning: Paragraph primarily describes the CISO's role, reporting line to CFO, qualifications, leadership of the dedicated security team and ISSC (management-level committee), and committee structure, answering 'How is management organized to handle cybersecurity?' per MR definition and person-removal test showing role focus. Specificity reaches Quantified-Verifiable due to verifiable quantified experience claims like 'over 20 years' and 'over four years,' plus firm-specific elements like named CISO and ISSC.


fact: Incident Response Team

reasoning: Paragraph describes the incident response process, including identification, assessment, response, coordination of resources, and escalation protocols, which directly answers 'What does the cybersecurity program do?' making it RMP; person-removal test confirms substantive program description remains. Specificity reaches Firm-Specific due to the named 'Incident Response Team', a firm-unique organizational element, with no higher verifiable facts.


reasoning: Paragraph asserts no material cybersecurity incidents or expenses in the last three fiscal years, stating a conclusion about lack of business/financial impact, fitting Strategy Integration per Rule 5 (negative assertion). No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: advanced persistent threats

reasoning: Paragraph primarily assesses cybersecurity's lack of material impact (no incidents in two-year period) and potential effects on operations/reputation, directly answering Strategy Integration per materiality rule for negative assertions. Specificity at Domain-Adapted due to 'advanced persistent threats' as a cybersecurity-specific domain term passing ERM test; no firm-specific or verifiable facts.


reasoning: Paragraph describes using external service providers to evaluate and enhance the company's own cybersecurity policies as part of their program, directly answering 'What does the cybersecurity program do?' (RMP per Rule 3, as these are hired assessors, not vendor oversight). No domain terms passing ERM test, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: Chief Information Officer

fact: vCISO

reasoning: Paragraph describes board and Audit Committee oversight of cybersecurity risks, delegation, and reporting flows, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity driven by named firm-specific cybersecurity/IT leadership roles (CIO, vCISO) elevating to Firm-Specific; no domain terms or verifiable claims present.


reasoning: This paragraph details the Audit Committee's receipt of periodic reports on cybersecurity threats, risks, and mitigation processes from specific executives, directly addressing board oversight structure and information flow, which fits Board Governance per rules on board-level committees. No domain terminology passing the ERM test, no qualifying firm-specific cybersecurity roles (named executives are finance/legal, not IT/security), and no verifiable facts like numbers or dates, yielding Generic Boilerplate specificity.


fact: Chief Information Security Officer

fact: Chief Technology and Digital Officer

reasoning: Paragraph describes board-level oversight by the Audit and Finance Committee, briefing frequency, and discussions with specific officers, directly answering 'How does the board oversee cybersecurity?' → Board Governance. Specificity reaches Firm-Specific due to named cybersecurity leadership roles (CISO, CTO) that distinguish the company's structure.


reasoning: Paragraph describes board oversight of cybersecurity via annual CIO briefings and Audit Committee support with exec updates, directly answering 'How does the board oversee cybersecurity?' → Board Governance. Specificity reaches Firm-Specific due to named CIO role (VP-level IT leadership), with no domain terms passing ERM test or verifiable claims.


fact: September 2022 network intrusion

fact: Rockstar Games' systems

fact: early development footage for the next Grand Theft Auto

fact: 2K Games

fact: vendor platform that 2K Games uses to provide help desk support

reasoning: Paragraph primarily describes specific past cybersecurity incidents (September 2022 events at Rockstar and 2K), including nature, scope, timing, impact, and remediation, making Incident Disclosure the dominant category despite initial materiality statement. Specificity reaches Quantified-Verifiable due to specific dates (September 2022), named subsidiaries (Rockstar Games, 2K Games), and game assets (Grand Theft Auto footage).


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors, which is explicitly classified as None/Other. It contains no domain terms, firm-specific facts, or verifiable claims, warranting Generic Boilerplate specificity.


fact: Chief Technology Officer (CTO)

fact: in 2023, management hosted an expert during the annual board of directors' retreat

reasoning: Paragraph primarily describes board and audit committee oversight of cybersecurity risks, including reporting frequency, expert briefings, and information flow (BG), with governance-chain defaulting to BG over MR despite CTO mention. Specificity driven by firm-specific named role (CTO, L3) and 2023 event (firm-unique, L3); no domain terms or verifiable claims elevate higher.


fact: CISO

fact: CIO

fact: Technology & Operations Committee

fact: information technology, legal, and internal audit functions

reasoning: Paragraph describes board/committee oversight structure, briefing frequency by functions and leaders (CISO/CIO) to Audit Committee and Technology & Operations Committee, answering 'How does the board oversee cybersecurity?' (BG per governance-chain rule). Specificity reaches Firm-Specific due to named roles (CISO, CIO) and non-generic committee (Technology & Operations), with no higher verifiable facts.


fact: Risk and Governance Committee

fact: Head of Information Technology

fact: Certified Information Systems Security Professional (CISSP)

reasoning: Paragraph describes board delegation of cybersecurity oversight to the Risk and Governance Committee with update cadences and flows to senior management including the Head of IT, fitting BG governance-chain structure per Rule 1. Specificity reaches Quantified-Verifiable due to the CISSP certification, a verifiable fact, plus firm-specific named committee and role.


fact: CTO

reasoning: Paragraph describes how the CTO reports quarterly to the Board on cybersecurity risks, incidents, and program updates, directly answering the Board Governance question of oversight, briefing frequency, and information flow; defaults to BG per governance-chain rule. Specificity reaches Firm-Specific due to the named CTO role (VP-level cybersecurity leadership), with no higher verifiable facts or domain terms passing the ERM test.


fact: principle of least-privilege

fact: phishing awareness exercises

fact: security-by-design principles

reasoning: Paragraph describes cybersecurity program elements like framework adoption (ISO 27001), access controls (least-privilege), and employee training (phishing exercises, security-by-design), directly answering 'What does the cybersecurity program do?' making it Risk Management Process. Specificity is Domain-Adapted due to multiple domain terms (ISO 27001, least-privilege, phishing exercises, security-by-design) that demonstrate cybersecurity expertise beyond generic ERM language, with no firm-specific or verifiable facts.


reasoning: Paragraph describes the process for reviewing third-party IT providers' cybersecurity measures, centrally addressing third-party risk management (TP). No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: Vice President, IT Security and Compliance

fact: Chief Information Officer

fact: IT Security Director

fact: threat intelligence

reasoning: Paragraph primarily describes management-level roles (VP IT Security, IT Security Director reporting to CIO), their responsibilities, reporting lines, and team qualifications, fitting Management Role per person-removal test where focus is on organization and credentials rather than program activities. Specificity reaches Firm-Specific due to multiple named VP+/Director-level security roles; no verifiable claims like specific certifications or numbers.


fact: Chief Technology Officer (CTO)

fact: Chief Operating Officer (COO)

fact: CTO has over 10 years of experience overseeing cybersecurity functions within technology-driven organizations

fact: COO has over 5 years of experience overseeing cybersecurity and IT functions

reasoning: Paragraph primarily describes board and Audit Committee oversight of cybersecurity risks and program's implementation, with information flow from management (CTO/COO) to committee/board, fitting Board Governance per governance-chain default. Specificity reaches Quantified-Verifiable due to named executive roles (CTO, COO) with cybersecurity duties and verifiable quantified experience claims (over 10 years for CTO, over 5 for COO).


fact: full Board of Directors designated as primary responsible for oversight of cybersecurity risk management

reasoning: Paragraph describes board-level oversight structure, including full Board responsibility, reporting frequency to Board and Audit Committee, and information flow, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1). Specificity reaches Firm-Specific due to the distinguishing claim of full Board as primary oversight body, with no domain terms, verifiable facts, or other firm-specific elements like named roles or quantified data.


fact: Senior Director of Information Technology

fact: over 20 years of cybersecurity experience

fact: last 10 years in leadership positions

fact: Veteran Volunteer Instructor for US Cyber Army Command (ARCYBER)

fact: Information Systems Security Association (ISSA)

fact: Forum of Incident Response and Security Teams (FIRST)

fact: Strategic Planning, Policy, and Leadership (GSTRT)

fact: Certified Cloud Security Professional (CCSP)

fact: Certified Information Systems Security Architecture Professional (CISSP-ISSAP)

fact: Certified in the Governance of Enterprise IT (CGEIT)

fact: Certified Data Privacy Solutions Engineer (CDPSE)

fact: Certified Ethical Hacker (CEH)

reasoning: Paragraph primarily describes management roles (CFO and Senior Director of IT), their responsibilities, qualifications, experience, and third-party assistance, fitting Management Role per person-removal test (collapses without personnel details). Specificity reaches Quantified-Verifiable due to multiple verifiable facts like quantified experience ('over 20 years'), specific certifications (CISSP, CCSP, etc.), and named associations (ARCYBER, ISSA, FIRST).


fact: approximately 20 years of experience in his field

reasoning: Paragraph describes a specific management role's cybersecurity responsibilities, qualifications, and experience, directly answering 'How is management organized to handle cybersecurity?' (MR per person-centric focus and Rule 2). Firm-specific named role (Director of Operations & Information Technology) qualifies for Level 3; 'approximately 20 years' is soft but listed as quantified fact supporting the level.


reasoning: Paragraph centrally describes franchisees/licensees' responsibility for information security at non-company properties, compliance with brand standards, and incident reporting obligations, directly answering how third-party cyber risks are managed (TP). No domain terminology passing ERM test, no firm-specific roles/committees/programs, no verifiable claims like numbers/dates/named firms/certifications, resulting in Generic Boilerplate specificity.


reasoning: Paragraph states a conclusion on no material past or likely future cybersecurity impacts on business strategy, operations, or finances, directly matching SI materiality rule for backward- and forward-looking assessments; cross-references are secondary. No specific facts of any level (no domain terms, firm-specific details, or verifiable claims like numbers/dates/names), resulting in Generic Boilerplate specificity.


fact: CIO has primary responsibility for the development, operation, and maintenance of the Company's information security program

fact: CIO has 19 years of experience in technology risk management

fact: 11 years with the Company (or its affiliates)

fact: certifications as a SANS Global Information Security Leader

fact: Certified Information Systems Auditor

reasoning: Paragraph primarily describes the CIO's leadership role, qualifications, experience, and the reporting structure of the information security team, answering 'How is management organized to handle cybersecurity?' (MR per person-centric focus and Rule 2 partial collapse on removal). Specificity reaches Quantified-Verifiable due to multiple verifiable facts like specific years of experience (19/11) and named certifications checkable via registries or resumes.


fact: Risk Management Committee of our Board of Directors

fact: EVP ERM and his team

reasoning: The paragraph primarily details the Risk Management Committee's oversight responsibilities for enterprise risk management including cybersecurity, quarterly reporting from management, and escalation to the full Board, directly answering how the board oversees cybersecurity risks (Board Governance); later sentences on no material incidents and speculation are secondary. Specificity is Firm-Specific due to the named committee and VP-level EVP ERM role involved in cybersecurity reporting.


reasoning: This is a cross-reference to Item 1A Risk Factors, which per rules is None/Other as it provides no substantive cybersecurity disclosure. No specific facts, domain terms, or verifiable claims are present anywhere in the paragraph, resulting in Generic Boilerplate specificity.


reasoning: This paragraph provides generic boilerplate language about commitment to cybersecurity without addressing any specific question on board governance, management roles, processes, third parties, incidents, or strategy integration, making it None/Other. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, resulting in Generic Boilerplate specificity.


fact: intelligence sharing about emerging threats

fact: Arizona Cyber Threat Response Alliance ("ACTRA")

fact: The Internet and Television Association ("NCTA")

reasoning: Paragraph describes incorporating threat intelligence sharing via industry collaborations and public-private partnerships, directly answering what the cybersecurity program does (RMP). Specificity reaches Quantified-Verifiable due to named firms ACTRA and NCTA, which are externally verifiable partnerships.


reasoning: Paragraph primarily describes executive management's responsibility for overseeing cybersecurity risks and strategy, directly answering 'How is management organized to handle cybersecurity?' (MR per Rule 1, as it's management-level not board). No domain terminology passing ERM test, firm-specific roles/committees, or verifiable facts anywhere, resulting in empty specific_facts and Generic Boilerplate specificity.


fact: Change Healthcare experienced an incident in which a cybersecurity threat actor gained access to some of its information technology systems

fact: Change Healthcare, a subsidiary of UnitedHealth Group

fact: related to our EXOGEN device

fact: UnitedHealth Group is still investigating this incident

reasoning: Paragraph primarily describes a real cybersecurity incident involving Change Healthcare, including nature (threat actor access), impact on company's billing for EXOGEN device, remediation (alternative intermediary), and ongoing investigation, making Incident Disclosure the dominant category despite opening SI materiality statements (most text on incident). Specificity reaches Quantified-Verifiable due to named firms (Change Healthcare, UnitedHealth Group) and company product (EXOGEN), which are externally verifiable facts tied to a known real-world event.


reasoning: Paragraph details the Audit Committee's oversight of cybersecurity risks, frequency of reviews, and reporting to the Board, fitting Board Governance as it describes board-level oversight structure. No domain-specific cybersecurity terminology, firm-specific roles/committees beyond generic Audit Committee, or verifiable facts like numbers/dates/names, so Generic Boilerplate.


reasoning: Paragraph details continuous monitoring, security tools for detecting suspicious behaviors, and incident response collaboration, directly answering 'What does the cybersecurity program do?' thus Risk Management Process; no domain-specific terminology passing ERM test, firm-specific details, or verifiable facts present, resulting in Generic Boilerplate.


fact: scanning our internal network and infrastructure

fact: third-party vulnerability testing

reasoning: Paragraph describes cybersecurity program activities like risk assessment, vulnerability scanning (monthly internal, annual third-party), monitoring, and security tools for incident handling, directly answering 'What does the cybersecurity program do?' (RMP); no roles, oversight, or incidents mentioned. Specificity driven by domain terms like network scanning and vulnerability testing that demonstrate cybersecurity expertise (Level 2), with no firm-specific roles/committees or verifiable quantities/names (no Level 3/4).


reasoning: The paragraph primarily describes processes for overseeing third-party providers, including pre-engagement security assessments and ongoing reviews for compliance, making Third-Party Risk the central topic with most text despite a brief concluding materiality statement. No domain terms passing the ERM test, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph describes the company's cybersecurity framework and procedures for threat detection, incident response, and risk mitigation, directly answering 'What does the cybersecurity program do?' making it Risk Management Process. No domain terms passing the ERM test, firm-specific details, or verifiable facts are present, resulting in Generic Boilerplate specificity.


fact: ORIX USA

fact: subsidiary of ORIX

reasoning: Paragraph primarily describes reliance on external Manager (affiliate of ORIX USA) and its cybersecurity program for managing cyber risks, making third-party risk the central topic per Rule 3 (requirements/oversight of vendor cybersecurity). Specificity reaches Quantified-Verifiable due to named external firms (ORIX USA, ORIX) that are independently verifiable in the company's structure.


fact: defense in depth

fact: zero trust based controls

fact: phishing email simulations

reasoning: Paragraph describes the cybersecurity program's processes, tools, and activities like risk assessment, training, and specific controls, directly answering 'What does the cybersecurity program do?' (RMP); domain terms such as 'defense in depth,' 'zero trust,' and 'phishing simulations' demonstrate cybersecurity expertise for Domain-Adapted specificity, with no firm-specific roles/committees or verifiable quantities.


reasoning: Paragraph centrally describes due diligence and periodic reviews of third-party providers for cybersecurity compliance, directly answering the Third-Party Risk question per Rule 3 (vendor oversight as central topic). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph states a conclusion on no material cybersecurity incidents affecting business outcomes, directly matching SI per Rule 5 (backward-looking materiality assessment); no substantive program details. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: Chief Information Security Officer (CISO)

fact: Chief Information Officer

reasoning: Paragraph primarily describes board and committee oversight of cybersecurity risks, including briefing frequency and information flow from management to board/Audit Committee, fitting Board Governance per governance-chain default and Rule 1. Specificity reaches Firm-Specific due to named cybersecurity leadership roles (CISO reporting to CIO), with no domain terms or verifiable claims elevating higher.