content_category: None/Other

category_confidence: high

specificity_confidence: high

reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with no substantive cybersecurity disclosure, fitting None/Other per rules on cross-references. No specific facts of any level are present, confirming Generic Boilerplate specificity.

provider: x-ai

stage: benchmark


reasoning: This paragraph is a generic commitment statement without describing any specific oversight, roles, processes, incidents, or impacts, fitting None/Other as it lacks substantive cybersecurity disclosure. No domain terms, firm-specific facts, or verifiable claims are present, confirming Generic Boilerplate specificity.


reasoning: This paragraph provides general business context about reliance on technology systems and data storage without addressing any substantive cybersecurity oversight, processes, roles, or incidents, fitting None/Other. No domain terms, firm-specific details, or verifiable facts are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is solely a cross-reference to another section of the filing (MD&A Item 7, page 86), which qualifies as None/Other per category rules for cross-references with no substantive cybersecurity content. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, confirming Generic Boilerplate specificity.


reasoning: This is a cross-reference to the Risk Factors section in Item 1A, which qualifies as None/Other per guidelines for non-substantive pointers without cybersecurity program details. No specific facts, domain terms, roles, or verifiable claims anywhere in the paragraph, confirming Generic Boilerplate specificity.


content_category: Board Governance

fact: CISO

fact: Cybersecurity Executive Steering Body

reasoning: Paragraph describes information flow from CISO through management to the Board/Audit Committee, directly answering 'How does the board oversee cybersecurity?' via governance-chain structure (BG per Rule 1). Specificity reaches Firm-Specific due to named CISO role and Cybersecurity Executive Steering Body committee, distinguishing the company's structure.


reasoning: This paragraph consists of a generic forward-looking disclaimer about the limitations of any cybersecurity program and a cross-reference to Item 1A Risk Factors, which matches None/Other per rules for cross-references and speculation without substantive measures. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, confirming Generic Boilerplate specificity.


reasoning: Paragraph is a cross-reference to Item 1A risk factors with speculative risk language, matching N/O for cross-references per Rule 5 and 6; no substantive cybersecurity content or specific facts of any level, resulting in empty specific_facts and Generic Boilerplate.


content_category: Strategy Integration

reasoning: This paragraph states a conclusion about no material past or reasonably likely future cybersecurity incidents impacting business or finances, directly matching SI materiality rule examples for backward- and forward-looking assessments. No specific facts elevate specificity: the date is reporting context, and the negative assertion is not externally verifiable, leaving it as Generic Boilerplate.


reasoning: Paragraph describes the company's data handling and general exposure to cyber threats in a speculative manner without addressing governance, processes, incidents, or strategy impacts, fitting None/Other per Rule 6 and Rule 5; no domain terms passing ERM test, firm-specific facts, or verifiable claims, resulting in Generic Boilerplate.


reasoning: Paragraph states a conclusion about no material past or likely future cybersecurity incidents affecting business outcomes, directly matching SI materiality rule for backward- and forward-looking negative assertions; cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


content_category: Third-Party Risk

reasoning: Paragraph centrally describes enhancing monitoring and commencing a program for third-party service providers' cybersecurity risks, directly answering the Third-Party Risk question per Rule 3 (vendor oversight as central topic). No domain terms passing ERM test, firm-specific facts (program unnamed/generic), or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph explains the Trust's passive structure with no operations, customers, or data, offering no substantive cybersecurity processes or measures, fitting None/Other per Rule 6 for no-operations entities. No domain terms, firm-specific facts, or verifiable claims present anywhere → Generic Boilerplate.


reasoning: This paragraph states a conclusion on no material past or likely future cybersecurity impacts on business strategy, results, or financial condition, directly matching Strategy Integration per Rule 5 materiality rule; the cross-reference is secondary. No specific facts elevate specificity: negative assertions are not verifiable, and no domain terms, firm-specific details, or quantified claims are present.


reasoning: The paragraph primarily assesses the past material impact of cybersecurity incidents (none material to date) and references ongoing risks and investments, directly answering how cybersecurity affects business/financial outcomes per SI materiality rule. No domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate specificity.


content_category: Incident Disclosure

fact: In 2017, we experienced a material cybersecurity incident

fact: criminal attack... theft of personal information of U.S., Canadian and U.K. consumers

reasoning: Paragraph primarily describes a real past cybersecurity incident (2017 Equifax breach with specific scope), fitting Incident Disclosure over Strategy Integration speculation in later sentences. Specificity reaches Quantified-Verifiable due to the verifiable 2017 date and incident details matching public records.


reasoning: Paragraph provides a general description of business risks from handling personal data and facing routine cyber threats from external and internal sources, without detailing any oversight, processes, roles, or impacts, making it None/Other speculation. No domain terms passing ERM test, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate.


reasoning: The paragraph primarily describes the company's third-party risk management program, including vetting, monitoring, and reviews for vendor compliance with security standards, directly answering how third-party cyber risks are managed (central topic is TP per Rule 3). No domain terminology passing ERM test, no firm-specific facts like named roles/committees, and no verifiable claims like numbers/dates/named firms, resulting in Generic Boilerplate specificity.


fact: Vice-President of Information Technology ("VPIT")

fact: Director - Information Security ("DIS")

reasoning: Paragraph describes Audit Committee reporting to the Board on cybersecurity and presentations from management to the Board, directly answering board oversight structure (BG per Rule 1, board-level committee). Firm-specific VPIT and DIS roles elevate to Firm-Specific (Level 3), no higher verifiable facts.


content_category: Risk Management Process

fact: security incident and event manager interface that uses behavioral analytics

fact: logs of firewalls, authentication attempts, emails, anti-malware, attempted intrusions and applications

fact: penetration testing

fact: system security assessments

reasoning: Paragraph describes cybersecurity processes, tools for monitoring and incident response, and testing activities, directly answering 'What does the cybersecurity program do?' (RMP); third-party testing is part of internal program per Rule 3. Specificity driven by multiple domain terms like SIEM-like interface, behavioral analytics, firewalls, anti-malware, and pen testing that demonstrate cybersecurity expertise beyond generic ERM language, reaching Domain-Adapted with no firm-specific or verifiable facts.


content_category: Management Role

fact: threat intelligence

reasoning: Paragraph describes how the management team monitors cybersecurity risks and incidents via briefings, threat intelligence, and security tools, directly answering 'How is management organized to handle cybersecurity?' (MR); domain term 'threat intelligence' demonstrates cybersecurity expertise beyond generic ERM language, setting specificity to Domain-Adapted with no firm-specific or verifiable facts.


reasoning: Paragraph states a conclusion on no material past cybersecurity impact to business strategy, results of operations, or financial condition (SI per Rule 5), with speculative forward-looking language and cross-references that do not override the materiality assessment; no specific facts, domain terms passing ERM test, firm-specific details, or verifiable claims anywhere, resulting in Generic Boilerplate.


fact: Chief Risk Officer

reasoning: This paragraph identifies specific management leaders (CISO, Chief Risk Officer, Chief Information and Technology Officer) responsible for cybersecurity risk assessment and management, directly answering 'How is management organized to handle cybersecurity?' (MR per Rule 1 and person-removal test). Specificity reaches Firm-Specific due to multiple named high-level cybersecurity-responsible roles, with no higher verifiable facts.


fact: On June 13, 2023, Brunswick disclosed an IT security incident

fact: Normal global business operations resumed over the course of nine days

type: quantified

fact: lost revenue of approximately $80 million to $85 million

fact: operating earnings of $35 million to $40 million

reasoning: This paragraph describes a specific cybersecurity incident with timing, response actions, recovery duration, and financial impacts, directly answering 'What happened in a cybersecurity incident?' for Incident Disclosure. Specificity is Quantified-Verifiable due to the specific date, quantified recovery period, and precise financial loss ranges that are externally verifiable.


fact: isolated computer workstations

fact: passwords, passphrases, and two-factor or independent authorizations

reasoning: Paragraph describes the Trust's cybersecurity protocols and practices like isolated workstations and multi-factor authentication, answering 'What does the cybersecurity program do?' (RMP); mentions third parties but not centrally managing their risks (not TPR). Specificity driven by domain-specific terms like 'isolated computer workstations' and 'two-factor authorizations' that demonstrate cybersecurity expertise beyond generic ERM language.


fact: threat detection rates

fact: response times

fact: penetration tests

fact: process audits

reasoning: Paragraph describes Audit Committee oversight of cybersecurity risks, including dashboards, briefings, and external test reports, directly answering board governance question. Specificity driven by domain terms like threat detection rates, response times, penetration tests, and process audits, which demonstrate cybersecurity expertise but no firm-specific roles or verifiable claims.


fact: during March 2021

fact: first quarter of 2021

fact: year ended December 31, 2021

fact: $2.4 million

reasoning: This paragraph primarily describes a specific past cybersecurity incident, including timing, investigation, remediation, and business impacts, directly answering 'What happened in a cybersecurity incident?' for Incident Disclosure. Specificity reaches Quantified-Verifiable due to multiple verifiable facts like exact dates (March 2021, Q1 2021, Dec 31, 2021) and quantified costs ($2.4 million).


fact: Vice President, Information Systems and Technology

reasoning: Paragraph describes board and Audit Committee oversight of cybersecurity risks with management reporting flow, directly answering 'How does the board oversee cybersecurity?' (BG per governance-chain rule). Specificity driven by firm-specific VP-level IT leadership role (Level 3), no domain terms or verifiable facts elevate higher.


reasoning: Paragraph primarily assesses cybersecurity's lack of material impact on business outcomes and mentions insurance coverage, directly answering Strategy Integration questions per materiality rule (negative assertion of no material effects). No domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate specificity.


fact: Enterprise & Technology Security (E&TS) organization

fact: Chief Information Security Officer (CISO)

fact: CSIRT

fact: Product Security Incident Response Team (PSIRT)

fact: Business Information Security Officers (BISO)

reasoning: Paragraph primarily describes management's organizational structure for cybersecurity, including specific roles like CISO and BISOs, teams like E&TS, CSIRT, and PSIRT, and their responsibilities, fitting Management Role per person-removal test and Rule 1 (management-level, not board). Specificity reaches Firm-Specific due to multiple named roles and teams that distinguish IBM's structure; no verifiable quantities or external claims for Level 4.


fact: targeted attacks, ransomware, malware, phishing attacks, data theft, other data or security breaches, virus and intrusion software

fact: layered technical protective capabilities and detective surveillance controls

fact: phishing, social engineering and other cybersecurity training

fact: operational technology

reasoning: Paragraph describes the cybersecurity program's risk assessment, specific threats faced, and key aspects like controls, training, and procedures, directly answering 'What does the cybersecurity program do?' → RMP; specificity driven by multiple domain terms (ransomware, phishing, layered controls, social engineering, OT) that demonstrate cybersecurity expertise beyond generic ERM language, reaching Domain-Adapted with no firm-specific or verifiable facts.


reasoning: The paragraph primarily describes the cybersecurity risk management system, safeguards, programs, policies, and procedures for protection and incident response, answering 'What does the cybersecurity program do?' (RMP), with brief generic oversight and a materiality conclusion as secondary. No domain terms passing the ERM test, firm-specific facts, or verifiable claims are present; all language is boilerplate (e.g., 'programs, policies and procedures', negative incident assertion), yielding Generic Boilerplate.


reasoning: Paragraph primarily answers whether cybersecurity has materially affected business outcomes by stating no material adverse effects to date but possible in future (SI per Rule 5 negative assertion and forward-looking), amid boilerplate threats and cross-reference; no domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, yielding Generic Boilerplate.


fact: Aerospace Safety Committee

fact: Chief Information Officer and Senior Vice President, Information Technology & Data Analytics (CIO)

fact: Chief Security Officer (CSO)

fact: Chief Aerospace Safety Officer

fact: Chief Product Security Engineer

reasoning: Paragraph describes board-level oversight structure, delegation to specific committees (Audit and Aerospace Safety), reporting flows, and officer briefings to committees/Board, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1). Specificity driven by multiple firm-specific named committees and VP-level cybersecurity/IT roles (Level 3), with no domain terms elevating to L2 alone or verifiable facts for L4.


fact: Cybersecurity Committee

reasoning: The paragraph primarily describes board-level oversight via the Board and its Cybersecurity Committee, answering 'How does the board oversee cybersecurity?' (BG per Rule 1 for board committees). Specificity reaches Firm-Specific due to the named non-generic 'Cybersecurity Committee', with no domain terms or verifiable facts elevating further.


fact: cybersecurity incident in April 2022

reasoning: The paragraph primarily describes a specific past cybersecurity incident, including its timing (April 2022), nature (disruption to hospital operations and data exfiltration), impacts (costs, lost revenues), and remediation steps, directly answering 'What happened in a cybersecurity incident?'; forward-looking risks are secondary. Specificity reaches Quantified-Verifiable due to the externally verifiable specific date of the incident.


reasoning: Paragraph primarily states a conclusion on no material cybersecurity incidents to date and potential future business/financial impacts, directly answering 'How does cybersecurity affect the business or finances?' per SI materiality rule for negative assertions; no domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes the board's delegation of cybersecurity oversight to the Audit Committee, update frequency from officers, and reporting to the full board, directly answering the Board Governance question about oversight structure (governance-chain default to BG per Rule 1). Specificity reaches Firm-Specific due to the named cybersecurity-qualified Director-level role ('Senior Director of Governance & Information Security'), with no higher verifiable facts.


reasoning: Paragraph lists oversight duties like reviewing information security examination reports and regulatory findings, and monitoring emerging risks, directly answering how the board/committee oversees cybersecurity (Board Governance per governance-chain default). No domain terminology passing ERM test, firm-specific elements, or verifiable facts present, resulting in Generic Boilerplate specificity.


fact: forensic investigations

fact: incident response management

reasoning: Paragraph describes the incident response process (containment, remediation, notifications, annual review), directly answering 'What does the cybersecurity program do?' → RMP; mentions Board/Audit notifications but process is primary. Specificity driven by domain terms like 'forensic investigations' and 'incident response management' passing ERM test (cyber-specific practices), no firm-specific roles/committees or verifiable claims.


fact: Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG)

fact: Chief Information Security Officer

reasoning: Paragraph primarily describes the structure, membership (senior leaders), responsibilities, and reporting lines of the management-level Enterprise Cybersecurity MRG steering committee and its interaction with the CISO, fitting Management Role over Board Governance (which focuses on board oversight) or Risk Management Process (no program activities detailed). Specificity reaches Firm-Specific due to the named committee and CISO role, with no higher verifiable facts like quantities or dates.


reasoning: Paragraph centrally describes management of third-party cybersecurity risks via due diligence, contracts, new vendor reviews, and ongoing monitoring, directly answering the Third-Party Risk question per Rule 3 (vendor oversight as central topic). Specificity reaches Firm-Specific due to the named internal program 'Third-Party Risk Management (TPRM) program'; no domain terms pass ERM test and no verifiable claims present.


reasoning: Paragraph centrally describes management of third-party service provider risks through assessments for access to information assets, directly answering the Third-Party Risk question per Rule 3 (vendor oversight as central topic). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


fact: Risk Management Committee

fact: CISO

reasoning: Paragraph describes board-level oversight structure, committees, reporting cadences, and education for cybersecurity risks, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity reaches Firm-Specific due to named committees (Risk Management Committee, Cybersecurity and Technology Subcommittee) and CISO role, with no domain terms or verifiable facts elevating higher.


reasoning: The paragraph lists components of the cybersecurity risk management program (risk assessments, team responsibilities, external providers for controls, training, incident response plan, third-party vetting), primarily answering 'What does the cybersecurity program do?' making it Risk Management Process; third-party elements are subordinate bullets, not central. No domain terms pass ERM test (all generic like risk assessments, incident response plan), no firm-specific roles/teams/committees, no verifiable facts like numbers/dates/names, so Generic Boilerplate.


fact: Head of Cyber Security

reasoning: Paragraph primarily describes board-level oversight structure via delegation to Audit Committee, reporting from Head of Cyber Security (quarterly), and flow to full Board, fitting Board Governance per governance-chain default (Rule 1). Specificity reaches Firm-Specific due to the named cybersecurity leadership role 'Head of Cyber Security'; no domain terms pass ERM test beyond generic, no verifiable claims.


fact: regular monitoring of outside threats

fact: continuous updating of software

fact: formal policy related to employees that access corporate systems from personal devices

fact: simplification of infrastructure to minimize servers

fact: migration of business-critical systems, including the Company's ERP system, to Tier-1 cloud service providers

fact: enhancements to endpoint protection

fact: enhanced encryption

fact: two-factor authentication (2FA)

fact: real-time threat monitoring

reasoning: Paragraph describes the cybersecurity program's activities like threat monitoring, software updates, BYOD policy, infrastructure simplification, cloud migration, endpoint protection, encryption, 2FA, and real-time monitoring, directly answering 'What does the cybersecurity program do?' (RMP); no board/management roles, incidents, or vendor focus. Specificity driven by multiple domain terms (e.g., 2FA, endpoint protection, real-time threat monitoring) passing ERM test, but no firm-specific roles/committees or verifiable claims like numbers/names/dates.


reasoning: This paragraph primarily describes the Board's oversight of cybersecurity risks through the Enterprise Risk Management program, information flow from management, escalation processes, and periodic engagement of third-party experts, directly answering the Board Governance question. No domain-specific terminology passing the ERM test, firm-specific facts like named roles or committees, or verifiable claims like numbers or dates are present, resulting in Generic Boilerplate specificity.


fact: automated event-detection notifications or similar technologies

fact: security operations team

fact: incident response team

reasoning: Paragraph describes detection methods (automated notifications monitored by security operations) and incident analysis process (investigation, severity assessment), directly answering 'What does the cybersecurity program do?' → Risk Management Process; passes person-removal test with substantive program details remaining. Specificity driven by domain terms like 'automated event-detection notifications' and 'security operations team' that demonstrate cybersecurity expertise beyond generic ERM language, but no firm-specific roles/teams or verifiable facts.


reasoning: The paragraph centrally describes the Cybersecurity team's risk assessments, reassessments, and contractual requirements for third-party service providers' data security, directly answering how third-party cyber risks are managed (TP). No domain terminology passing the ERM test (e.g., specific controls like SOC 2 or encryption), firm-specific elements (e.g., named roles or committees), or verifiable facts (e.g., numbers, dates, certifications) are present, resulting in Generic Boilerplate.


fact: CIO (Chief Information Officer)

fact: CIO reports to General Counsel, Chief Accounting Officer, Chief Financial Officer, Chief Executive Officer, and Audit Committee

reasoning: Paragraph primarily describes Board oversight of cybersecurity risks, information flow from management (CIO) to Board/Audit Committee, and escalation processes, fitting Board Governance per governance-chain default. Specificity reaches Firm-Specific due to named CIO role and specific reporting lines to identified executives/committee, with no domain terms or verifiable claims elevating higher.


fact: phishing attempts

fact: ransomware and other forms of malware

fact: computer viruses

reasoning: The paragraph primarily states a conclusion about no material cybersecurity incidents to date, directly answering whether cybersecurity has affected business outcomes (SI per Rule 5 negative assertion), with the rest being speculation and cross-reference (N/O). Specificity reaches Domain-Adapted due to cyber-specific threat types like phishing, ransomware, and malware that demonstrate domain expertise (pass ERM test), but no firm-specific roles/committees or verifiable claims like dates tied to events or quantifiables.


fact: identity and access management, cyber defense operations, security engineering

fact: penetration testing, incident response, threat intelligence, managed security services

fact: Executive Vice President/ Chief Information Security Officer

fact: Chief Information Officer

fact: Senior Executive Vice President / Chief Operating Officer

fact: over 25 years' experience in cybersecurity risk management

fact: over 27 years' experience in technology risk management

reasoning: Paragraph primarily describes management organization, team composition, leadership roles/qualifications, and reporting lines, fitting Management Role per person-removal test and Rule 1 (management-level focus). Specificity reaches Quantified-Verifiable due to verifiable experience quantifiers ('over 25 years', 'over 27 years') and includes domain terms and firm-specific named roles.


reasoning: The paragraph primarily describes processes for assessing, onboarding, monitoring, and requiring security from third-party service providers, making third-party risk management the central topic (TP). No domain-specific terminology, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph is speculative forward-looking disclaimer with cross-reference to Item 1A risk factors, matching None/Other for pure speculation without substantive cybersecurity measures or processes (Rule 5, Rule 6). No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph provides a backward-looking materiality assessment of no material cybersecurity impacts on business strategy, operations, or finances, directly matching Strategy Integration per Rule 5 (negative assertion). No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, confirming Generic Boilerplate specificity.


fact: security operations center

fact: Cybersecurity Incident Response Plan

fact: CISO

fact: cybersecurity crisis response team (Crisis Response Team)

fact: Public Disclosure Committee

reasoning: Paragraph describes cybersecurity monitoring via SOC, incident escalation via CIRP, response management, and disclosure processes, which survives person-removal test as substantive program activities → RMP. Specificity driven by firm-specific elements like CISO role, named Crisis Response Team, and Public Disclosure Committee, elevating to Firm-Specific despite domain terms like SOC.


reasoning: This paragraph is a cross-reference to another section with no substantive cybersecurity disclosure, fitting None/Other per rules on cross-references and lack of measures/processes. No specific facts of any level (no domain terms passing ERM test, no firm-specific elements, no verifiable claims), resulting in Generic Boilerplate specificity.


fact: Chief Information Security Officer (CISO)

fact: Senior Leadership Team (SLT)

fact: ELT

reasoning: Paragraph primarily describes board oversight of cybersecurity through quarterly CISO briefings and annual tabletop exercises, fitting Board Governance as it details information flow and briefing frequency to the board. Specificity reaches Firm-Specific due to named cybersecurity role (CISO) and named leadership teams (SLT, ELT), with no domain terms passing ERM test or verifiable claims present.


fact: real-time security scoring of supplier technology services

fact: threat intelligence

fact: continuous threat intelligence monitoring

reasoning: Paragraph centers on supplier cybersecurity risk assessments, monitoring, and contract provisions, making third-party risk the primary topic per Rule 3 (vendor oversight central). Domain terms like 'real-time security scoring' and 'threat intelligence' pass ERM test, elevating to Domain-Adapted with no firm-specific or verifiable facts.


fact: defense-in-depth and layered strategy

fact: endpoint detection and response

fact: network anomaly detection

fact: multi-factor authentication

fact: threat intelligence services

fact: phishing simulation exercises

reasoning: Paragraph describes the cybersecurity program's activities, tools, and processes like risk assessment, defense-in-depth strategy, EDR, MFA, threat intelligence, and training, directly answering 'What does the cybersecurity program do?' → RMP; third-party mentions are supportive, not central. Specificity driven by multiple domain-specific cyber terms (EDR, network anomaly detection, MFA, etc.) passing ERM test for Level 2, with no firm-specific roles/committees or verifiable quantities/names for higher levels.


fact: CSO

fact: phishing tests

reasoning: Paragraph describes the cybersecurity program's activities including detection, mitigation, incident handling (identify/contain/remediate), employee training, and phishing tests, which survives person-removal test for RMP over MR. Specificity driven by firm-specific CSO role (L3) and domain term 'phishing tests' (L2), with no verifiable facts for L4.


reasoning: Paragraph states a conclusion about no material cybersecurity incidents in 2024 (backward-looking materiality assessment) with forward-looking speculation and cross-reference, directly matching SI per Rule 5; no specific facts of any level found, as the negative assertion and reporting period are not verifiable or domain-specific per guidelines.


reasoning: The paragraph primarily states a materiality conclusion about no past material effects and no reasonable likelihood of future material impacts on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5. No domain terms passing ERM test, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: The paragraph details a documented process for identifying, assessing, and mitigating cybersecurity risks from new third-party service providers, with the central focus on vendor/supplier oversight, fitting Third-Party Risk. No domain-specific terminology passing the ERM test, firm-specific elements like named roles or teams, or verifiable facts such as numbers or dates are present, resulting in Generic Boilerplate specificity.


fact: network and perimeter defense

fact: infrastructure security

fact: cloud security

fact: endpoint protection

fact: data protection

fact: identity management

fact: network segmentation

fact: cybersecurity threat intelligence

reasoning: Paragraph details specific tools and safeguards like endpoint protection and network segmentation used in the cybersecurity program, directly answering 'What does the cybersecurity program do?' classifying as Risk Management Process. Specificity reaches Domain-Adapted due to multiple cybersecurity-specific terms passing the ERM test, showing domain expertise without firm-specific or verifiable facts.


reasoning: Paragraph states a conclusion about prior cybersecurity threats not materially affecting business outcomes (SI per materiality rule) and speculates on future impacts with a cross-reference, primarily answering how cybersecurity affects business/finances. No domain terms, firm-specific facts, or verifiable claims present; pure boilerplate speculation and negative self-assertion yield Generic Boilerplate.


reasoning: The paragraph primarily states a conclusion about no material past impacts from cybersecurity incidents, directly answering how cybersecurity has affected the business (SI per Rule 5 negative assertion). No specific facts elevate specificity: negative assertions are not verifiable, and language is generic boilerplate without domain terms, firm-specific details, or quantifiable claims.


reasoning: This paragraph states a conclusion that no cybersecurity risks or incidents have materially affected business strategy, results of operations, or financial condition, directly answering the Strategy Integration question per Rule 5 (backward-looking negative assertion). No specific facts elevate specificity beyond Generic Boilerplate, as it contains only a non-verifiable negative self-assertion without domain terms, firm-specific details, or quantifiable claims.


reasoning: The paragraph primarily describes the vendor management process for third-party oversight, including vetting, approval, inventory, and risk mitigation applied to cybersecurity-related vendors, making Third-Party Risk the central topic over the single materiality statement (SI) or cross-reference (N/O). No domain terms passing the ERM test, firm-specific elements (e.g., no named cyber roles/committees), or verifiable facts (e.g., no numbers, dates, certifications) are present, resulting in Generic Boilerplate specificity.


fact: chief information security officer (CISO)

fact: chief information officer (CIO)

fact: chief risk officer (CRO)

fact: Two members of the audit committee have obtained certifications in cybersecurity oversight

fact: risk committee

fact: disclosure committee

reasoning: Paragraph describes board and audit committee oversight of cybersecurity, including briefing frequency from named officers (CIO, CISO, CRO), board expertise (two certified members), and information flow, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity reaches Firm-Specific due to multiple named cybersecurity/IT leadership roles (CISO, CIO, CRO) and named committees (risk committee, disclosure committee), with no domain terms or verifiable claims elevating higher.


fact: Enterprise Risk Management Committee ("ERM Committee"), which consists of executives appointed by the Board

fact: annual reviews of third-party SOC1 reports

reasoning: Paragraph primarily describes oversight structure via the ERM Committee (executives appointed by Board) reviewing cyber risks and reporting annually to the Audit Committee, fitting Board Governance per governance-chain rule. Specificity reaches Firm-Specific due to the named ERM Committee; domain term SOC1 elevates from boilerplate but does not exceed Level 3 as no verifiable claims present.


reasoning: The paragraph primarily addresses the lack of material cybersecurity incidents to date and potential future business/financial impacts, directly answering a Strategy Integration question per Rule 5 (negative materiality assertion and cost examples). No specific facts elevate specificity: generic language on risks and processes shows no domain terminology, firm-specific details, or verifiable claims, resulting in Generic Boilerplate.


reasoning: Paragraph states a conclusion on no material cybersecurity incidents in the last three fiscal years, directly answering how cybersecurity has affected business outcomes (SI per Rule 5); cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims present, as the negative assertion is not externally verifiable (per guidelines), resulting in Generic Boilerplate specificity.


reasoning: Paragraph primarily consists of cross-references to other SEC Items (1A, 1B, 1C) and vague generic language about reviews and drills on an unspecified 'plan,' qualifying as None/Other per rules on cross-references and lack of substantive cybersecurity content. No domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate specificity.


fact: ransomware

fact: Phishing attempts

fact: nation states cyber threats

reasoning: Paragraph discusses general cybersecurity threats and risks (e.g., ransomware, phishing, nation-state actors) without addressing board oversight, management roles, risk processes, incidents, or strategy integration, classifying as None/Other per Rule 6 for pure speculation lacking substantive measures. Specificity reaches Domain-Adapted due to cybersecurity-specific threat terminology passing the ERM test, with no firm-specific or verifiable facts.


fact: Chief Information Security Officer ("CISO")

reasoning: Paragraph primarily describes Audit Committee oversight of cybersecurity risks, including briefing content and flow from CISO, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity reaches Firm-Specific due to the CISO role (Level 3 fact); no domain terms pass ERM test for Level 2, no verifiable claims for Level 4.


reasoning: This paragraph provides generic boilerplate on the importance of cybersecurity governance for alignment, compliance, and goals without addressing any specific oversight structure, roles, processes, or incidents, defaulting to None/Other. No domain-specific terminology, firm-unique facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: cybersecurity attack in May 2022 involving ransomware

fact: multi-factor authentication

reasoning: The paragraph primarily describes a specific past cybersecurity incident including timing (May 2022), nature (ransomware), response (third-party forensics, law enforcement notification, no ransom paid), and remediation, fitting Incident Disclosure as the dominant frame despite some Strategy Integration language on impacts. Specificity reaches Quantified-Verifiable due to the verifiable specific date of the incident and domain terms like ransomware and multi-factor authentication.


fact: CISO

fact: CIO

fact: cybersecurity dashboard that is reviewed...includes key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance toward Transportation Security Administration (TSA) compliance

reasoning: Paragraph primarily describes Board and Audit Committee oversight of cybersecurity, including briefing frequency, dashboard reviews, and escalation protocols, directly answering the Board Governance question. Specificity reaches Firm-Specific due to named leadership roles (CISO, CIO); domain terms like cybersecurity process maturity KPIs and TSA compliance elevate from boilerplate but no verifiable claims like quantities or dates.


fact: SOC 1 audit

reasoning: Paragraph centrally describes third-party oversight via mandatory annual SOC 1 audits and report reviews for cybersecurity and IT controls, fitting Third-Party Risk per Rule 3 (requirements imposed on vendors). Specificity is Domain-Adapted due to SOC 1 audit as a domain term passing the ERM test, showing cybersecurity-specific audit knowledge; no firm-specific roles or verifiable claims present.


reasoning: Paragraph centrally describes contractual security requirements and data usage restrictions imposed on suppliers, vendors, and third-parties, directly answering the Third-Party Risk question. No domain terms passing ERM test, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: EVP, Chief Digital and Innovation Officer (CDIO)

fact: Vice President (VP) of Platforms, Infrastructure and Cybersecurity

fact: over 20 years of related experience

reasoning: Paragraph describes management leadership roles (EVP CDIO and VP of Platforms/Infrastructure/Cybersecurity), their shared responsibilities for risk assessment/management, and qualifications, directly answering 'How is management organized?' (MR per person-removal test as program details collapse without persons); specificity driven by firm-specific named VP+ roles (Level 3) and verifiable 'over 20 years' experience (Level 4 lower bound).


fact: Security and Technology Risk Leadership Committee

fact: chaired by our CISO

fact: Privacy and Data Governance Committee

fact: chaired by our Chief Privacy Officer

fact: Data Security and Privacy Governance Committee

reasoning: Describes structure, membership, and reporting of management-level cybersecurity and privacy committees chaired by CISO and Chief Privacy Officer, directly answering how management is organized → Management Role. Multiple named committees and executive roles qualify as firm-specific facts, setting specificity to Firm-Specific with no higher verifiable claims.


fact: CIO (Chief Information Officer)

fact: CISO (Chief Information Security Officer)

fact: DTI organization

fact: CDT function/team

fact: Incident Response team including CISO and senior CDT members

reasoning: Paragraph primarily describes management roles (CIO, CISO), team structures (DTI, CDT, Incident Response), and reporting lines for handling cybersecurity, fitting Management Role per person-removal test showing organizational focus over program activities. Specificity reaches Firm-Specific due to multiple named cybersecurity leadership roles and teams like CISO, CIO, CDT, which distinguish the company's structure.


reasoning: Paragraph states a conclusion about no material cybersecurity incidents or impacts in 2023 on business strategy, results, or financial condition, directly matching SI materiality rule for negative assertions; cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims present, as the 2023 timeframe does not make the negative self-assertion externally verifiable.


reasoning: The paragraph states conclusions about past and potential material effects of cybersecurity on business strategy, results of operations, and financial condition, directly matching Strategy Integration per Rule 5 (backward- and forward-looking materiality assessments). No domain terms, firm-specific facts, or verifiable claims appear anywhere, confirming Generic Boilerplate specificity.


fact: Chief Information Security Officer (CISO)

fact: EXCO

fact: Senior Leadership Team (SLT)

reasoning: Paragraph primarily describes board oversight of cybersecurity through CISO meetings, tabletop exercises, and briefings on risks, fitting Board Governance as it details the governance-chain structure and information flow to the board. Specificity reaches Firm-Specific due to named cybersecurity leadership role (CISO) and firm-unique committees/teams (EXCO, SLT), with no domain terms or verifiable claims elevating higher.


fact: cyberattack in February 2023

fact: temporary interruption of our systems

fact: disclosure of certain confidential information

fact: litigation and governmental inquiries

reasoning: This paragraph primarily describes a specific past cybersecurity incident, including timing (February 2023), nature (cyberattack causing system interruption and data disclosure), and impacts (litigation, inquiries), fitting Incident Disclosure; the cross-reference reinforces but does not change the core topic. Specificity reaches Quantified-Verifiable due to the verifiable specific date 'February 2023' tied to the real event, elevating beyond firm-specific details.


reasoning: Paragraph is a generic risk speculation ('could disrupt...') with no description of processes despite the title, fitting None/Other per Rule 6 as pure boilerplate without substantive cybersecurity measures; no specific facts of any level found, resulting in Generic Boilerplate.


fact: 24/7 security operations center

fact: security operations center (SOC)

fact: insider threat protection program

reasoning: Paragraph describes cybersecurity program activities including incident response plans, 24/7 SOC for monitoring, insider threat program, plan updates, training exercises, and annual employee security awareness training, directly answering 'What does the cybersecurity program do?' (RMP). Specificity reaches Firm-Specific due to the 24/7 SOC claim (firm-unique organizational detail) and domain terms like SOC and insider threat program, with no verifiable Level 4 facts like dates, headcounts, or named products.


fact: Chief Information Officer (CIO), who is a member of the Company's Executive Committee

reasoning: Paragraph primarily describes management leadership roles (CIO and CISO) and their responsibilities for cybersecurity, fitting Management Role per person-removal test where roles are central. Specificity reaches Firm-Specific due to named VP-level roles (CISO and CIO with Executive Committee membership), with no higher verifiable facts.


fact: zero-day vulnerability

fact: MOVEit Transfer

reasoning: Paragraph primarily describes actual past cybersecurity incidents including nature (fraud attempts, unauthorized access to customer data like SSN/credit cards), scope (customer systems/emails, third-party providers), timing (2023 example), and a specific vendor incident with MOVEit Transfer zero-day, making it Incident Disclosure despite trailing materiality statement (ID frame dominant per Rule 4). Specificity reaches Quantified-Verifiable due to verifiable facts like '2023' date, named 'MOVEit Transfer' software (publicly known breach), and 'zero-day vulnerability' domain term.


fact: Cyber Security Group

fact: Department of Homeland Security's list of Prohibited Nations

fact: operational technology

reasoning: Paragraph centrally describes vendor screening, risk ranking, rescreening, attestations, insurance requirements, and supply chain protections from prohibited nations, making Third-Party Risk the primary category over minor insurance mention (SI). Specificity reaches Firm-Specific due to named 'Cyber Security Group' and unique policy referencing DHS Prohibited Nations list, with 'operational technology' as domain term; no verifiable quantities, dates, or certifications for L4.


fact: Certified Information Systems Security Professional (CISSP)

fact: Global Industrial Cyber Security Professional (GICSP)

fact: Electricity Information Sharing and Analysis Center

fact: Cybersecurity and Infrastructure Security Agency

fact: network monitoring

fact: vulnerability scanning

fact: TEP's Enterprise Cybersecurity team

reasoning: Paragraph primarily describes the cybersecurity program's activities (threat intelligence use, monitoring, scanning), passing person-removal test for RMP over MR; contains verifiable domain-specific certifications (CISSP, GICSP) and named entities elevating to Quantified-Verifiable.


fact: Risk Committee

fact: Chief Information Security Officer (CISO)

fact: vulnerability assessments

reasoning: Paragraph primarily describes board-level oversight via the Risk Committee, including CISO reporting and risk indicator reviews, answering 'how the board oversees cybersecurity' (BG per governance-chain rule). Firm-specific facts like named 'Risk Committee' and 'CISO' drive Firm-Specific level, with domain term 'vulnerability assessments' as supporting.


reasoning: Paragraph asserts no material past or reasonably likely future impacts from cybersecurity on business/financials, directly matching SI materiality rule for backward- and forward-looking conclusions; cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: global incident involving Progress Software Corporation ("MOVEit Transfer")

fact: received written notice during 2023

fact: the only cybersecurity incident that materially affected the Corporation during the 2023 fiscal year

fact: vendor confirmed that it implemented the recommended patches released by Progress Software Corporation

reasoning: Paragraph details a specific real-world cybersecurity incident (MOVEit Transfer), including timing, scope, third-party involvement, investigation, remediation, and impacts, directly answering 'What happened in a cybersecurity incident?' → Incident Disclosure. Specificity reaches Quantified-Verifiable due to named firms/products (Progress Software, MOVEit Transfer) and event-specific dates (2023) that are externally verifiable.


fact: defense-in-depth approach

fact: National Institute of Standards and Technology Cyber Security Framework

type: framework

fact: penetration testing

fact: incident response and disaster recovery exercises

fact: encryption

fact: threat management

fact: multi-factor authentication

fact: identity and access management controls

fact: Written Information Security Program

reasoning: The paragraph primarily describes the cybersecurity program's components, framework (NIST CSF), processes (vulnerability scanning, penetration testing, incident response), and tools (encryption, MFA), answering 'What does the cybersecurity program do?' (RMP); third-party risk is a minor bullet, not central. Specificity reaches Firm-Specific due to the named 'Written Information Security Program' distinguishing this company's posture, plus multiple domain terms like defense-in-depth and vulnerability scanning.


fact: Previously Disclosed Cyber Incident

reasoning: Paragraph primarily assesses cybersecurity's material impact on business strategy, results of operations, and financial condition, including a past incident's effects and forward-looking risks, directly answering Strategy Integration's question per materiality rule. Specificity reaches Firm-Specific due to the firm-unique reference to the 'Previously Disclosed Cyber Incident', with no domain terms, quantified claims, or other verifiable facts elevating it further.


reasoning: Paragraph centrally describes vendor cybersecurity assessments, contractual requirements, and incident notification obligations, directly answering how third-party risks are managed (TP). No domain terms passing ERM test, firm-specific facts (e.g., named roles/committees), or verifiable claims (e.g., numbers, dates, certifications), resulting in Generic Boilerplate specificity.


fact: On February 22, 2024, we disclosed the occurrence of a cybersecurity incident

fact: cybercrime threat actors

reasoning: Paragraph primarily describes a real cybersecurity incident including disclosure date, ongoing investigation, believed perpetrators, fitting Incident Disclosure as it details what happened with timeline and scope. Specificity reaches Quantified-Verifiable due to the verifiable specific date of disclosure, with domain term 'cybercrime threat actors' as additional support.


fact: RCSC

fact: CISO

fact: cybersecurity threat landscape

fact: cybersecurity incidents

reasoning: Paragraph describes RCSC committee oversight of cybersecurity via quarterly CISO briefings on threats, initiatives, regulations, and incidents, directly answering board/committee oversight question (BG per governance-chain rule). Specificity reaches Firm-Specific due to named committee (RCSC) and role (CISO), with supporting domain terms.


fact: Chief Information Security Officer (CISO)

fact: 30 years of information technology experience

fact: 17 years focused specifically on information security and risk management

reasoning: Paragraph details the CISO's responsibilities for the security program and personal qualifications/experience, directly answering 'How is management organized?' per Management Role (person-specific leadership and credentials). Specificity is Quantified-Verifiable from multiple hard numbers on experience years, verifiable against a resume or LinkedIn.


fact: CSBDO

fact: CISO has over thirty years of experience as a cybersecurity professional

fact: CSBDO has nearly twenty years of experience enabling digital transformation

fact: cyber incident response plan

reasoning: Paragraph primarily describes the cybersecurity program's activities including securing information, detection/response, third-party risk processes, training, and incident response planning (RMP per person-removal test as program details remain without roles); specificity reaches Quantified-Verifiable due to verifiable quantified experience claims for CISO ('over thirty years') and firm-specific roles like CISO and CSBDO.


reasoning: Paragraph primarily describes the establishment and general purpose of a cybersecurity risk management program as part of enterprise risk management to address risks and regulatory requirements, answering 'What does the cybersecurity program do?'; no domain terms, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


fact: CSO

fact: confidentiality, integrity, or availability

reasoning: Paragraph describes the cybersecurity program's components, processes for risk assessment, management, incident response, and inclusion of third-party risks, directly answering 'What does the cybersecurity program do?' (RMP); third-party mention is subordinate. Specificity reaches Firm-Specific due to the named cybersecurity leadership role 'CSO' (Level 3), with CIA triad as supporting domain term.


fact: Vendor Management Committee

fact: Vendor Management team

reasoning: Paragraph centers on vendor due diligence including cybersecurity reviews, annual follow-ups, and reporting to a committee, making third-party risk management the primary topic per Rule 3 (requirements imposed on vendors). Firm-specific facts include the named 'Vendor Management Committee' and 'Vendor Management team', elevating to Firm-Specific with no higher verifiable claims.


fact: defense in depth strategy

fact: data loss prevention technology

fact: advanced transport layer security encryption

fact: phishing, malware and social engineering testing

fact: S&T Information Security Program

reasoning: Paragraph describes the cybersecurity program's activities including strategy, tools like DLP and TLS encryption, and employee training on specific threats, directly answering 'What does the cybersecurity program do?' (RMP). Specificity reaches Firm-Specific due to the named 'S&T Information Security Program' distinguishing the company, plus multiple domain terms like defense in depth and DLP, but no verifiable quantified facts.


reasoning: Paragraph centrally describes requirements imposed on vendors for data handling, security safeguards, and contractual addendums including cybersecurity insurance and incident reporting, making third-party risk the primary topic per Rule 3 (TP vs RMP). No domain terms passing ERM test (e.g., generic 'safeguards' and 'standards' are boilerplate), no firm-specific elements like named roles/committees, and no verifiable facts like quantities or named certifications → Generic Boilerplate.


reasoning: This paragraph is a forward-looking disclaimer about potential material impacts from cybersecurity risks with a cross-reference to Item 1A, matching None/Other as it provides no substantive cybersecurity disclosure or answers to the core questions. No specific facts of any level are present, confirming Generic Boilerplate specificity.


fact: strategic risk management committees

reasoning: Paragraph centrally describes evaluation and mitigation of cybersecurity risks from third-party service providers via assessments and committee review, directly answering the Third-Party Risk question (vendor oversight as main topic per Rule 3). Specificity reaches Firm-Specific due to the named non-generic 'strategic risk management committees'; no domain terms pass ERM test and no verifiable facts present.


fact: Director of Cybersecurity

fact: Chief Information Officer (CIO)

fact: CIO reports directly to CEO

fact: over 20 years of cybersecurity oversight experience

reasoning: Paragraph details management roles (CIO, Director of Cybersecurity), responsibilities, reporting lines, and qualifications/career history, fitting Management Role per person-removal test (collapses without persons). Specificity reaches Quantified-Verifiable due to 'over 20 years' experience (verifiable lower bound) and named security-qualified roles (Director of Cybersecurity, CIO).


reasoning: Paragraph primarily describes evaluation of cybersecurity risks in third-party selection/oversight, contractual obligations, and review of providers' practices, making third-party risk management the central topic (TP per Rule 3). No domain terms passing ERM test, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate.


fact: Vice President of Cybersecurity

reasoning: This paragraph primarily describes board-level oversight of cybersecurity risks, including Audit Committee responsibilities, briefing cadences, and escalation processes, directly answering the Board Governance question. Specificity reaches Firm-Specific due to the named VP of Cybersecurity role, a firm-unique leadership position; no domain terms or verifiable claims elevate it further.


fact: On February 21, 2024, Change Healthcare notified us of a cybersecurity incident

fact: Change Healthcare, a subsidiary of UnitedHealth Group

fact: acted as an intermediary for processing of our payment claims for all payors

reasoning: The paragraph primarily describes a specific cybersecurity incident involving Change Healthcare, including timing, notification, response actions (severing connections, forensics), impact, and remediation, directly answering 'What happened in a cybersecurity incident?' despite a concluding immateriality statement. Specificity reaches Quantified-Verifiable due to the specific date (February 21, 2024) and named firms (Change Healthcare, UnitedHealth Group), which are externally verifiable facts tied to a real public event.


reasoning: This paragraph describes the Audit Committee's oversight role for cybersecurity risks in consultation with the Board, fitting Board Governance per board-level committee focus (Rule 1). No domain terminology passing ERM test, firm-specific facts (Audit Committee is generic), or verifiable claims found anywhere, yielding Generic Boilerplate.


reasoning: This paragraph states a conclusion that cybersecurity risks and incidents have not materially affected business strategy, results of operations, or financial condition as of a specific date, directly matching Strategy Integration per materiality rule 5 (backward-looking negative assertion); the cross-reference to Risk Factors is secondary. No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


fact: led by our CDO and our CISO

fact: collectively over 25 years of prior work experience

fact: ISACA Certified Information Security Manager

fact: ISC2 Certified Information Systems Security Professional

reasoning: This paragraph primarily answers how management is organized for cybersecurity by detailing the CDO and CISO's leadership roles, collective experience, required certifications, and monitoring responsibilities, fitting Management Role per person-specific focus (passes person-removal test). Specificity is Quantified-Verifiable due to verifiable facts like named certifications (CISM, CISSP) and quantified experience (>25 years).


reasoning: The paragraph primarily addresses how cybersecurity threats have and could affect business strategy, results of operations, and financial condition, directly matching Strategy Integration via materiality assessments (Rule 5). It contains no domain terminology passing the ERM test, no firm-specific facts like named roles or committees, and no verifiable claims like dates or quantities, yielding Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Risk Factors in Item 1A, providing no substantive cybersecurity disclosure itself, fitting None/Other per rules on cross-references. No specific facts of any level are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is introductory boilerplate emphasizing the general importance of cybersecurity and introducing the disclosure without addressing any substantive question about governance, management, processes, incidents, or strategy, fitting None/Other. No domain terms, firm-specific details, or verifiable facts are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph details the Audit Committee and Risk Committee's oversight of cybersecurity governance, risks, controls, and information security matters, directly answering how the board oversees cybersecurity, classifying it as Board Governance. No domain-specific cybersecurity terminology, firm-specific facts like unique roles or committees beyond generic board committees, or verifiable claims such as numbers or dates are present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily assesses the past, present, and potential future material impacts of cybersecurity on business strategy, operations, and financial condition, directly answering the Strategy Integration question with statements like 'have not been materially affected' and 'have materially affected our business strategy.' No specific facts elevate specificity: lacks domain terminology beyond generic terms, no firm-specific roles/committees/teams, and no verifiable quantities, dates, or named entities.


fact: incident in August 2023 that affected certain of our information systems and resulted in temporary disruptions to parts of our operations

reasoning: The paragraph primarily describes actual past cybersecurity incidents, including a specific one in August 2023 with details on scope and impact, directly answering 'What happened in a cybersecurity incident?'; the negative materiality assertion and forward-looking speculation are secondary. Specificity reaches Quantified-Verifiable due to the verifiable specific date ('August 2023') tied to a real event.


fact: Corporate Risk Committee

fact: CIO

fact: CISO

reasoning: Paragraph describes board-level oversight via named committees (Corporate Risk Committee, Audit Committee), reporting from CIO/CISO to board/committee with frequencies, fitting Board Governance as governance-chain structure. Specificity reaches Firm-Specific due to named firm-unique committee and cybersecurity leadership roles (CIO, CISO); no domain terms pass ERM test and no verifiable claims.


reasoning: The paragraph states conclusions about no material past or reasonably likely future impacts from cybersecurity on business strategy, financial condition, or operations, directly matching Strategy Integration per Rule 5. No domain terms, firm-specific facts, or verifiable claims are present anywhere, confirming Generic Boilerplate specificity.


fact: SOC 2

reasoning: The paragraph centrally describes processes for managing cybersecurity risks from third-party vendors, including onboarding, due diligence, security requirements, and reviews requiring SOC 2 or ISO 27001 reports, directly matching Third-Party Risk. Specificity is Domain-Adapted due to domain-specific frameworks SOC 2 and ISO 27001 that demonstrate cybersecurity expertise beyond generic ERM language.


reasoning: Paragraph centrally describes vendor due diligence, risk assessment for third-party access to data/systems, and review of vendors' security practices, directly answering 'How are third-party cyber risks managed?' making it Third-Party Risk; no domain-specific cybersecurity terminology (passes ERM test as generic vendor risk language), no firm-specific elements like named roles/committees, and no verifiable facts like numbers/dates/names, so Generic Boilerplate.


fact: As of February 28, 2024, we have not identified any compromise

reasoning: Paragraph primarily describes a real cybersecurity incident involving Change Healthcare (timing, notification, response actions like severing connections and forensics, scope on claims processing, and limited impact), directly answering 'What happened in a cybersecurity incident?'; dominant incident frame over materiality assessment per Rule 4. Specificity reaches Quantified-Verifiable due to specific dates (Feb 21 and 28, 2024) tied to the event and named firm (Change Healthcare/UnitedHealth), both externally verifiable via public reports.


fact: our CISO

reasoning: Paragraph details board oversight via annual CISO briefings and periodic external expert presentations, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity is Firm-Specific due to the CISO named role; no domain terms or verifiable facts elevate further.


fact: forensic reviews of cybersecurity-related incidents

fact: independent security assessments

reasoning: Paragraph details components of the information security program, including hiring external assessors for threat evaluation, forensic reviews, and assessments, directly answering 'What does the cybersecurity program do?' (RMP per Rule 3 as externals serve the company's program). Contains domain-specific terms like 'forensic reviews' and 'independent security assessments' that demonstrate cybersecurity expertise beyond generic ERM language, setting specificity to Domain-Adapted; no firm-specific or verifiable facts.


reasoning: This paragraph is a cross-reference to risk factors in Item 1A, providing no substantive cybersecurity disclosure itself, fitting None/Other per rules on cross-references and lack of actual content. No specific facts of any level are present, resulting in Generic Boilerplate specificity.


fact: Core Cybersecurity Management Team (CCMT)

fact: CIRP

reasoning: Paragraph describes management-level team structure (CCMT with CISO, CLO, CFO), responsibilities for oversight and incident response, fitting Management Role per Rule 1 (management committee) and Rule 2 (person-removal leaves little program detail). Specificity driven by firm-specific named role (CISO), committee (CCMT), and program (CIRP), reaching Firm-Specific with no higher verifiable facts.


reasoning: Paragraph centrally describes entrusting third-party providers with security responsibilities and conducting periodic assessments of their security frameworks, directly addressing third-party risk management → Third-Party Risk. No domain terminology passing ERM test, firm-specific facts, or verifiable claims found anywhere → Generic Boilerplate.


fact: Vice President of Information Security

fact: Information Technology Senior Leadership Team

fact: vulnerability assessments

fact: third-party and independent reviews

reasoning: Paragraph primarily describes board and Audit Committee oversight of cybersecurity risks, including briefing frequency, topics covered, and information flow from management, aligning with Board Governance per governance-chain default. Specificity reaches Firm-Specific due to named VP-level security role, CIO, and IT Senior Leadership Team, surpassing domain terms like vulnerability assessments.


reasoning: Paragraph states a backward-looking materiality conclusion ('to date... not material') and forward-looking risk, directly answering how cybersecurity has/will affect business/finances per Rule 5 (SI); cross-reference is secondary. No domain terms passing ERM test, no firm-specific roles/committees/teams, no verifiable claims (negative assertions not verifiable), so empty specific_facts → Generic Boilerplate.


fact: ransomware attack

reasoning: Paragraph describes a specific past cybersecurity incident including timing (2021), nature (ransomware attack), impact (no material effect), and initial response (accelerated IT initiatives), directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to the specific year 2021 tied to a real event and 'ransomware' as a domain-specific threat type.


fact: Vice President of Information Technology, Security and Business Intelligence

fact: over 18 years in information technology and information security

fact: roles at Biogen, AstraZeneca, Iron Mountain, Charles River Labs, Sunovion Pharmaceuticals, Agero, DentaQuest

fact: master's degree in business administration from Boston University

fact: master's degree in electrical and computer engineering from Utah State University

fact: bachelor's degree in electronics engineering from Mumbai University

fact: Information Technology team has over 10 years of experience with managing risks arising from cybersecurity threats

reasoning: Paragraph focuses on the VP of IT, Security and BI's role, responsibilities, coordination with executives, career history at named firms, and specific education, making Management Role the primary category as it describes leadership organization and qualifications. Specificity is Quantified-Verifiable due to multiple hard facts like 'over 18 years' experience, named prior employers, and degrees from specific universities.


reasoning: The paragraph centrally describes third-party risk assessments, requests for security information from material providers, and monitoring of incidents involving them, making Third-Party Risk the primary category as vendor oversight is the core topic. No domain-specific terminology passing the ERM test, firm-specific details, or verifiable facts are present, warranting Generic Boilerplate specificity.


fact: CIO

reasoning: The paragraph primarily describes the Board's direct oversight and Audit Committee's role in reviewing cybersecurity risks, management's actions, and updates, answering 'How does the board oversee cybersecurity?' (BG per governance-chain default and Rule 1). It includes the firm-specific 'CIO' role (Level 3), with no higher verifiable facts, setting specificity to Firm-Specific.


reasoning: Paragraph states conclusions about no material past impacts and forward-looking reasonable likelihood of material effects, directly matching SI materiality rule examples for backward- and forward-looking assessments; cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate specificity.


fact: cybersecurity due diligence reviews

reasoning: Paragraph centrally describes the Third Party Risk Management (TPRM) program for vendor cybersecurity due diligence, monitoring, and oversight, directly answering how third-party cyber risks are managed (TP). Firm-specific named TPRM program elevates to Level 3, with domain term 'cybersecurity due diligence reviews' supporting expertise but not exceeding.


reasoning: Paragraph primarily consists of forward-looking speculative risks and hypothetical impacts of cybersecurity failures, including cross-reference to prior disclosure, fitting None/Other per Rule 5 and Rule 6; no domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in empty specific_facts and Generic Boilerplate.


fact: Chief Security Officer ("CSO")

fact: served in that role for Zebra since 2018

fact: over 14 years of global executive cybersecurity experience

reasoning: This paragraph details the CSO's leadership role, responsibilities, reporting line, tenure, and qualifications, directly answering 'How is management organized to handle cybersecurity?' (MR per Rule 1 and person-removal test). Specificity hits Quantified-Verifiable from verifiable tenure ('since 2018') and experience ('over 14 years'), with CSO as firm-specific named role.


reasoning: The paragraph primarily describes high-level policies, procedures, and systems implemented to identify and address cybersecurity risks, directly answering the Risk Management Process question despite boilerplate language. No domain-specific terminology passing the ERM test (CIA triad is basic and ERM-applicable), firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate.


fact: Chief Security and Trust Officer

fact: reports to our Executive Vice President, Operations

fact: over 25 years

reasoning: Paragraph focuses on the Chief Security and Trust Officer's role, reporting line, responsibilities, and qualifications, directly answering 'How is management organized to handle cybersecurity?' (MR per person-removal test as it collapses without person-specific details). Specificity reaches Quantified-Verifiable due to the verifiable 'over 25 years' experience claim and firm-specific named roles (CSTO and EVP Operations).


fact: Senior Manager of our Enterprise IT Security Risk and Compliance team

fact: Managing Director of Enterprise IT

fact: over 30 years of IT experience

fact: over 20 years specializing in cybersecurity

reasoning: Paragraph primarily describes management leadership roles, reporting lines, and qualifications for handling cybersecurity (MR per person-focused organization and Rule 2). Specificity driven by verifiable quantified experience claims ('over 30 years', 'over 20 years') elevating to Level 4, with firm-specific named roles supporting.


fact: Chief Innovation Officer

reasoning: Paragraph describes Board and Audit Committee oversight of cybersecurity, including review topics, frequency, and information flow from management/Chief Innovation Officer, directly answering 'How does the board oversee cybersecurity?' (BG). Specificity reaches Firm-Specific due to the named Chief Innovation Officer role involved in cybersecurity reporting, a firm-unique leadership detail; no domain terms or verifiable facts elevate further.


fact: Farmer Mac's CISO

fact: cybersecurity subcommittee

fact: board enterprise risk committee

fact: Senior Vice President – Enterprise Risk Officer

fact: CISO has more than 20 years of experience in cybersecurity and information technology

fact: holds a Master's degree in Business Administration with a focus on Information Technology

fact: holds a Certified Information Security Manager (CISM) certification

reasoning: Paragraph primarily describes the CISO's role, qualifications, experience, certifications, and reporting lines to senior management, directly answering 'How is management organized to handle cybersecurity?' (MR per person-specific focus and Rule 2). Specificity reaches Quantified-Verifiable due to multiple verifiable facts like '>20 years experience', CISM certification, and specific degree, plus firm-specific roles and committees.


fact: John Bresney, EVP & CIO

fact: Robert McKenna, SVP of Enterprise Strategy and Execution

fact: Christopher Cunniff, SVP and CRO

fact: Board's Risk Committee

fact: ERC and the Emerging Risk Committee

fact: Security Incident Response Plan (IRP)

fact: over 27 years of technology and information security experience

fact: over 32 years of insurance industry experience

fact: Columbia University CIO Program Certificate

fact: Certified Insurance Counselor

fact: fellow of the Casualty Actuarial Society

fact: member of the American Academy of Actuaries

reasoning: Paragraph details management personnel's roles, reporting lines, responsibilities, qualifications, and experience in cybersecurity oversight, directly answering 'How is management organized to handle cybersecurity?' (Management Role). Multiple named roles, committees, programs, quantified experience durations (e.g., over 27 years), and verifiable certifications (e.g., Certified Insurance Counselor) drive Quantified-Verifiable specificity.


reasoning: The paragraph primarily details processes for third-party due diligence, security risk assessments, supplemental reviews post-incident, and continuous monitoring of vendors, making third-party risk management the central topic per Rule 3 (TP vs RMP). No domain terms passing the ERM test, firm-specific elements like named roles/committees, or verifiable facts like quantities/dates/named firms are present, resulting in Generic Boilerplate specificity.


fact: Third Party Risk Management (TPRM) program

fact: outside-in, hacker perspective of a company's cybersecurity posture

reasoning: Paragraph centrally describes third-party risk management via TPRM program, vendor due diligence, and ongoing monitoring, directly answering 'How are third-party cyber risks managed?'; specificity reaches Firm-Specific due to named TPRM program and domain term 'outside-in, hacker perspective' demonstrating expertise beyond generic ERM language.


fact: IT Security team

fact: over 30 years of experience

fact: GIAC Security Essentials

fact: GIAC Certified Enterprise Defender

fact: GIAC Certified Incident Handler Certification

fact: GIAC Certified Windows Security Administrator

fact: GIAC Critical Controls Certification

fact: Vice President of Information Technology

fact: over 19 years of experience

fact: Certified Information Systems Security Professional certification

reasoning: Paragraph primarily describes management roles, reporting lines, team leadership, and detailed qualifications/experience of specific cybersecurity leaders (Director of IT Infrastructure and Security and VP of IT), fitting Management Role per person-removal test where removing people collapses the content. Specificity reaches Quantified-Verifiable due to multiple verifiable facts like quantified experience ('over 30 years', 'over 19 years') and named certifications (GIAC variants, CISSP) that can be independently checked.


reasoning: Paragraph details the HR officer's biography and responsibilities with zero cybersecurity content, fitting None/Other as non-cybersecurity executive bio. No qualifying specific facts for any specificity level above Generic Boilerplate.


reasoning: Paragraph centrally describes vendor oversight processes including IT vendor risk policy, third-party risk program, pre-onboarding/annual security assessments, and remediation tracking, directly answering 'How are third-party cyber risks managed?' with TP as the primary focus per Rule 3. No domain terms passing ERM test (e.g., generic 'security assessments' and 'security controls' are L1), no firm-specific elements like named roles/committees/programs, and no verifiable facts like numbers/dates/named firms, resulting in empty specific_facts and Generic Boilerplate specificity.


reasoning: This paragraph describes hypothetical cybersecurity risks and their potential impacts in speculative terms ('could prevent', 'could harm'), which matches pure speculation without any substantive cybersecurity measures, processes, or assessments, defaulting to None/Other per Rule 5 and Rule 6. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, resulting in Generic Boilerplate specificity.


fact: vulnerability or risk identified

reasoning: Paragraph centrally describes management of third-party (acquisition target) cybersecurity risks through due diligence, testing, remediation, and contracts, directly answering 'How are third-party cyber risks managed?'; specificity driven by domain terms like 'independent testing of the target technology' and 'vulnerability or risk' that demonstrate cybersecurity expertise beyond generic ERM language, with no firm-specific roles or verifiable claims.


fact: CISO

fact: over 20 years of information technology and cybersecurity experience

fact: team comprises security engineers, detection specialists, and business cybersecurity experts

reasoning: Paragraph primarily describes the CISO's qualifications, leadership role, and team composition, fitting Management Role per person-specific focus and Rule 2 (process details remain minor after person removal). Specificity reaches Quantified-Verifiable due to the verifiable 'over 20 years' experience claim, with supporting firm-specific CISO role and team composition.


fact: crisis simulation exercises

fact: shipboard and shoreside employees

reasoning: Paragraph details incident response planning, updates, testing via exercises, and team handling, primarily answering 'What does the cybersecurity program do?' (RMP); no board/management focus or other categories dominate. Specificity is Firm-Specific due to the firm-unique 'shipboard and shoreside employees' (Carnival's cruise operations) and domain term 'crisis simulation exercises' passing ERM test, with no verifiable facts.


reasoning: Paragraph primarily states a backward-looking materiality conclusion ('no material incidents incurred to-date') and forward-looking potential impact on business, fitting Strategy Integration per Rule 5; speculation and cross-reference are secondary. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph primarily assesses cybersecurity's lack of material impact on business strategy, operations, or finances, both backward- and forward-looking, fitting Strategy Integration per Rule 5. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: Chief Information Officer (CIO)

fact: CSO

fact: appointed to the role in March 2022

fact: nearly 20 years of experience in managing IT functions

reasoning: Paragraph describes CIO's role, reporting line to CFO, peer relationship with CSO, appointment date, and experience, directly answering 'How is management organized to handle cybersecurity?' (MR per leadership roles/responsibilities/qualifications). Specificity reaches Quantified-Verifiable due to the verifiable appointment date (March 2022) and named high-level roles (CIO, CSO), with 'nearly 20 years' as a near-quantified claim.


fact: June 21, 2023, informed of Vendor Incident

fact: MOVEit file-sharing software

fact: names and social security numbers or tax identification numbers

fact: June 22, 2023, email notification

fact: August 2023, U.S. mail notice

fact: 429,252 Umpqua Bank customers

reasoning: This paragraph describes a specific past cybersecurity incident (Vendor Incident with MOVEit), including timeline, scope (data types, customer segments), impact (no further compromise), and remediation (notifications), directly answering 'What happened?' for Incident Disclosure. Specificity reaches Quantified-Verifiable due to multiple hard facts like exact dates (June 21/22, 2023; August 2023) and customer count (429,252).


fact: Cybersecurity Sub-Committee of the Board of Directors

reasoning: Paragraph details board and committee oversight of cybersecurity risks, updates, and incident response delegation, directly answering 'How does the board oversee cybersecurity?' (BG). Named 'Cybersecurity Sub-Committee of the Board' is a firm-specific committee, setting Firm-Specific without domain terms or verifiable claims.


reasoning: Paragraph primarily describes integration of cybersecurity risks into ERM, annual risk assessments, and evaluations of security approaches, answering 'What does the cybersecurity program do?' (RMP); Audit Committee oversight is secondary. No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph is an executive biography detailing Travis Smith's roles, responsibilities, and career history with no mention of cybersecurity, fitting None/Other as non-cybersecurity content; no cybersecurity-specific facts present, resulting in Generic Boilerplate specificity.


fact: more than 30 years of experience working in information technology

fact: dedicated cybersecurity team

fact: Master's in Cybersecurity

fact: Certified Information Systems Security Professional (CISSP)

fact: Certified Information Security Manager (CISM)

fact: Microsoft Certified Cybersecurity Architect Expert

fact: Graduate Certificates in Enterprise Cybersecurity and Data Science

fact: Security+

fact: Certified Information Systems Auditor (CISA)

reasoning: Paragraph primarily describes management leadership roles, qualifications, experience, and team composition/certifications, fitting Management Role per person-focused content and Rule 2 (person-removal leaves generic program outline). Specificity reaches Quantified-Verifiable due to verifiable facts like 'more than 30 years of experience' and specific named certifications (e.g., CISSP, CISM) held by the team, plus firm-specific elements like CIO role and dedicated team.


fact: ISC members

fact: CIO

fact: combined 20 years of risk management experience

fact: threat assessments

fact: vulnerability management

reasoning: Paragraph describes ISC committee membership and qualifications/experience of CIO and Director of IT Security, Risk and Compliance, directly answering 'How is management organized?' per MR (management-level roles/committee, person-specific expertise survives as core content). Specificity reaches Quantified-Verifiable due to 'combined 20 years' (verifiable quantity) and firm-specific elements like named roles/committee, atop domain terms like vulnerability management.


fact: cross-functional effort involving our end-user, Legal, Privacy and Information Security teams

reasoning: The paragraph primarily details processes for overseeing cybersecurity risks from third-party service providers, including vendor assessments and monitoring, making Third-Party Risk the central topic per rules (vendor oversight as focus). Specificity reaches Firm-Specific due to the named team composition (end-user, Legal, Privacy, Information Security teams), with no domain terms or verifiable claims elevating higher.


fact: Chief Information Officer

reasoning: Paragraph primarily describes management team's (including CIO) roles, responsibilities for cybersecurity risk management, and CIO's qualifications, fitting Management Role per person-removal test where roles/qualifications dominate over program activities. Specificity at Firm-Specific due to named CIO role; no domain terms pass ERM test and no quantified/verifiable facts present.


fact: Head of Global IT

fact: IT Security Team

fact: CompTIA certifications

fact: over 20 years of combined infrastructure architecture experience

fact: PCI, SOC1 and SOC2 level compliance

fact: cybersecurity experience includes managing the network, infrastructure security and a cyber security team of a global consumer products company with a heavy online presence and with sales of services and goods to the U.S. government

reasoning: Paragraph primarily describes management roles, responsibilities, qualifications, and team composition for handling cybersecurity (Head of Global IT and IT Security Team), fitting Management Role per person-removal test where core content is organizational structure. Specificity reaches Quantified-Verifiable due to verifiable facts like 'over 20 years combined experience,' named certifications (CompTIA), and compliance standards (PCI, SOC1, SOC2).


fact: Retrieval-Masters Credit Bureau, Inc. d/b/a/ American Medical Collections Agency (AMCA)

fact: the AMCA Incident

reasoning: This paragraph primarily describes a specific past cybersecurity incident involving a third-party vendor, including timing, nature, and consequences like litigation, directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to the precise date (May 14, 2019) and named external firm (AMCA), which are independently verifiable facts.


fact: aligned with the National Institute on Standards and Technology Cybersecurity Framework

fact: third party security operation center

fact: multi-factor authentication

fact: intrusion prevention and detection systems

fact: partitioning and encryption of information

fact: hardware and software updates and patching

reasoning: Paragraph describes the cybersecurity program's components, tools, processes, and alignment with NIST CSF, directly answering 'What does the cybersecurity program do?' (RMP); no board/management structure, incidents, or business impacts. Specificity driven by multiple domain terms (NIST CSF, SOC, MFA, IPS/IDS, encryption, patching) demonstrating cybersecurity expertise beyond generic ERM language, but no firm-specific roles/committees or verifiable quantities/names/dates.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors, which fits None/Other per category rules for cross-references with no substantive cybersecurity disclosure. No specific facts, domain terms, roles, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: dedicated department within its Enterprise Risk Management division

reasoning: Paragraph primarily describes a dedicated department for managing cybersecurity risks from third-party service providers (e.g., bank operations technology, payroll), making Third-Party Risk the central topic over RMP per Rule 3. Specificity is Firm-Specific due to the firm-unique organizational structure of a dedicated third-party risk department within ERM division; no domain terms, quantifiables, or higher facts present.


reasoning: Paragraph describes the role and responsibilities of the Chief Risk Officer in supporting ERM, answering 'How is management organized?' (MR per person-removal test: collapses without role details, no program activities remain). No domain terms, firm-specific cyber roles (CRO is generic exec role without cyber qualifier), or verifiable facts anywhere, so Generic Boilerplate.


reasoning: Paragraph primarily answers how third-party cyber risks are managed via due diligence, contractual requirements, oversight, and incident notifications, centrally fitting Third-Party Risk (not RMP as vendors are the focus per Rule 3). No domain terms passing ERM test, firm-specific elements, or verifiable facts anywhere, resulting in Generic Boilerplate.


fact: Risk Committee

fact: Incident Management and Information Security Plan

reasoning: Paragraph describes the Risk Committee's oversight role in assuring management and the Board on cybersecurity risk identification, evaluation, and controls, aligning with Board Governance as a board-level committee oversight structure (Rule 1). Specificity reaches Firm-Specific due to the named committee and named internal security plan, distinguishing the company's structure without domain terms or verifiable claims.


reasoning: This paragraph states a conclusion about no material cybersecurity incidents affecting business outcomes, directly matching Strategy Integration per Rule 5 (backward-looking materiality assessment and negative assertion). No specific facts elevate specificity: negative self-assertion is not verifiable, and there are no domain terms, firm-specific details, or quantified claims.


fact: On October 11, 2023, we announced that we had experienced disruptions

fact: disruption of our business operations for approximately three days

fact: restore our operations within three days

fact: fulfill our backlog of orders... within one week

reasoning: The paragraph primarily describes a specific past cybersecurity incident including timing, nature, response, remediation, and resolution, directly answering 'What happened in a cybersecurity incident?' (Incident Disclosure). Specificity reaches Quantified-Verifiable due to the specific date (October 11, 2023) and quantified durations (three days, one week) that are externally verifiable via public announcements and filings.


reasoning: Paragraph is generic boilerplate emphasizing broad organizational responsibility for data handling without addressing any specific cybersecurity oversight, roles, processes, or incidents, defaulting to None/Other. Contains the CIA triad ('confidentiality, integrity, and availability'), a domain-specific cybersecurity concept passing the ERM test, setting specificity to Domain-Adapted.


fact: ransomware

fact: malware

fact: computer viruses

fact: phishing attempts

reasoning: Paragraph primarily states a conclusion on no material cybersecurity incidents to date and mentions insurance, directly answering a Strategy Integration materiality question per Rule 5 (negative assertion). Domain terms like ransomware and phishing elevate specificity to Domain-Adapted as they demonstrate cybersecurity expertise beyond generic ERM language.


fact: Senior Vice President of Information Technology ("SVP IT")

category_confidence: medium

reasoning: Paragraph primarily describes cybersecurity program activities like monitoring information systems, deploying security measures, system audits, and incident response planning (RMP per person-removal test, as substantive processes remain); SVP IT role provides firm-specific detail elevating to Firm-Specific, no domain terms or verifiable claims.


fact: Operational Risk Committees

fact: Enterprise Risk Management Committee

fact: Information Security and Data Management Committee

fact: SHUSA's Head of Technology & Operations

fact: Chief Risk Officer

fact: Chief Technology Officer

reasoning: Paragraph primarily describes management-level committee structures, memberships, and leadership roles (e.g., CTO, CRO chairing committees) for handling cybersecurity risks, fitting Management Role per Rule 1; brief Board mention is subordinate. Specificity driven by multiple firm-specific named committees and senior IT/cyber roles (Level 3), with no domain terms or verifiable claims elevating higher.


reasoning: This paragraph provides generic boilerplate on mitigation systems and programs without describing any specific processes, measures, or structure, primarily serving as a forward-looking disclaimer and cross-reference to Risk Factors, which fits None/Other. No domain terminology passing the ERM test, firm-specific facts, or verifiable claims are present anywhere in the text, warranting Generic Boilerplate specificity.


reasoning: Paragraph is forward-looking speculation, a vague negative assertion about no recent material incidents (not verifiable or substantive), references to other companies' incidents generically, and a cross-reference to Risk Factors, fitting None/Other per rules on disclaimers and lack of substantive cybersecurity disclosure. No domain terms passing ERM test, firm-specific facts, or verifiable claims anywhere, yielding empty specific_facts and Generic Boilerplate.


fact: exploitation in software or code with malicious intent

fact: state-sponsored cyber attacks

fact: vulnerabilities relating to new technologies, such as generative AI

reasoning: This paragraph speculates on future threats and control insufficiency with a cross-reference to risk factors, fitting None/Other as pure speculation without describing governance, processes, or incidents (Rule 5, Rule 6). Specificity reaches Domain-Adapted due to domain-specific threat terminology like ransomware and generative AI vulnerabilities that pass the ERM test, with no firm-specific or verifiable facts.


fact: offered identity protection services, including credit monitoring

fact: to all of our current and former customers for two years

reasoning: Paragraph describes ongoing remediation efforts (law enforcement engagement, litigation defense, customer credit monitoring services) following a cybersecurity incident, directly answering 'what happened' via response actions. Specificity reaches Quantified-Verifiable due to the verifiable claim of offering services 'for two years' to all customers, plus domain term 'credit monitoring'.


fact: CRO (Chief Risk Officer)

fact: CIO (Chief Information Officer)

fact: CISO (Chief Information Security Officer)

fact: CRO has more than 30 years of experience

fact: CRO, CIO each have over 15 years experience

fact: CRO is a member of RGA's Executive Committee

fact: CIO is a member of RGA's Executive Committee

fact: CISO oversees the Company's global security and privacy teams

reasoning: Paragraph details leadership roles (CRO, CIO, CISO), their responsibilities, qualifications, and experience, directly answering 'How is management organized to handle cybersecurity?' per Management Role; person-removal test confirms as it collapses without role-specific content. Specificity reaches Quantified-Verifiable due to hard lower-bound experience claims ('over 15 years', 'more than 30 years') and named VP-level roles/teams verifiable externally.


fact: National Institute of Standards and Technology Cybersecurity Framework

fact: Center for Internet Security – Top 18 Critical Security Controls – Control Level Framework

fact: Phishing tests conducted at least quarterly on a global basis

fact: cybersecurity tabletop exercises

reasoning: Paragraph details the cybersecurity program's components, processes, and features like assessments, training, phishing tests, and incident response, directly answering 'What does the cybersecurity program do?' (RMP); third-party mention is minor. Specificity driven by domain terms like NIST CSF, CIS Top 18, phishing tests, and cyber tabletops passing ERM test for L2, with no firm-specific roles or verifiable quantities for higher levels.


fact: In July 2018

fact: ransomware incident

reasoning: This paragraph describes a specific past cybersecurity incident including timing, nature (ransomware), scope (Dx IT systems and operations), investigation results, and immaterial impact, directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to the verifiable specific date 'July 2018' for the event, with ransomware as a supporting domain term.


fact: Cyber ERM (Enterprise Risk Management) Committee

reasoning: Paragraph describes the Cyber ERM Committee's role in incident reporting to the Audit Committee and Board for oversight and materiality assessment, fitting Board Governance as a governance-chain oversight structure (Rule 1). Named committee 'Cyber ERM' is a firm-specific fact elevating specificity to Firm-Specific (Level 3), with no domain terms or verifiable claims.


reasoning: Paragraph outlines board-level oversight via the Audit Committee approving an annual risk-based audit plan informed by ERM that includes cybersecurity risks, directly answering how the board oversees cybersecurity (BG per governance-chain default). No domain cybersecurity terminology (ERM/audit are generic), no firm-specific cyber roles/committees, and no verifiable facts like numbers/dates/names, so Generic Boilerplate.


reasoning: The paragraph primarily details processes for overseeing and managing cybersecurity risks from third-party service providers, including annual evaluations, contractual safeguards, and reviews of internal control reports, making Third-Party Risk the central topic per Rule 3 (requirements imposed on vendors). No domain terminology passing the ERM test, firm-specific facts (e.g., named roles or committees), or verifiable claims (e.g., hard numbers, dates, named firms) are present anywhere in the text, yielding Generic Boilerplate specificity.


reasoning: Paragraph centrally describes vendor management process for cybersecurity risks from third-party providers, including assessments and contractual obligations, making Third-Party Risk the primary category per rules (vendor oversight central). No domain terms passing ERM test (generic vendor risk language), no firm-specific elements like named roles/committees, no verifiable facts like numbers/dates/names → Generic Boilerplate.