fact: Federal Financial Institutions Examination Council (FFIEC) framework

fact: National Institute of Standards and Technology (NIST) standards, guidelines, and resources

fact: confidentiality, integrity, and availability of sensitive information and systems

reasoning: The paragraph primarily describes the cybersecurity program's design using specific frameworks like FFIEC and NIST for risk mitigation controls and processes, answering 'What does the cybersecurity program do?' (RMP). Specificity is Domain-Adapted due to domain-specific frameworks and concepts like the CIA triad that demonstrate cybersecurity expertise beyond generic ERM language, with no firm-specific roles or verifiable claims.


content_category: Incident Disclosure

fact: on February 13, 2023, we disclosed a security breach

category_confidence: high

specificity_confidence: high

reasoning: Paragraph primarily describes a specific cybersecurity incident including timing, nature (third-party vendor breach), and impact (patient data exposure), fitting Incident Disclosure. Specificity reaches Quantified-Verifiable due to the verifiable specific date of the disclosure tied to the real event.

provider: x-ai

stage: benchmark


content_category: Strategy Integration

reasoning: Paragraph primarily states a materiality assessment concluding no past material impact from cybersecurity and no reasonable likelihood of future material effect on business strategy, results, or finances, directly matching Strategy Integration per Rule 5 (SI materiality rule for backward- and forward-looking assertions). No domain terminology passing ERM test, firm-specific facts, or verifiable claims (negative assertions and generic threat language do not qualify), resulting in empty specific_facts and Generic Boilerplate specificity.


content_category: Third-Party Risk

fact: SOC Reports

reasoning: Paragraph centrally describes processes for managing cybersecurity risks from third-party providers, including pre-acquisition diligence, contractual obligations, performance monitoring, and obtaining SOC Reports, directly answering the Third-Party Risk question. Specificity is Domain-Adapted due to the domain term 'SOC Reports' (specific cyber audit evidence passing ERM test), with no firm-specific roles/committees or quantified verifiable claims.


fact: On February 16, 2022, we became aware of a cybersecurity intrusion

fact: cybersecurity intrusion that caused a network disruption and impacted certain of our systems

reasoning: The paragraph primarily describes a real past cybersecurity incident including its date, nature (intrusion causing network disruption), response actions, and non-material impact, fitting Incident Disclosure as the dominant frame despite trailing hypotheticals. Specificity reaches Quantified-Verifiable due to the externally verifiable specific date of February 16, 2022, tied to the event.


fact: penetration testing

reasoning: Paragraph centers on vendor cybersecurity assessments, monitoring programs, and contractual protections, making Third-Party Risk the primary category per Rule 3 (requirements imposed on vendors). Specificity at Domain-Adapted due to 'penetration testing' as a cybersecurity-specific practice passing the ERM test; no firm-specific roles/committees or verifiable claims like numbers/names.


content_category: None/Other

reasoning: Paragraph is a forward-looking disclaimer with speculation on potential impacts and a cross-reference to Item 1A risk factors, matching None/Other per rules on disclaimers and cross-references; negative assertion on no material events is not substantive disclosure. No domain terms, firm-specific facts, or verifiable claims present anywhere, confirming Generic Boilerplate specificity.


reasoning: Paragraph states conclusions on past material incidents (none since January 1, 2021) and forward-looking materiality (not reasonably likely to impact business), directly answering Strategy Integration per Rule 5 on materiality assessments and negative assertions. No specificity-elevating facts: specific date is tied to unverifiable negative self-assertion, no domain terms, roles, or verifiable claims present.


content_category: Risk Management Process

fact: managed services agreement for incident response

fact: comprehensive cybersecurity assessment, opportunity prioritization, initiative road mapping and cyber project delivery

fact: firewall maintenance and upgrade initiatives

reasoning: Paragraph describes elements of the cybersecurity program including specific external services for incident response, assessments, roadmapping, project delivery, and firewall maintenance, answering 'What does the cybersecurity program do?' (RMP); domain terms like 'managed services for incident response' and 'firewall maintenance' demonstrate cybersecurity expertise beyond generic ERM language, setting specificity to Domain-Adapted with no firm-specific or verifiable facts.


content_category: Board Governance

fact: ISMS

fact: Chief Information Officer

reasoning: Paragraph describes board and committee oversight of cybersecurity risks within the enterprise risk management program, including reporting and updates from executives, directly answering 'How does the board oversee cybersecurity?' (BG per governance-chain default). Specificity reaches Firm-Specific due to named cybersecurity-relevant roles (CIO, Executive Director of Information Security) and domain term ISMS, with no verifiable claims.


reasoning: This paragraph provides a backward-looking negative assertion about no material cybersecurity incidents to date and speculates on potential future business/financial impacts, directly matching Strategy Integration per Rule 5 materiality rule for conclusions on materiality. No domain terminology, firm-specific details, or verifiable facts are present anywhere in the text, warranting Generic Boilerplate specificity.


reasoning: This paragraph is solely a cross-reference to Item 1A Risk Factors for discussions on cybersecurity risks' potential financial impacts, fitting None/Other per category rules for cross-references without substantive content. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, confirming Generic Boilerplate specificity.


reasoning: This paragraph describes the Audit Committee's reporting to the Board and Board briefings from management on cybersecurity, directly answering how the board oversees cybersecurity risks (BG). No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states a conclusion about no material past impacts from cybersecurity incidents and touches on insurance and future risks, directly matching Strategy Integration's materiality assessment rule (backward-looking negative assertion). No domain terminology passing ERM test, firm-specific details, or verifiable facts (negative assertions and soft speculation do not qualify), yielding Generic Boilerplate specificity.


reasoning: Paragraph centers on contractual requirements for the Custodian and its critical vendors to implement cybersecurity measures and notify MetLife of incidents, making third-party risk management the primary topic per Rule 3 (requirements imposed on vendors). No domain terminology passing ERM test, firm-specific facts (e.g., named cyber roles/committees), or verifiable claims (e.g., numbers, dates, certifications) found anywhere, resulting in Generic Boilerplate.


fact: ransomware

fact: denial-of-service

fact: nation state actors

fact: 21st Century Security vision

reasoning: Paragraph discusses general importance of cybersecurity, specific threats, and speculative material impacts without describing oversight, roles, processes, or incidents, fitting None/Other per Rule 6 (speculation without measures). Specificity reaches Firm-Specific due to the named '21st Century Security vision' distinguishing the company's posture, plus domain terms like ransomware and nation-state actors.


reasoning: Paragraph centrally describes a risk-based approach to identifying and overseeing cybersecurity risks from third parties like vendors and service providers, directly answering the Third-Party Risk question and distinguishing from general RMP via central focus on external parties. No domain terms passing ERM test, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph centrally describes vendor management process for cybersecurity, including reviews, contracts, assessments, and reassessments, directly answering 'How are third-party cyber risks managed?' (TP per Rule 3). No domain terms passing ERM test (all generic processes any ERM pro could describe), no firm-specific facts, no verifiable claims → Generic Boilerplate.


fact: Information Technology Automated Solutions (ITAS)

reasoning: Paragraph centrally describes third-party cybersecurity risk management via pre-engagement assessments, contractual security requirements, and ongoing audits, fitting Third-Party Risk; firm-specific due to named internal group ITAS handling vendor audits, elevating to Firm-Specific with no higher verifiable facts.


reasoning: This paragraph is speculative boilerplate warning of potential material adverse effects from cybersecurity incidents and cross-references Risk Factors, answering no substantive cybersecurity question per Rule 5 and 6, thus None/Other. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph centrally describes vendor risk assessments, due diligence levels, and cybersecurity contractual obligations imposed on third-party providers like CROs and CMOs, making Third-Party Risk the primary category per Rule 3 (requirements ON vendors). No domain terminology passing ERM test (generic 'risk assessments' and 'contractual obligations' could apply to any ERM risk), no firm-specific elements like named roles/committees, and no verifiable claims like quantities or dates → Generic Boilerplate.


reasoning: The paragraph primarily assesses the lack of material impact from cybersecurity incidents on business outcomes and references potential future effects, directly answering the Strategy Integration question per Rule 5 (backward-looking materiality statement). No domain terms passing the ERM test, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


fact: CISO

reasoning: Paragraph describes board/committee oversight of cybersecurity via regular briefings from CISO and management on topics like training and assessments, directly answering 'How does the board oversee cybersecurity?' (BG per governance-chain rule). Specificity reaches Firm-Specific due to mention of CISO as a cybersecurity leadership role; no domain terms pass ERM test beyond generic, no verifiable claims.


fact: Risk Committee of the Board

fact: Global Security Organization

fact: ERM Steering Committee

fact: CSO

fact: Disclosure Committee

reasoning: Paragraph describes board and committee oversight of cyber strategy, reporting flows from organization to ERM Steering Committee, Risk Committee, and Board, aligning with Board Governance as the primary oversight structure (governance-chain default to BG). Multiple named firm-specific entities (committees, organization, CSO role) elevate specificity to Firm-Specific, with no domain terms or verifiable facts present.


fact: firewalls

fact: intrusion prevention

fact: endpoint detection and response systems

fact: vulnerability assessments

fact: cybersecurity threat intelligence

reasoning: The paragraph details specific technical safeguards, tools, and processes in the cybersecurity program, directly answering 'What does the cybersecurity program do?' for Risk Management Process. Domain terms like 'endpoint detection and response,' 'intrusion prevention,' 'vulnerability assessments,' and 'cybersecurity threat intelligence' demonstrate cybersecurity expertise beyond generic ERM language, yielding Domain-Adapted specificity with no firm-specific roles or verifiable claims.


fact: On February 16, 2022, we became aware of a cybersecurity intrusion

fact: cybersecurity intrusion that caused a network disruption and impacted certain of our systems

reasoning: Paragraph primarily describes a specific past cybersecurity incident including timing, nature, scope, response actions, and non-material impact, fitting Incident Disclosure over Strategy Integration as the incident frame dominates despite potential future risks. Specificity reaches Quantified-Verifiable due to the externally verifiable specific date (February 16, 2022) tied to the real event.


fact: Chief Technology Officer

fact: Technology Leadership Centre

fact: Chief Risk Officer

fact: Risk Committee of the board of directors

fact: Controlling Department

reasoning: Paragraph describes the overall cybersecurity governance structure using a three-lines-of-defense model involving board committees (Risk and Audit), senior officers, and named teams, defaulting to Board Governance per Rule 1 as it outlines oversight chain. Multiple firm-specific named roles (CTO, CRO), committees (Risk Committee), and teams (Technology Leadership Centre, Controlling Department) drive Firm-Specific level with no higher verifiable facts.


fact: denial of service attacks

fact: malicious software attacks

category_confidence: medium

reasoning: Paragraph primarily addresses third-party cyber risks (card transaction processors, service providers) and vendor oversight via security assessments, which is the central topic with most text; past non-material incidents and impacts are secondary. Domain terms like 'denial of service attacks' and 'malicious software attacks' demonstrate cybersecurity expertise (pass ERM test), setting specificity to Domain-Adapted with no firm-specific or verifiable facts.


fact: threat intelligence services

fact: Third-Party Risk Management program

reasoning: The paragraph primarily describes the company's Third-Party Risk Management program, including requirements for third parties' security controls and compliance assessments, making Third-Party Risk the central topic over internal threat intelligence (RMP). Specificity reaches Firm-Specific due to the named 'Third-Party Risk Management program' (L3) and 'threat intelligence services' domain term (L2).


fact: security posture

reasoning: Paragraph describes board oversight of cybersecurity risks, including quarterly reports on security posture and events, and escalation of incidents above a threshold, directly answering 'How does the board oversee cybersecurity?'; 'security posture' is a domain-specific cybersecurity term passing the ERM test, elevating to Domain-Adapted, with no firm-specific roles or verifiable claims.


fact: incident response

fact: access control

reasoning: Paragraph describes cybersecurity processes, policies, and standards covering risk assessment, incident response, access control, and disaster recovery, directly answering 'What does the cybersecurity program do?' (RMP); domain terms like 'incident response' and 'access control' demonstrate cybersecurity expertise beyond generic ERM language, setting specificity to Domain-Adapted with no firm-specific or verifiable facts.


reasoning: Paragraph centrally describes oversight of cybersecurity risks from third parties like vendors and service providers, directly answering the Third-Party Risk question per Rule 3 (vendor oversight as central topic). No domain terminology passing ERM test, firm-specific facts (e.g., named roles/committees), or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


content_category: Management Role

fact: CSO

fact: Chief Information Officer

reasoning: The paragraph primarily describes the CSO's responsibilities, information flow, and reporting lines to the CIO and senior management, directly answering how management is organized to handle cybersecurity (MR per person-specific roles and reporting). Specific named roles (CSO, CIO) qualify as firm-specific facts, setting specificity to Firm-Specific with no higher verifiable claims.


fact: Director - Information Systems (i.e. the Company's chief information officer)

reasoning: Paragraph describes board oversight of cybersecurity via the Audit and Compliance Committee and its interaction with senior management including the CIO, directly answering 'How does the board oversee cybersecurity?' (BG per governance-chain rule). Specificity reaches Firm-Specific due to the named cybersecurity leadership role (CIO), a VP-level equivalent distinguishing the company's structure.


fact: recognized frameworks established by the National Institute of Standards and Technology

type: framework

fact: International Organization for Standardization

reasoning: Paragraph primarily describes Board oversight of cybersecurity as part of ERM (BG), with subordinate details on program integration and frameworks; NIST and ISO references are domain terms passing ERM test, elevating to Domain-Adapted with no higher facts.


reasoning: Paragraph primarily describes the incident response procedures, notification processes, and escalation for cybersecurity incidents, which remains substantive after removing person-specific content (person-removal test), making it RMP rather than MR or BG. No domain terms passing ERM test, no firm-specific roles beyond generic CEO/CFO/Board, and no verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is introductory boilerplate emphasizing the importance of cybersecurity without addressing any specific question like board oversight, management roles, or risk processes, making it None/Other. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: CIO

fact: CISO

fact: CIO has more than 30 years of experience

type: quantified

fact: CISO has more than 20 years of cybersecurity experience

fact: prior roles at Aegon N.V., Citigroup, Inc., JP Morgan Chase & Company

fact: Senior Vice President, Chief Information Security Officer at Brighthouse Financial

fact: Technology Vice President & Chief Information Security Officer for GE Healthcare

fact: started career at Allstate Insurance Company

fact: holds Certified Information Systems Auditor (CISA)

fact: holds Certified Information Security Manager (CISM)

fact: holds Certified Information Systems Security Professional (CISSP)

reasoning: Paragraph details management leaders' (CIO, CISO) qualifications, experience, and career history, directly answering 'How is management organized to handle cybersecurity?' per MR definition. Specificity reaches Quantified-Verifiable due to multiple verifiable facts like quantified years of experience (>30, >20), named prior firms, and specific certifications (CISA, CISM, CISSP).


fact: Chief Information Security Officer

fact: Trust, Security and Reliability department

fact: Cybersecurity Risk Management Team

reasoning: Paragraph primarily describes management roles (CISO oversight, named department and team) and their qualifications, fitting Management Role per person-removal test as it collapses without roles; firm-specific named roles and teams drive Firm-Specific level with no higher verifiable facts.


fact: vulnerability scans

reasoning: Paragraph centrally describes vendor management processes, assessments (including security questionnaires and vulnerability scans), and contractual cybersecurity obligations imposed on third-party providers, directly answering how third-party cyber risks are managed (TP per Rule 3). Specificity driven by domain term 'vulnerability scans' (passes ERM test as cybersecurity-specific practice), reaching Domain-Adapted; no firm-specific roles/committees or verifiable claims like numbers/dates/named firms.


fact: ransomware actors

fact: exfiltrated personal information

reasoning: This paragraph describes details of a real cybersecurity incident including ransomware exfiltration of personal information, investigation findings, and notifications, directly answering 'What happened in a cybersecurity incident?' (ID). Domain terms like 'ransomware' and 'exfiltrated' demonstrate cybersecurity expertise (Level 2), with no firm-specific roles or verifiable quantities elevating higher.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors, fitting 'None/Other' as it contains no substantive cybersecurity disclosure and merely points to content elsewhere. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, warranting Generic Boilerplate specificity.


fact: Cybersecurity Team

fact: Vice President and Chief Information Officer (CIO)

fact: Chief Information Security Officer (CISO)

fact: 27 years of cybersecurity experience

fact: 17 years in the oil and gas industry

fact: graduated from the FBI's CISO Academy in Quantico, Virginia

fact: one of less than 400 CISOs globally

fact: Cybersecurity Executive Committee

reasoning: Paragraph primarily describes management organization for cybersecurity, including team structure, reporting lines to CIO/CISO, their qualifications, and escalation to a named executive committee, fitting Management Role per person-removal test and Rule 1. Specificity reaches Quantified-Verifiable due to multiple hard numbers (27/17 years, <400 CISOs) and verifiable claims like FBI CISO Academy graduation, alongside firm-specific roles and named entities.


reasoning: Paragraph states no material cybersecurity incidents to date and describes potential business/operational/financial impacts of failures, directly answering how cybersecurity affects business outcomes per SI materiality rule (negative assertion); lacks any domain terms passing ERM test, firm-specific details, or verifiable facts, resulting in Generic Boilerplate.


reasoning: This paragraph provides no substantive cybersecurity disclosure, consisting of generic boilerplate about investments and protections with a cross-reference to Risk Factors, fitting None/Other. No specific facts, domain terms, firm-specific details, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: Service Organization Controls (SOC) reports

reasoning: Paragraph primarily details vendor due diligence (questionnaires using SOC reports), contractual security requirements, and ongoing monitoring for critical third-party providers, making third-party risk management the central topic per Rule 3 (TP). Specificity driven by domain term 'SOC reports' (passes ERM test as cybersecurity-specific evidence); no firm-specific roles/teams or verifiable claims like numbers/dates.


fact: February 2022 targeted cyber-attack

fact: CSRM program

reasoning: Paragraph primarily describes a real cybersecurity incident including timing (February 2022), scope (global systems shutdown), operational impact (~3 weeks disruption), and response (incident plan activation, investments), fitting Incident Disclosure over Strategy Integration as the event details dominate. Specificity reaches Quantified-Verifiable due to the specific date of the attack, with supporting firm-specific facts like CISO role and CSRM program.


reasoning: Paragraph focuses on pre-engagement evaluation, ongoing reviews, and contractual obligations for third-party vendors with access to customer data or networks, making third-party risk the central topic. No domain-specific cybersecurity terms passing ERM test, no firm-specific roles/committees/teams, and no quantifiable or verifiable facts, resulting in Generic Boilerplate specificity.


fact: ransomware incident

fact: fourth quarter of fiscal year 2019

fact: Note 18 to the consolidated financial statements in Part II, Item 8

reasoning: This paragraph details a specific past ransomware incident including timing (Q4 FY2019), nature (encryption and disruption), remediation (third-party experts, law enforcement), and impacts (costs, operations, revenue), directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to the verifiable specific date and financial note reference, alongside domain term 'ransomware'.


fact: Vice President of IT & Digitization

reasoning: Paragraph describes management oversight structure via VP of IT & Digitization and IT Team responsibilities/qualifications, directly answering 'How is management organized?' (MR per rules, person-removal leaves generic processes). Specificity driven by firm-specific VP-level role (Level 3); no domain terms pass ERM test, no verifiable facts.


fact: Chief Information Security Officer ("CISO")

fact: Executive Vice President and Chief Information Officer ("CIO")

reasoning: The paragraph primarily describes the cybersecurity program and its core activities (assessing, identifying, managing risks), passing the person-removal test for RMP over MR as a substantive program description remains. Firm-specific named roles (CISO, EVP/CIO) elevate specificity to Firm-Specific with no higher verifiable facts.


fact: incident response and breach management processes that principally consist of four interrelated steps: (1) preparing for a cybersecurity incident; (2) detecting and analyzing a cybersecurity incident; (3) containing, eliminating and recovering from the cybersecurity incident; and (4) analyzing the cybersecurity incident after it is resolved

fact: Board's Cybersecurity Special Committee

reasoning: Paragraph primarily describes the incident response and breach management processes (four steps, prioritization), answering 'What does the cybersecurity program do?' → RMP; person-removal test confirms substantive program details remain. Specificity driven by firm-specific named committee (Level 3) and domain-specific IR phases (Level 2), max Level 3.


reasoning: The paragraph details the risk assessment methodology within the cybersecurity program, directly answering 'What does the cybersecurity program do?' under Risk Management Process. It uses entirely generic language with no domain terms passing the ERM test, firm-specific facts, or verifiable claims, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes the board's oversight of cybersecurity risks, including delegation to the audit committee, directly answering the Board Governance question. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph introduces general reliance on technology and associated cybersecurity risks without addressing any substantive question about governance, management, processes, incidents, or strategy, making it None/Other. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: detected a cybersecurity incident in early April 2023

reasoning: This paragraph describes a specific cybersecurity incident including detection timing, investigation, and response actions, directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to the verifiable specific date 'early April 2023' tied to the event.


reasoning: This paragraph is pure speculation about potential cybersecurity risks and their hypothetical impact on business success, with no description of governance, roles, processes, incidents, or measures, fitting None/Other per Rule 6 and Rule 5 (speculative 'may' language). No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: Chief Operating Officer oversees cybersecurity policies and processes

reasoning: Paragraph describes the Chief Operating Officer's oversight role for cybersecurity, directly answering 'How is management organized to handle cybersecurity?' (MR per leadership responsibilities); person-removal test confirms MR over RMP as it collapses without the role. Specificity driven by firm-specific named leadership role (COO in cybersecurity context), elevating to Firm-Specific (Level 3); no domain terms or verifiable claims.


reasoning: This paragraph primarily describes the Board's direct oversight of cybersecurity risks within the ERM program, lack of delegation to committees, and how management provides updates, directly answering the Board Governance question. No domain-specific cybersecurity terminology, firm-unique roles/committees/programs, or verifiable facts like numbers/dates/certifications are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph details how the Board and Audit Committee oversee cybersecurity through regular reports on risks and updates on incidents, directly answering the Board Governance question about oversight structure and information flow. No domain-specific terminology, firm-unique facts (Audit Committee is generic), or verifiable claims are present, warranting Generic Boilerplate specificity.


reasoning: The paragraph primarily states a conclusion that cybersecurity risks and threats have not materially affected business strategy, results of operations, or financial condition, directly answering the Strategy Integration question per Rule 5 (backward-looking negative assertion). No specific facts elevate specificity: mentions of 'malware and computer virus attacks' are generic threats not passing the ERM test for domain expertise, with no firm-specific details, roles, or verifiable claims.


reasoning: This paragraph is a cross-reference to Item 1A risk factors, providing no substantive cybersecurity disclosure itself, fitting None/Other per Rule 6 and Rule 5. No specific facts of any level are present, resulting in Generic Boilerplate specificity.


fact: CISO

fact: Audit Committee is composed of the two members of the Board of Directors

reasoning: Paragraph describes board-level Audit Committee oversight via annual CISO briefings and overlap with Cybersecurity Executive Committee, directly answering board oversight and information flow (BG per Rule 1). Specificity reaches Quantified-Verifiable due to named CISO role (L3), named Cybersecurity Executive Committee (L3), and verifiable 'two members' composition (L4).


reasoning: The paragraph centers on processes to oversee third-party service providers' cybersecurity risks, including pre-engagement assessments and ongoing monitoring, directly matching Third-Party Risk as the central topic per Rule 3 (requirements imposed on vendors). Specificity is Firm-Specific due to the named CISO role, a firm-unique leadership fact elevating above Domain-Adapted.


reasoning: This paragraph primarily describes the Board's ultimate oversight responsibility for risk management, including through its committees and interaction with CEO/senior management, directly answering the Board Governance question about board oversight structure (governance-chain defaults to BG per Rule 1). No domain-specific cybersecurity terms, firm-unique facts (e.g., CEO and generic standing committees do not qualify), or verifiable claims anywhere, resulting in empty specific_facts and Generic Boilerplate specificity.


reasoning: Paragraph is a pure cross-reference to Item 1A Risk Factors for cybersecurity risks discussion, matching None/Other for cross-references with no substantive content. No domain terms passing ERM test, firm-specific facts, or verifiable claims present anywhere, confirming Generic Boilerplate.


fact: incident response plan including prioritization guidelines, data collection and evidence handling, communication channels and partners, law enforcement engagement

fact: evaluate security incidents on a scale of severity to determine incident handling protocols

reasoning: This paragraph details the components and processes of the incident response plan and incident evaluation, primarily answering 'What does the cybersecurity program do?' classifying as Risk Management Process. It demonstrates domain expertise through cybersecurity-specific practices like evidence handling and severity-based protocols (Level 2), with no firm-specific roles/committees or verifiable quantities/names (no Level 3/4).


fact: disclosure committee responsible for detecting and reporting cybersecurity incidents

fact: Employee Self Service portal

reasoning: Paragraph primarily describes board and audit committee oversight of cybersecurity risks, including briefings and governance structure, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1). Specificity reaches Quantified-Verifiable due to the specific date '2022' and named 'Employee Self Service portal' as verifiable facts anywhere in the text, with 'disclosure committee' as firm-specific.


reasoning: This paragraph states a conclusion on the lack of material past or likely future impact of cybersecurity risks on business outcomes, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments). No specific facts elevate specificity: it contains only a self-reported negative assertion without domain terms, firm-specific details, or verifiable claims, resulting in Generic Boilerplate.


reasoning: The paragraph primarily describes assessing key third-party service providers' security measures, compliance with laws, maintenance of reasonable measures, and breach reporting requirements, making third-party risk the central topic (TP per Rule 3). It contains no domain-specific cybersecurity terminology passing the ERM test, no firm-specific facts like named roles or committees, and no verifiable claims like numbers or dates, yielding Generic Boilerplate specificity.


reasoning: Paragraph details Audit Committee and Board oversight of cybersecurity risks, including ad hoc discussions, meeting considerations, and annual updates, directly answering 'How does the board oversee cybersecurity?' thus Board Governance. No domain terms passing ERM test, firm-specific elements (Audit Committee is generic), or verifiable facts, yielding Generic Boilerplate.


reasoning: This paragraph is a cross-reference to Item 1A risk factors, quoting speculative risk descriptions without any substantive cybersecurity disclosure on governance, processes, or incidents, matching N/O per rules. No domain terms passing ERM test, firm-specific facts, or verifiable claims anywhere, resulting in empty specific_facts and Generic Boilerplate.


reasoning: The paragraph centrally describes the process for assessing, reviewing, contracting, and monitoring cybersecurity risks from third-party vendors, directly answering the Third-Party Risk question and qualifying under Rule 3 as requirements imposed on vendors. No domain terms passing the ERM test (e.g., no specific tools, standards, or practices like SOC 2 or EDR), firm-specific elements (e.g., no named roles or committees), or verifiable facts (e.g., no quantities, dates, or named firms/products) are present, resulting in Generic Boilerplate specificity.


reasoning: This is a cross-reference to Item 1A Risk Factors with a quoted hypothetical 'could experience adverse consequences' boilerplate, matching Rule 5 and Rule 6 for None/Other as it lacks substantive cybersecurity measures or processes. No domain terms passing ERM test, firm-specific facts, or verifiable claims anywhere, confirming Generic Boilerplate.


reasoning: Paragraph primarily describes the cybersecurity program's processes for risk assessment, management, incident response, business continuity, system evaluations, and infrastructure enhancements (RMP), passing the person-removal test with substantive program details remaining; CISO mention is the sole firm-specific fact elevating specificity to Firm-Specific, with no domain terms or verifiable claims.


reasoning: The paragraph primarily describes how the company manages cybersecurity risks through third-party professional services, consulting firms, and service providers that maintain cybersecurity programs, making third-party risk management the central topic over RMP (external assessors as program component) or SI (subordinate materiality statement). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes the high-level nature of the information security program, including integration into operations and cross-functional approach with privacy objectives, primarily answering 'What does the cybersecurity program do?' → Risk Management Process. No domain terminology passing ERM test, firm-specific facts, or verifiable claims present anywhere → Generic Boilerplate.


reasoning: The paragraph primarily asserts that cybersecurity incidents have not materially affected business strategy, results of operations, or financial condition (SI per Rule 5 backward-looking materiality), with surrounding generic discussion of threats and high-level responses. No domain terms passing ERM test, firm-specific facts, or verifiable claims present anywhere, yielding Generic Boilerplate specificity.


fact: ransomware attack

fact: early 2019

fact: infiltrated and encrypted certain information technology systems, including systems containing critical business data

fact: full forensic analysis

fact: no evidence of malware, persistence mechanisms or other compromised exchange on-premises accounts

reasoning: This paragraph describes a specific past ransomware incident, including its nature, timing, response, recovery, and forensic findings, directly answering 'What happened in a cybersecurity incident?' thus Incident Disclosure. Specificity is Quantified-Verifiable due to the verifiable specific timeframe 'early 2019' tied to the real event, alongside multiple domain-specific cybersecurity terms like ransomware, forensic analysis, malware, and persistence mechanisms.


fact: ransomware attacks

fact: phishing attacks

fact: insider threats

fact: third-party attacks

reasoning: Paragraph primarily assesses cybersecurity's lack of material impact on business (negative assertion of no material incidents to date), fitting Strategy Integration per Rule 5; domain-specific threat types like ransomware and phishing elevate specificity to Domain-Adapted, with no firm-specific roles or verifiable claims.


reasoning: Paragraph describes third-party providers assessing and supporting the company's security program, monitoring, and breach response, which fits RMP as these are services hired to aid internal processes (Rule 3: third parties serving the company → RMP, not TP). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes high-level processes to assess, identify, and manage cybersecurity risks, with reliance on the Investment Adviser's program, directly answering the Risk Management Process question; it contains no domain-specific terminology passing the ERM test, no firm-specific roles/committees, and no verifiable facts, warranting Generic Boilerplate specificity.


reasoning: This paragraph primarily describes the Board's risk oversight function and delegation to the Audit Committee for cybersecurity oversight, directly answering the Board Governance question. It contains no domain-specific cybersecurity terminology beyond generic phrases, no firm-specific roles or committees beyond the standard Audit Committee, and no verifiable facts, warranting Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with quoted hypothetical risk language about potential adverse consequences, providing no substantive cybersecurity measures, processes, or events, thus classifying as None/Other per cross-reference and speculation rules. No domain terms, firm-specific details, or verifiable facts are present anywhere in the text, confirming Generic Boilerplate specificity.


reasoning: The paragraph primarily describes procedures to identify, mitigate, and assess cybersecurity risks from material third-party vendors and service providers, directly answering the Third-Party Risk question as the central topic. No domain terminology passing the ERM test, firm-specific facts, or verifiable claims are present, warranting Generic Boilerplate specificity.


fact: IS Steering Committee

fact: chaired by the Chief Information Officer

reasoning: Paragraph centers on the vendor management program for identifying, measuring, monitoring, and controlling risks from third-party service providers, with oversight by the IS Steering Committee, making third-party risk the primary topic over governance structure. Specificity reaches Firm-Specific due to the named IS Steering Committee and Chief Information Officer role, with no domain terms or verifiable facts elevating further.


reasoning: Paragraph provides backward- and forward-looking materiality assessments on cybersecurity's impact on business strategy, operations, and financial condition, directly matching Strategy Integration per Rule 5 (e.g., 'have not materially affected' and 'reasonably likely to materially affect'). No domain terms, firm-specific facts, or verifiable claims anywhere in the text, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with a quoted boilerplate speculation on potential cybersecurity risks, matching None/Other for cross-references and non-substantive content per Rule 6 and Rule 5. No specific facts of any level are present anywhere in the paragraph, confirming Generic Boilerplate specificity.


reasoning: The paragraph primarily describes the Board's active involvement in oversight of the risk management program with cybersecurity as a key ERM component, fitting Board Governance for oversight structure; no substantive management roles or program activities dominate. No domain-specific terminology, firm-unique facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


fact: Paresh Patel, one member of our Board of Directors, has information technology expertise

reasoning: Paragraph describes board oversight via periodic reports on risks/incidents and highlights a specific board member's IT expertise, directly answering 'How does the board oversee cybersecurity?'; named board member Paresh Patel with expertise is a firm-specific fact elevating to Firm-Specific, no domain terms or verifiable claims present.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with speculative language about potential impacts, fitting None/Other per Rule 5 (cross-references) and Rule 6 (no substantive cybersecurity disclosure). No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity with empty specific_facts.


reasoning: The paragraph primarily states conclusions about the lack of material past or likely future impacts from cybersecurity on business outcomes and mentions cyber insurance, directly answering the Strategy Integration question per materiality rule 5. No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states conclusions about no material past or likely future cybersecurity impacts on the business, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments); vague mentions of past threats lack incident details for ID. No domain terms passing ERM test, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily describes Board and Audit Committee oversight of cybersecurity risks, including integration into ERM and oversight of policies, processes, and strategies, directly answering the Board Governance question per Rule 1 (board-level committee focus). No domain terms passing the ERM test, firm-specific facts (Audit Committee is generic), or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily assesses that no cybersecurity risks or prior incidents have materially affected or are likely to affect business outcomes, directly answering a Strategy Integration question per Rule 5 (backward- and forward-looking materiality statements). No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


fact: Chief Technology Officer

reasoning: Paragraph describes management roles (CTO and IT Director) and their cybersecurity responsibilities/qualifications, fitting Management Role per person-removal test (collapses without roles) and Rule 1 (management-level). Specificity reaches Firm-Specific due to named VP-level role (CTO) distinguishing the company's structure; no domain terms or verifiable facts present.


reasoning: Paragraph describes high-level oversight structure with support from management, Board, and Audit Committee, answering 'How does the board oversee cybersecurity?' and defaulting to BG per Rule 1. No domain terms passing ERM test, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph defines terms by referencing SEC regulations, providing no substantive cybersecurity disclosure and fitting None/Other as a non-cybersecurity content or cross-reference. No specific facts of any level are present, resulting in Generic Boilerplate specificity.


fact: Vice President, Information Security and Privacy

fact: Senior Vice President, Chief Strategy and Digital Officer

reasoning: This paragraph describes Audit Committee oversight of cybersecurity risks, review topics, and briefing cadence by specific executives, directly answering 'How does the board oversee cybersecurity?' (BG). Firm-specific named VP-level security and digital roles elevate specificity to Firm-Specific (Level 3); no domain terms or verifiable claims present.


fact: Breach Response Team

reasoning: Paragraph describes the activities of the Breach Response Team in conducting tabletop exercises for incident simulation, risk analysis, and strategy development, directly answering 'What does the cybersecurity program do?' (RMP; person-removal test leaves substantive program description). Named 'Breach Response Team' is a firm-specific fact elevating to Firm-Specific, with no higher verifiable claims.


reasoning: Paragraph details the Audit Committee's oversight of cybersecurity risks, internal controls, and management reporting to the board/committee, directly answering board oversight question per BG definition and Rule 1 (board-level Audit Committee). No domain-specific terminology passing ERM test, firm-specific facts (e.g., Audit Committee is generic), or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes board-level oversight via the Audit Committee reviewing cybersecurity with management, fitting Board Governance as a governance-chain structure; General Counsel mention is subordinate. No domain terms, firm-specific roles (Audit Committee and General Counsel are generic), or verifiable facts, resulting in Generic Boilerplate specificity.


fact: ongoing ISO 27001 compliance certification

fact: merger with SomaLogic Operating Co, Inc. in early 2024

fact: early 2024 merger completion

reasoning: Paragraph describes post-merger cybersecurity integration activities like reviewing and deploying policies, procedures, and tools, primarily answering 'What does the cybersecurity program do?' (RMP). Specificity reaches Quantified-Verifiable due to verifiable facts like the named merger partner/date and SomaLogic's ongoing ISO 27001 certification.


reasoning: Paragraph describes reporting chain from IT director to CEO/CFO and audit committee/board on cybersecurity matters, including briefing frequency and escalation, directly answering board oversight structure (BG per Rule 1 for board-level audit committee). No domain terms passing ERM test, no firm-specific roles (Global Director of IT lacks security qualifier), no verifiable facts like numbers/dates/names, so empty specific_facts yields Generic Boilerplate.


fact: Vice President of Information Systems and Architecture (VP of IT)

reasoning: Paragraph focuses on the VP of IT's leadership role, team responsibilities, qualifications, and reporting lines for the Cybersecurity Program, directly answering 'How is management organized to handle cybersecurity?' per MR category and Rule 1/2. Specificity reaches Firm-Specific due to the named VP-level role with IT/security portfolio; no domain terms pass ERM test, no verifiable facts.


fact: Security Governance Council (SGC)

fact: chaired by our CISO

fact: members ... from Operations, Information Technology, Finance, Internal Audit, Legal, Human Resources and Organizational Development, and Risk Management

reasoning: Paragraph details the structure, leadership (CISO), membership (specific departments), and reporting of the management-level Security Governance Council, primarily answering how management is organized for cybersecurity → Management Role (management committee per Rule 1). Firm-specific facts include named committee, CISO role, and listed departments, setting specificity to Firm-Specific with no higher verifiable claims.


reasoning: The paragraph primarily states conclusions about no material past or reasonably likely future impacts from cybersecurity threats or incidents on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments); the cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims anywhere in the paragraph, resulting in Generic Boilerplate specificity.


fact: penetration testing

reasoning: Paragraph primarily describes the cybersecurity program's activities including risk assessment with consultants, policies/practices, frameworks, and third-party evaluations like penetration testing, answering 'What does the cybersecurity program do?' (RMP per Rule 3 as third parties are service providers to the program). Specificity is Domain-Adapted due to the domain term 'penetration testing' passing the ERM test; no firm-specific roles/committees or verifiable claims present.


reasoning: The paragraph primarily states a conclusion about no cybersecurity threats reasonably anticipated to materially affect business outcomes, directly matching Strategy Integration per Rule 5 (forward-looking materiality assessment). No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


fact: Enterprise Risk Management Committee

fact: Chief Information Officer

fact: Chief Risk Officer

fact: Risk Oversight Committee

fact: penetration test

fact: Information Systems Audit

reasoning: Paragraph primarily describes cybersecurity program activities like annual audits, penetration tests by third parties, and risk assessments triggered by threat changes, qualifying as Risk Management Process per Rule 2 (substantive program details remain post person-removal). Specificity reaches Firm-Specific due to named committees (Enterprise Risk Management Committee, Risk Oversight Committee) and cybersecurity-relevant C-level roles (CIO, CRO), with domain terms like penetration testing supporting but not exceeding L3.


reasoning: Paragraph centrally describes vendor oversight program for cybersecurity risks, including reviews of third-party cybersecurity controls based on risk factors, directly answering 'How are third-party cyber risks managed?' No domain terms passing ERM test (e.g., 'cybersecurity controls' and 'periodic reviews' are generic), no firm-specific roles/committees/teams, and no quantified or verifiable claims like numbers, dates, or named certifications/products.


fact: Chief Technology and Digital Officer

fact: Senior Vice President, Technology

fact: over 10 and 25 years, respectively, of networking and information technology management or executive experience

fact: Cybersecurity Committee

fact: comprised of representatives from key management groups including accounting, finance, legal, internal audit, and information technology

reasoning: Paragraph primarily describes management-level leadership roles (named officers with qualifications), Cybersecurity Committee structure/membership/composition, and reporting to senior management/Board, fitting Management Role per rules on management committees and person-removal test showing role focus. Specificity reaches Quantified-Verifiable due to verifiable quantified experience claims (over 10/25 years) and firm-specific elements like named VP-level roles and committee with specific departmental reps.


reasoning: Paragraph describes Board and Audit Committee oversight of cyber risk management and financial reporting of risks/incidents, directly answering 'How does the board oversee cybersecurity?' with no substantive program details, fitting Board Governance per governance-chain default. No domain terms passing ERM test, firm-specific facts (Audit Committee is generic), or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: reviews threat intelligence

fact: over thirty years of experience leading information technology teams in the life sciences industry

reasoning: Paragraph describes the Head of IT's leadership role, qualifications, experience, and specific cybersecurity-related activities like reviewing threat intelligence, directly answering 'How is management organized to handle cybersecurity?' (MR per person-removal test as it collapses without role/person details). Specificity reaches Quantified-Verifiable due to the verifiable 'over thirty years of experience' claim and domain term 'threat intelligence'.


reasoning: This paragraph is a cross-reference to the risk factors section in Item 1A, providing no substantive cybersecurity disclosure itself, fitting None/Other per rules on cross-references and N/O threshold. No specific facts, domain terms, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: corporate information security organization, led by our CISO

fact: CISO has a certificate in Cybersecurity Oversight from the Carnegie Mellon University Software Engineering Institute

fact: cyber threat detection and response

fact: security engineering

reasoning: Paragraph primarily describes the management structure via the CISO-led corporate information security organization, its responsibilities, and CISO qualifications, answering 'How is management organized?' (MR per person-removal test borderline but roles/qualifications dominant). Specificity reaches Quantified-Verifiable due to the named, externally checkable CISO certificate from Carnegie Mellon SEI, plus firm-specific CISO role and domain terms like cyber threat detection.


reasoning: Paragraph primarily describes management's responsibilities for cybersecurity programs, their qualifications via education and experience, and monitoring via teams, directly answering 'How is management organized to handle cybersecurity?' (MR); no domain terms passing ERM test, no firm-specific roles/teams/committees, and no verifiable claims, resulting in Generic Boilerplate specificity.


fact: penetration tests

reasoning: Paragraph primarily describes management's organizational roles and responsibilities in overseeing cybersecurity policies, incident response testing, vendor engagements, and participation on the incident response team, fitting Management Role per Rule 2 (focus on who is responsible rather than program activities alone). Specificity is Domain-Adapted due to the domain term 'penetration tests' passing the ERM test; no firm-specific roles or verifiable claims present.


reasoning: Paragraph primarily describes board-level oversight via the Audit Committee, including reporting frequency from the CFO and committee review of cybersecurity risks and controls, aligning with Board Governance for oversight structure (governance-chain focus). No domain terms passing ERM test, no firm-specific roles/committees (CFO and Audit Committee are generic), and no verifiable facts like numbers/dates/names, resulting in Generic Boilerplate specificity.


fact: Senior Director of Information Technology

fact: over 25 years of work experience in various roles in information technology and cybersecurity

reasoning: Paragraph primarily describes management roles (Senior Director of IT and CFO) and their qualifications responsible for implementing cybersecurity processes, fitting Management Role per person-removal test (collapses without persons) and MR focus on organization/credentials. Specificity reaches Quantified-Verifiable due to the hard lower-bound fact 'over 25 years of work experience', verifiable against credentials, with named_role also elevating.


fact: CISO

fact: CPO

fact: CIO

fact: VP of Global IT Security

fact: Certified Information Systems Auditor

fact: Certified Information Systems Security Professional

fact: Fellow of Information Privacy

fact: Certified Information Privacy Professional

fact: Incident Response team

reasoning: Paragraph primarily describes management leadership roles (CISO, CPO, CIO, VP of Global IT Security), their qualifications, experience, and team structure like the Incident Response team, answering 'How is management organized?' per MR category and Rule 2 person-removal test. Specificity reaches Quantified-Verifiable due to named VP-level roles (Level 3) and specific certifications held by leaders (Level 4, externally verifiable via registries).


reasoning: This paragraph is aspirational forward-looking language about minimizing risks without describing any specific cybersecurity measures, processes, or assessments, fitting None/Other as pure speculation. No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph primarily assesses past and expected materiality of cybersecurity impacts on business, finances, and strategy, with statements on no material incidents to date and threats not reasonably likely to materially affect operations, fitting SI per Rule 5; no domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate.


reasoning: Paragraph primarily describes Audit Committee oversight of cybersecurity risks via ERM program, including annual assessments and quarterly updates, directly answering 'How does the board oversee cybersecurity?' (BG). No domain-specific cybersecurity terms (passes ERM test), firm-specific facts (e.g., Audit Committee is generic), or verifiable claims (generic cadences like 'annually/quarterly' don't qualify), resulting in Generic Boilerplate.


fact: Director of Information Security

fact: OD Technology Department

fact: Risk Committee

fact: over 30 years in information technology and information security

fact: Certified Information Systems Security Professional (CISSP)

fact: prevention, detection, mitigation and remediation of cybersecurity threats and incidents

reasoning: Paragraph primarily describes management organization including the Director of Information Security's qualifications, role, team collaborations (OD Technology Department, multidisciplinary teams), and reporting to the Risk Committee, fitting Management Role over RMP (person-removal leaves program descriptions but focus is on roles/structure) or BG (management-focused not board oversight). Specificity reaches Quantified-Verifiable due to verifiable CISSP certification and quantified 'over 30 years' experience, plus firm-specific roles/committees/teams and domain terms.


fact: Chief Information Officer ("CIO")

fact: Chief Information Technology Architect & Chief Information Security Officer ("CISO")

reasoning: Paragraph describes board committee oversight of cybersecurity via reports, briefings, and incident updates, with flow to full board, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity reaches Firm-Specific due to named executive cybersecurity roles (CIO/CISO), with no domain terms or verifiable claims present.


fact: Lead IT Systems Specialist

fact: Directors of Banking and Mortgage

fact: Corporate Security

reasoning: Paragraph describes cross-functional team composition and specific roles involved in incident response teams, fitting Management Role (team structure and membership) per person-removal test where removing roles leaves generic process; firm-specific facts like 'Lead IT Systems Specialist' and 'Directors of Banking and Mortgage' elevate to Firm-Specific, no domain terms or verifiable claims.


reasoning: Paragraph primarily describes the Board's oversight of the cybersecurity program, including expertise, strategic review, and resource allocation, fitting Board Governance. No domain terminology passing ERM test, firm-specific facts (e.g., named roles or committees), or verifiable claims present, resulting in Generic Boilerplate.


fact: Director of Global Information Systems

reasoning: Paragraph primarily describes board and Audit Committee oversight of cybersecurity, including information flow from Director and audits, answering 'How does the board oversee cybersecurity?' (BG per governance-chain rule). Specificity driven by firm-specific named role 'Director of Global Information Systems' (Level 3); no domain terms pass ERM test beyond generic oversight, no verifiable claims.


fact: In February 2024, the Board delegated to its Audit Committee oversight of cybersecurity and other information technology risks

reasoning: Paragraph describes board-level oversight structure, delegation to Audit Committee, and reporting flows from executives to board/committee, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1). Specificity reaches Quantified-Verifiable due to the verifiable specific date of delegation in February 2024.


fact: hotel manager, Our Town

reasoning: The paragraph centers on lack of control over and reliance on third-party hotel manager 'Our Town' and franchisors for cybersecurity risk management, directly answering the Third-Party Risk question. Specificity is Firm-Specific due to the named firm 'Our Town' in a cybersecurity context, distinguishing this company's posture.


reasoning: Paragraph speculates on hypothetical cybersecurity risks, impacts, and cross-references Item 1A without describing oversight, processes, roles, incidents, or assessments, matching Rule 5 speculation as None/Other. No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere.


fact: HITRUST and SOC2 frameworks

fact: penetration testing and threat modeling

fact: network firewalls and access controls

fact: vulnerability scanners

fact: intrusion prevention and detection systems

fact: identity and access management systems

fact: vulnerability assessments

fact: cybersecurity threat intelligence

fact: phishing email simulations

fact: tabletop exercises

fact: Incident Response Plan based upon NIST, HITRUST, and SOC2 frameworks

reasoning: The paragraph details the company's cybersecurity program activities, including risk assessments, technical controls, training, and incident response processes, directly answering 'What does the cybersecurity program do?' (RMP); third-party elements are subordinate components of the internal program. Specificity reaches Domain-Adapted due to numerous cybersecurity-specific terms like HITRUST/SOC2/NIST frameworks, penetration testing, endpoint protection, and phishing simulations that demonstrate domain expertise beyond generic ERM language, with no firm-specific roles/committees or verifiable quantities/dates.


fact: Senior Vice President and Chief Information Officer ("CIO")

fact: over 25 years of IT Risk Management experience

fact: team of personnel with more than 30 years of collective information and product security experience

reasoning: Paragraph primarily describes management's organization for cybersecurity, focusing on CIO role, qualifications, team composition/experience, and reporting lines (MR per Rule 1/2); contains verifiable quantified experience claims (>25 years individual, >30 years collective) driving Level 4 specificity.


reasoning: Paragraph describes the information systems organization's responsibilities, composition by education/experience, and training, directly answering 'How is management organized to handle cybersecurity?' (MR); no domain terms passing ERM test, firm-specific roles/teams, or verifiable facts found anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph details Board and Audit Committee oversight of cybersecurity risks, including update frequency from the CFO and management, fitting Board Governance as it describes the oversight structure and information flow. No domain terminology passing the ERM test, firm-specific elements beyond generic roles like Audit Committee or CFO, or verifiable facts are present, warranting Generic Boilerplate specificity.


fact: Chief Information Consultant

reasoning: Paragraph describes oversight structure with information flowing from Chief Information Consultant and CFO to the Audit Committee of the Board for enterprise risk evaluation, fitting Board Governance per governance-chain rule and Rule 1. Specificity driven by firm-specific named role 'Chief Information Consultant' (Level 3), with no domain terms or verifiable facts elevating higher.


reasoning: This paragraph primarily assesses and concludes that no known cybersecurity risks are reasonably likely to materially affect the business, directly answering a Strategy Integration question per Rule 5 (materiality assessment, negative assertion). No specific facts elevate specificity: the negative materiality claim is a self-reported assertion (not externally verifiable), vague process reference lacks domain terms or details, and the cross-reference is non-substantive per Rule 5 and N/O threshold.


fact: CTO, Vaidyanathan Raghavan

fact: previously served as the General Manager of Technology at Wayfair

fact: holds a Master of Science in Electrical Engineering degree from the University of Minnesota

fact: Vice President of Information Technology and Security, Mr. Brendan Hamilton

fact: Certified Information Systems Security Professional

reasoning: Paragraph primarily describes management roles, qualifications, and career histories of specific leaders responsible for cybersecurity processes, fitting Management Role per person-removal test (collapses without personnel details). Specificity reaches Quantified-Verifiable due to named individuals, prior roles at named firms (Wayfair), specific degrees/universities, and CISSP certification, all externally verifiable.


fact: in December 2021, we experienced a targeted cyber-attack

fact: in March 2024, our Canadian subsidiary experienced a targeted cybersecurity breach

fact: disruption to our operations for approximately two weeks

fact: operations systems were restored...within one week

fact: identified by our end point protection software

fact: Canadian subsidiary

reasoning: This paragraph details two actual cybersecurity incidents with specifics on timing, nature, scope, impact, detection, response, and remediation, directly answering 'What happened in a cybersecurity incident?' and fitting Incident Disclosure per rules. Specificity is Quantified-Verifiable due to verifiable specific dates (December 2021, March 2024), quantified timelines (two weeks, one week), and domain terms like endpoint protection software.


fact: SVP of IT Security

reasoning: Paragraph describes Audit Committee oversight, briefing frequency, and information flow from SVP to the board, directly answering 'How does the board oversee cybersecurity?' → Board Governance per governance-chain rule. Specificity driven by firm-specific named role 'SVP of IT Security' (Level 3); no domain terms pass ERM test and no verifiable claims present.


reasoning: The paragraph describes an incident response process that includes materiality determinations for cybersecurity events and states no material impacts to business strategy, operations, or finances, directly answering how cybersecurity affects the business per Rule 5's materiality assessment and conclusion criteria for Strategy Integration (overlaps with RMP but SI frame dominates). No domain terminology passing ERM test, firm-specific elements (e.g., generic 'Incident Response Team' and 'major business areas' not qualifying), or verifiable facts present anywhere, yielding Generic Boilerplate.


reasoning: This paragraph is a cross-reference to Item 1A risk factors with quoted generic risk descriptions about potential cybersecurity threats and compliance failures, providing no substantive disclosure on oversight, processes, or incidents, thus None/Other per rules 5 and 6. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate.


reasoning: Paragraph states a negative assertion of no breaches in a specific period and concludes no risks reasonably likely to materially affect business/financials, directly answering Strategy Integration's question on cybersecurity's business impact per materiality rule (negative assertions → SI); no qualifying specific facts (negative assertions and reporting period dates are not verifiable, no domain terms or firm-specific elements pass filters).


reasoning: Paragraph centrally describes periodic assessments and due diligence on IT suppliers handling customer data, directly answering third-party risk management question per Rule 3 (requirements imposed on vendors). No domain-specific cybersecurity terms passing ERM test, no firm-specific roles/committees/teams, and no quantified or verifiable claims, resulting in Generic Boilerplate specificity.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

fact: HIPAA

fact: Service Organization Control Type 2 (SOC 2 Type II)

fact: Sarbanes-Oxley IT General Controls (SOX ITGC)

reasoning: Paragraph describes the cybersecurity risk management program, its purpose (protect CIA triad), and referenced frameworks for assessing and managing risks, directly answering 'What does the cybersecurity program do?' (RMP). Specificity is Domain-Adapted due to named cybersecurity frameworks (NIST CSF, HIPAA, SOC 2 Type II, SOX ITGC) that demonstrate domain expertise beyond generic ERM language; no firm-specific roles or verifiable claims present.


reasoning: Paragraph centrally describes vendor management processes including assessments, security questionnaires, and contractual cybersecurity obligations, directly answering how third-party cyber risks are managed (TP). No domain terminology passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes board oversight via annual reports and incident updates from management, directly answering 'How does the board oversee cybersecurity?' with no domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states conclusions about no material past cybersecurity incidents and potential future material effects on business/financials, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments); generic investments and cross-reference are secondary. No domain terms passing ERM test, firm-specific facts, or verifiable claims (negative assertions not QV), resulting in Generic Boilerplate specificity.


fact: uses the Ontrack software solution ("Ontrack")

reasoning: Paragraph describes the use of a specific tool for risk monitoring, assessment tracking, incident tracking, and remediation, directly answering 'What does the cybersecurity program do?' (RMP). Specificity reaches Quantified-Verifiable due to the named software solution 'Ontrack', a verifiable claim about their technology stack.


reasoning: Paragraph primarily describes Board oversight of cybersecurity risks, including update frequency, presentations by Director of IT, escalation processes, and third-party testing engagements, directly answering 'How does the board oversee cybersecurity?'; no domain-specific terminology, firm-unique facts, or verifiable claims present, as all elements (e.g., 'Director of IT' lacks security qualifier, 'quarterly' is generic cadence) fail specificity thresholds.


reasoning: Paragraph describes board-level oversight of cybersecurity risks via delegation to the Audit Committee, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1). No domain terms passing ERM test, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph centrally describes vendor selection, oversight, due diligence, and monitoring of cybersecurity risks from third-party service providers with data access, directly answering the Third-Party Risk question. No domain-specific terminology, firm-unique facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: CTO

fact: IT Manager

reasoning: Paragraph describes management's roles and responsibilities in overseeing cybersecurity, including specific leaders like CTO and IT Manager, fitting Management Role per person-removal test (focus on who is responsible). Specificity reaches Firm-Specific due to named leadership roles (CTO qualifies as VP-level+ with IT/cyber portfolio; IT Manager noted but doesn't elevate further).


fact: Topper Group employees

reasoning: The paragraph primarily assesses the lack of material impact from past cybersecurity incidents and states that risks are not reasonably likely to materially affect operations, directly answering a Strategy Integration question per Rule 5 (backward- and forward-looking materiality). Specificity reaches Firm-Specific due to the named 'Topper Group' as a distinguishing entity in the context of affected data, with no domain terms or verifiable claims present.


reasoning: Paragraph is a pure cross-reference to Item 1A Risk Factors, matching N/O for cross-references with no substantive cybersecurity content. No specific facts of any level found, confirming Generic Boilerplate.


fact: phishing attacks

fact: malware infections

fact: unauthorized access attempts

reasoning: Paragraph assesses non-material impact of past cybersecurity attempts and future risks, directly answering how cybersecurity affects business/financial outcomes (SI per Rule 5 negative materiality assertion); domain terms like phishing and malware elevate specificity to Level 2 as they demonstrate cybersecurity expertise beyond generic ERM language.


reasoning: Paragraph primarily describes Board and Audit Committee oversight of cybersecurity risks and risk management processes, directly answering the Board Governance question per category rules (board-level committee oversight). No domain terminology passing ERM test, firm-specific facts (e.g., Audit Committee is generic), or verifiable claims found anywhere, yielding Generic Boilerplate specificity.


reasoning: Paragraph describes board oversight of risk management including cybersecurity and how executives report to the board, directly answering 'How does the board oversee cybersecurity?' with governance-chain structure (BG per Rule 1). No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a generic boilerplate statement expressing general commitment to cybersecurity without describing any specific oversight structure, roles, processes, incidents, or impacts, fitting None/Other. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: Chief Technology Officer

reasoning: Paragraph details Audit Committee reporting to the Board on cybersecurity, regular briefings from management, and presentations from the CTO and team, primarily describing board oversight structure → Board Governance. Specificity is Firm-Specific due to the named CTO role, a VP-level leadership position in IT/cybersecurity.


fact: recognized frameworks established by the National Institute of Standards and Technology

fact: International Organization for Standardization

reasoning: Paragraph primarily describes Board oversight of cybersecurity as part of ERM, with integration into risk management, fitting Board Governance per governance-chain rule. Specificity at Domain-Adapted due to named cybersecurity frameworks (NIST, ISO) passing ERM test, no firm-specific or verifiable facts.


reasoning: This paragraph is generic boilerplate expressing commitment to cybersecurity without answering any substantive question about governance, roles, processes, third-parties, incidents, or strategy; no specific facts, domain terms, firm-specific details, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: leverages the NIST Framework

reasoning: Paragraph primarily describes the cybersecurity program's foundation, framework adoption (NIST), and processes/tools for risk management, incident handling, and protection, directly answering 'What does the cybersecurity program do?' → RMP. Specificity driven by NIST Framework reference (domain expertise via named standard), with no firm-specific roles or verifiable claims.


fact: NIST CSF principles: Identify, Protect, Detect, Respond, and Recover

reasoning: Paragraph describes the cybersecurity program's framework adoption (NIST CSF) and components (incident response plan), directly answering 'What does the cybersecurity program do?' → Risk Management Process. Specificity driven by named framework and its core functions, demonstrating domain expertise (Level 2); no firm-specific roles or verifiable claims.


reasoning: Paragraph primarily states conclusions on no material past or likely future cybersecurity impacts to business strategy, results, or financial condition, fitting Strategy Integration per materiality rule (Rule 5); cross-reference is secondary. No domain terminology passing ERM test, firm-specific facts, or verifiable claims (negative assertions not verifiable), resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily describes the board's oversight of cybersecurity risks and delegation to the audit committee, fitting Board Governance per governance-chain rules. No domain terminology passing the ERM test, firm-specific facts (e.g., Audit Committee is generic), or verifiable claims are present, warranting Generic Boilerplate specificity.


reasoning: Paragraph states a conclusion on no material cybersecurity impacts in the last three fiscal years, fitting Strategy Integration per Rule 5 (negative assertion about business/financial effects); cross-reference is secondary. No domain terms, firm-specific facts (e.g., roles, committees), or verifiable claims (negative assertions and soft timeframe not qualifying), so Generic Boilerplate.


reasoning: The paragraph primarily describes board-level oversight via the Audit Committee, including reporting, reviews, and escalation to the full Board, with management roles mentioned as part of the governance chain, defaulting to BG per Rule 1. No domain terms passing ERM test, no firm-specific roles (COO and Senior Director of IT are generic or lack security qualifier), and no verifiable facts, resulting in Generic Boilerplate specificity.


fact: Chief Information Security Officer (CISO)

fact: information security risk committee

reasoning: Paragraph primarily describes management-level organization including a named committee chaired by the CISO and monthly reporting to senior leadership, fitting Management Role per Rule 1 (management-level committee structure). Specificity reaches Firm-Specific due to named CISO role and named committee, with no higher verifiable facts.


reasoning: Paragraph speculates on general cybersecurity risks and potential impacts without describing oversight, roles, processes, incidents, or strategy, fitting None/Other per Rule 6 (no substantive measures) and Rule 5 (speculative 'could materially affect'). None/Other mandates Generic Boilerplate specificity with empty specific_facts.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with quoted section titles, matching the N/O rule for cross-references and containing no substantive cybersecurity disclosure. No specificity-elevating facts (domain terms, firm-specific details, or verifiable claims) are present anywhere in the text, resulting in Generic Boilerplate.


reasoning: The paragraph primarily assesses that no cybersecurity threats have materially affected or are likely to affect business strategy, results of operations, or financial condition, directly answering a Strategy Integration question per Rule 5's materiality assessment criteria, with cross-reference as secondary. No domain terms, firm-specific facts, or verifiable claims (negative assertions not QV) anywhere, driving Generic Boilerplate specificity.


fact: Mr. Lee

reasoning: Paragraph describes how a management figure (Mr. Lee) provides updates on cybersecurity incidents and threats to the Board and Audit Committee, directly answering the Board Governance question of information flow and oversight structure. Specificity reaches Firm-Specific due to the named individual 'Mr. Lee' in a cybersecurity reporting context, with no higher verifiable facts.


reasoning: Paragraph is a cross-reference to Item 1A risk factors with speculative language and no substantive cybersecurity measures, processes, or assessments described, per Rule 5 and Rule 6 → None/Other. No domain terms, firm-specific facts, or verifiable claims anywhere → Generic Boilerplate.


reasoning: The paragraph primarily states conclusions about the absence of material past or likely future cybersecurity impacts on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments). No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph centrally describes vendor due diligence, periodic reviews, and contractual requirements for incident reporting and insurance, directly answering how third-party cyber risks are managed (TP). No domain-specific cybersecurity terminology passing ERM test, no firm-specific roles/committees/teams, and no verifiable quantities, dates, or named entities, resulting in Generic Boilerplate specificity.


reasoning: Paragraph primarily states conclusions about no material past or likely future cybersecurity impacts on business strategy, operations, or finances, and notes insurance coverage, fitting Strategy Integration per Rule 5 materiality assessments; no domain terminology passing ERM test, firm-specific facts, or verifiable claims (negative assertions and generic insurance are not qualifying), resulting in empty specific_facts and Generic Boilerplate specificity.


reasoning: This paragraph directly assesses the lack of material impact from cybersecurity threats and past incidents on business strategy, operations, and finances, fitting Strategy Integration per the materiality rule for backward- and forward-looking statements. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: Vice President and Chief Information Officer

fact: Director of Information Security

fact: Information Security Committee

fact: 27 years of technology leadership experience

fact: Doctor of Business Administration

fact: 27 years of experience in infrastructure and security operations

fact: degree in Information Technology Management

fact: Director of Information Security is the chair of the Information Security Committee

fact: Executive Information Security Oversight Committee comprised of VP CIO, SVP CFO, SVP CLO and Secretary, SVP CHRO

reasoning: Paragraph primarily describes management roles, responsibilities, qualifications, reporting lines, and committee structures led by VP CIO and Director of Information Security, fitting Management Role per person-centric focus and Rule 1/2. Specificity reaches Quantified-Verifiable due to multiple verifiable facts like '27 years of experience' (quantified) and specific degrees/roles that could be independently confirmed.


reasoning: Paragraph primarily assesses materiality of cybersecurity risks to business strategy, results of operations, and financial condition, matching Strategy Integration per Rule 5 (backward- and forward-looking materiality statements and negative assertion). No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily states conclusions about the lack of material past and future impact of cybersecurity on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5; the cross-reference is secondary. No specific facts elevate specificity: negative materiality assertions are not verifiable, and the risk factor reference lacks domain terms, firm-specific details, or quantifiable claims.


reasoning: This paragraph is generic boilerplate expressing a high-level commitment to cybersecurity integrated into operations without addressing any specific question about governance, roles, processes, incidents, or impacts, classifying it as None/Other. It contains no domain terminology, firm-specific details, or verifiable facts, warranting Generic Boilerplate specificity.


reasoning: This paragraph primarily describes Board and Audit Committee oversight of cybersecurity risk assessment and management processes, directly answering the Board Governance question per Rule 1 (board-level oversight). No domain terminology passing the ERM test, firm-specific facts (Audit Committee is generic), or verifiable claims are present anywhere in the text, confirming Generic Boilerplate specificity.


fact: Senior Director, Information Technology

fact: Incident Response Team, which includes our Senior Vice President, Finance and our General Counsel

fact: over twenty years of experience operating in the information technology, security and cybersecurity space

fact: experience with cybersecurity assessment and prevention, incident responses, breach notifications and remediation

reasoning: Paragraph primarily describes management roles, team composition (Incident Response Team members), responsibilities for assessing/managing cyber risks, and leader qualifications, fitting Management Role per person-removal test (collapses without persons, no program activities remain). Specificity reaches Quantified-Verifiable due to 'over twenty years of experience' (verifiable lower-bound quantity) and firm-specific elements like named IT leadership role and team structure.


fact: cybersecurity incident response processes

fact: vulnerability management processes

reasoning: Paragraph describes cybersecurity program activities including incident response escalation, vulnerability management, reporting on measures, mitigation, and remediation, which survives person-removal test for RMP over MR. Domain terms like 'vulnerability management' and 'cybersecurity incident response' demonstrate cybersecurity expertise passing ERM test for Domain-Adapted, with no firm-specific roles or verifiable claims elevating higher.


reasoning: The paragraph centers on identifying and overseeing cybersecurity risks from third-party suppliers, vendors, and service providers, directly addressing Third-Party Risk management. It contains no domain terminology passing the ERM test, no firm-specific roles or committees, and no verifiable facts, warranting Generic Boilerplate specificity.


fact: GDPR

reasoning: The paragraph primarily describes the cybersecurity program's frameworks, tools, processes for threat identification/monitoring/response, and ERM integration, directly answering 'What does the cybersecurity program do?' (RMP); third-party mention and board notification are subordinate. Specificity is Domain-Adapted due to named frameworks (ISO 27001, NIST 800-53, GDPR) demonstrating cybersecurity domain expertise via ERM test-passing terminology, with no firm-specific roles/teams or verifiable quantities.


fact: subject our information technology systems to testing performed by external parties on an annual basis

fact: ISO 27001 certification

reasoning: Paragraph describes cybersecurity program activities like control reviews, external testing, employee training, training effectiveness testing, and third-party assistance for internal security, directly answering 'What does the cybersecurity program do?' (RMP); third-parties are used to support internal program (Rule 3). Specificity driven by ISO 27001 certification claim ('recently obtained our second'), a verifiable fact via certification bodies, elevating to Quantified-Verifiable despite other domain terms like annual external testing.


fact: Senior Vice President – Technology Solutions

fact: over four years in this role

fact: more than 25 years of experience in the aggregate

fact: more than ten years with the Company

reasoning: Paragraph primarily describes board-level audit committee oversight of cybersecurity risks, reporting from management including the SVP, and oversight structure, fitting Board Governance per Rule 1 (board committee focus and governance chain). Specificity reaches Quantified-Verifiable due to multiple verifiable quantified claims about the SVP's tenure and experience, plus a firm-specific named VP-level role.


reasoning: Paragraph describes using a third-party assessor for the company's own cybersecurity processes, which fits Risk Management Process per Rule 3 (third parties serving the company → RMP, not TPR). No domain terms, firm-specific facts, or verifiable claims present; generic language fails ERM test for Level 2.


reasoning: The paragraph primarily describes the cybersecurity program's activities, including risk assessments, safeguard evaluation and mitigation, monitoring, testing, and employee training, making it Risk Management Process per the person-removal test where program activities remain substantive. No domain terms passing the ERM test, firm-specific roles beyond generic CEO/IT leadership, or verifiable facts are present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph explains the SPAC's lack of operations and absence of its own cybersecurity personnel or processes, with only generic reliance on third parties mentioned, fitting None/Other per Rule 6 for no-operations companies without substantive disclosure; no domain terms, firm-specific facts, or verifiable claims found anywhere.


reasoning: Paragraph primarily describes the executive team's oversight of cybersecurity operations and regular updates to the Board/audit committee, detailing information flow in the governance chain, which fits Board Governance per Rule 1. No domain terminology passing the ERM test, firm-specific elements like named roles or committees beyond generics, or verifiable facts are present, warranting Generic Boilerplate specificity.


reasoning: This paragraph states a conclusion about no known cybersecurity incidents materially affecting business outcomes, directly matching Strategy Integration's materiality assessment rule for negative assertions. No domain terms passing ERM test, firm-specific facts, or verifiable claims (negative self-assertion not verifiable), so Generic Boilerplate specificity.


reasoning: Paragraph details responsibilities of management roles (Senior Director of IT and General Counsel) for cybersecurity, directly answering 'How is management organized to handle cybersecurity?' per MR definition and person-removal test showing role focus over program activities. No domain terms passing ERM test, no firm-specific roles (titles lack VP-level or security qualifiers), and no verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with no substantive cybersecurity disclosure, fitting None/Other per rules on cross-references. No specific facts, domain terms, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: Global Director of IT

fact: over 30 years of experience in various information technology roles, which experience includes management of cybersecurity matters

fact: over 20 years of experience as an IT Director

fact: CFO has over 10 years of experience in risk management at the Company and at similar companies, including risks arising from cybersecurity threats

reasoning: Paragraph primarily describes management roles (Global Director of IT, CEO, CFO), their cybersecurity responsibilities, and qualifications/experience, fitting Management Role per person-removal test (collapses without roles) and MR vs BG/RMP rules. Specificity reaches Quantified-Verifiable due to multiple lower-bound experience years ('over 30', 'over 20', 'over 10') that are externally checkable against resumes, plus firm-specific 'Global Director of IT' role.


reasoning: The paragraph centrally describes the vendor management process for assessing and imposing cybersecurity requirements on third-party providers, directly answering the Third-Party Risk question. No domain terminology passing the ERM test, firm-specific elements, or verifiable facts are present, resulting in Generic Boilerplate specificity.


fact: Senior Director - Information Security

fact: over 15 years' experience in the information technology and cybersecurity field

fact: over 15 years' experience in auditing information security

fact: previous roles in information security architecture

fact: CISO Academy Workshop

fact: BA in math and computer science from Ohio Wesleyan University

fact: holds an Information Systems Auditor certification

reasoning: Paragraph details the qualifications, experience, education, and certifications of the Senior Director - Information Security, directly answering 'How is management organized to handle cybersecurity?' via leadership credentials (MR per person-removal test: removes all program content). Specificity reaches Quantified-Verifiable due to multiple verifiable facts like 'over 15 years' experience' (checkable lower bound), named university, specific certification, and workshop.


reasoning: This paragraph states a conclusion about no material past or likely future cybersecurity impacts on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assertions). No specific facts elevate specificity: negative assertions are not verifiable, and there are no domain terms, firm-specific details, or quantified claims.


fact: Chief Information Officer ("CIO")

reasoning: This paragraph primarily describes board-level oversight of cybersecurity risks, including reviews, updates from management, and sessions with the CIO, directly answering the Board Governance question; it defaults to BG per Rule 1 as it outlines the oversight structure. Specificity reaches Firm-Specific due to the named CIO role (Level 3 firm-specific fact), with no higher verifiable claims or domain terms elevating it further.


reasoning: This is a fragmentary speculative risk statement about potential disruptions from cyber incidents or regulations, matching pure speculation without measures (Rule 6, Rule 5), so None/Other. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in empty specific_facts and Generic Boilerplate.


fact: fourth quarter of fiscal 2025

fact: Cybersecurity Incident

reasoning: Paragraph details a specific cybersecurity incident including timing (Q4 FY2025), nature (unauthorized activity on IT systems), response (incident response plan, containment, systems offline), and impacts, directly answering 'what happened' per ID definition with incident frame dominant over financials. Specificity reaches Quantified-Verifiable due to the specific fiscal quarter date and named 'Cybersecurity Incident' as verifiable event facts.


reasoning: Paragraph describes a named individual's general professional experience with no reference to cybersecurity, board oversight, management roles, processes, incidents, or strategy, fitting None/Other. None/Other always receives Generic Boilerplate specificity with empty specific_facts.


reasoning: Paragraph describes board oversight of cybersecurity framework and delegation to a dedicated board committee or appointed officer for reviewing policies and practices, directly answering 'How does the board oversee cybersecurity?' (BG per governance-chain default). No domain terms, firm-specific facts, or verifiable claims present; generic oversight language fails ERM test and lacks qualifying specifics.


fact: IT Security Steering Committee

fact: Director of Information Systems and Security

fact: VP of Software Engineering

fact: IT Security Team

fact: collectively have over 40 years of experience

reasoning: Paragraph primarily describes management-level committee structure, membership, leadership roles, reporting lines (Steering Committee to IT Security Team), and team qualifications, answering 'How is management organized to handle cybersecurity?' per MR category and Rule 1. Specificity reaches Quantified-Verifiable due to 'over 40 years of experience' (verifiable lower bound) and firm-specific elements like named committee, roles, and team.


fact: ransomware attack

fact: on January 18, 2023

fact: closure of fewer than 300 restaurants

fact: personal information of former and current employees

reasoning: The paragraph primarily describes a real cybersecurity incident (ransomware attack on January 18, 2023, with specific scope and impacts), directly answering 'What happened?' for Incident Disclosure. Specificity is Quantified-Verifiable due to the specific date, quantified restaurant closures (<300), and detailed data affected, with domain term 'ransomware' also present.


reasoning: This paragraph asserts no material cybersecurity incidents have occurred as of the filing date and references future risks, directly answering whether cybersecurity has materially affected business outcomes per SI materiality rule 5 (negative assertion). No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, confirming Generic Boilerplate specificity.