reasoning: Paragraph discusses general reliance on technology, increasing complexity of threats (cyber intrusions, denial of service attacks), and a generic definition of information security without describing any oversight, roles, processes, incidents, or strategy; fits None/Other as speculation without substantive measures (Rule 6, Rule 5). None/Other mandates Generic Boilerplate specificity with empty specific_facts, overriding any domain terms present.


content_category: Board Governance

fact: CISO

fact: ISO

category_confidence: high

specificity_confidence: high

reasoning: Paragraph describes board and audit committee oversight of cybersecurity, including reporting flows for incidents, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1 for board-level committees). Specificity reaches Firm-Specific due to named cybersecurity roles (CISO, ISO) in the reporting chain, with no domain terms or verifiable claims elevating higher.

provider: x-ai

stage: benchmark


content_category: Management Role

fact: the Company's CCO

fact: risk management, legal, information technology, and/or compliance personnel of the Adviser

reasoning: Paragraph primarily describes management's (including CCO) responsibilities, expertise, and monitoring processes for cybersecurity, directly answering 'How is management organized to handle cybersecurity?' per MR definition and person-removal test (collapses without roles). Specificity reaches Firm-Specific due to named CCO role and specific team composition of Adviser's personnel, distinguishing the company's structure.


content_category: Risk Management Process

fact: penetration testing of our customer facing domains

fact: CIS Critical Security Controls

type: framework

category_confidence: medium

reasoning: The paragraph primarily describes the cybersecurity program's activities, including third-party engagements for penetration testing and assessments, policies for monitoring vendor risks, and incident response planning with testing, answering 'What does the cybersecurity program do?' (RMP over TP as vendor oversight is embedded in program description); domain terms like 'penetration testing' and 'CIS Critical Security Controls' (passing ERM test) drive Domain-Adapted specificity, with no firm-specific roles or verifiable quantities.


content_category: None/Other

reasoning: This paragraph consists of speculative forward-looking language about future incidents and a cross-reference to Item 1A Risk Factors, which matches None/Other per rules on disclaimers and cross-references without substantive cybersecurity content. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, confirming Generic Boilerplate specificity.


content_category: Third-Party Risk

reasoning: Paragraph centrally describes vendor cybersecurity risk assessments and alignment with company standards, directly answering 'How are third-party cyber risks managed?' with vendor oversight as the primary topic (TP per Rule 3). No domain terms passing ERM test, firm-specific facts (e.g., no named roles/committees), or verifiable claims (no numbers/dates/names), so specificity is Generic Boilerplate.


reasoning: Paragraph contains speculative risk language, admission of lacking a cybersecurity program, and a negative assertion of no incidents since IPO, which for SPACs with no operations or measures described fits None/Other per Rule 6; no domain terminology passing ERM test, firm-specific facts, or verifiable claims (negative assertions not verifiable), resulting in empty specific_facts and Generic Boilerplate.


content_category: Strategy Integration

reasoning: Paragraph provides a negative assertion about no material cybersecurity incidents experienced by the company and minimal impact from third-party incidents, directly matching Strategy Integration's materiality rule for backward-looking conclusions on business impact. No domain terminology passing ERM test, firm-specific facts, or verifiable claims (negative assertions not verifiable), yielding Generic Boilerplate specificity.


reasoning: The paragraph primarily states conclusions about no material past or reasonably likely future impacts from cybersecurity on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5; it includes forward-looking speculation and a cross-reference but centers on materiality assessment. No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph primarily describes requirements imposed on third-party service providers (certification of security measures, breach reporting), making vendor oversight the central topic per Rule 3 (TP vs RMP). No domain terminology passing ERM test, no firm-specific facts (unnamed consultants), no verifiable claims (no names, numbers, dates, certifications held), so empty specific_facts and Generic Boilerplate.


reasoning: Paragraph states a conclusion that cybersecurity risks and incidents have not materially affected business strategy, results of operations, or financial condition (SI per Rule 5 backward-looking materiality assessment), with cross-reference to Item 1A but no incident details. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states conclusions about the lack of material past or reasonably likely future impacts of cybersecurity on business outcomes, directly matching Strategy Integration per materiality rule (backward- and forward-looking assessments). No domain terms passing ERM test, firm-specific facts, or verifiable claims (negative assertions are not externally verifiable), resulting in Generic Boilerplate specificity.


reasoning: This paragraph centrally describes processes for managing cybersecurity risks from vendors/service providers, including reviews, contracts, assessments, inspections, questionnaires, and re-assessments, directly matching Third-Party Risk. It lacks domain-specific cybersecurity terminology beyond generic vendor risk practices, firm-specific elements like named roles or committees, or verifiable facts like quantities or dates, warranting Generic Boilerplate specificity.


reasoning: Paragraph describes engaging third-party consultants for risk assessment, testing, and advisory services as part of the internal cybersecurity program, primarily answering 'What does the cybersecurity program do?' (RMP per Rule 3: externals hired to serve the company). No domain terms passing ERM test, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate.


reasoning: Paragraph primarily states conclusions on past and potential material impacts of cybersecurity on business outcomes, directly matching Strategy Integration per materiality rule (backward- and forward-looking assertions). No specificity-elevating facts present anywhere—no domain terms, firm-specific details, or verifiable claims—resulting in Generic Boilerplate.


fact: holds CISSP (Certified Information Systems Security Professional)

type: quantified

fact: holds CCSP (Certified Cloud Security Professional)

fact: penetration testing

fact: real-time vulnerability scanning

fact: intrusion detection

reasoning: Paragraph primarily describes the cybersecurity program's activities (assessments, penetration testing, vulnerability scanning, etc.), qualifying as Risk Management Process per person-removal test (substantive program remains after removing leadership details). Specificity reaches Quantified-Verifiable due to verifiable certifications (CISSP, CCSP) and firm-specific role (Director of Information Security and Privacy), plus multiple domain terms.


fact: cybersecurity incident response team

reasoning: Paragraph describes the incident response process including escalation, team designation for mitigation/remediation, and reporting, which primarily answers 'What does the cybersecurity program do?' making it RMP; person-removal test leaves substantive program description. Specificity driven by firm-specific 'cybersecurity incident response team' (non-generic named team), reaching Firm-Specific with no higher verifiable facts.


fact: Enterprise Risk and Compliance Committee of the Company's Board of Directors (the "ERC Committee")

reasoning: This paragraph describes how cybersecurity-related findings are presented to a board-level committee, directly addressing board oversight and information flow, fitting Board Governance per governance-chain rules. Specificity reaches Firm-Specific due to the named non-generic board committee (ERC Committee), a firm-unique fact distinguishing this company's structure.


reasoning: This paragraph describes the cybersecurity program's activities (assessing, identifying, managing risks via policies, controls, and internal/external reviews), directly answering 'What does the cybersecurity program do?' making it Risk Management Process; external assessments are part of the internal program per Rule 3, not central Third-Party Risk. No domain terms passing ERM test (e.g., no specific practices/tools/standards), no firm-specific facts, no verifiable claims, so empty specific_facts and Generic Boilerplate specificity.


reasoning: Paragraph asserts no material cybersecurity incidents affecting business strategy, results, or finances, fitting Strategy Integration per Rule 5 (backward-looking negative materiality assessment). No domain terms, firm-specific details, or verifiable facts present anywhere, yielding Generic Boilerplate specificity.


fact: Vice President of Information Systems

reasoning: Paragraph describes the oversight structure from VP of Information Systems reporting to CFO and Audit Committee, with Board ultimate oversight and information flow, fitting BG per governance-chain rule over MR. Specificity driven by firm-specific VP of Information Systems role (Level 3), no domain terms or verifiable facts elevating higher.


reasoning: Paragraph primarily describes processes to oversee cybersecurity risks from third parties, making Third-Party Risk the central topic despite mentioning consultants hired for internal risk assessment (RMP per Rule 3); no domain terms, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states conclusions about no material past or likely future cybersecurity impacts on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5; the admissions of no policies and generic awareness steps reinforce this without substantive program details. No domain terms passing the ERM test, no firm-specific roles/committees/teams, and no verifiable facts like dates, numbers, or certifications, resulting in Generic Boilerplate specificity.


reasoning: Paragraph primarily states a negative materiality assessment ('no material incidences as of December 28, 2024') and references potential business impacts, fitting Strategy Integration per Rule 5; no domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate.


reasoning: This paragraph is a section header and generic introductory statement emphasizing importance without describing any specific oversight structure, roles, processes, incidents, or impacts, fitting None/Other per Rule 6. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: VP Security

fact: IT Risk and Compliance Team

reasoning: Paragraph describes management-level roles, team composition, and reporting lines (IT Risk and Compliance Team reports to VP Security), fitting Management Role per person-removal test as it centers on organizational structure rather than program activities. Specificity reaches Firm-Specific due to named VP-level security role and named team, distinguishing the company's structure.


reasoning: This paragraph describes the company's risk assessment methodology as part of its cybersecurity program, directly answering 'What does the cybersecurity program do?' under Risk Management Process; no other category fits as it lacks governance, roles, incidents, or third parties. Specificity is Generic Boilerplate as the language is standard ERM boilerplate with no domain-specific cybersecurity terms, firm-unique details, or verifiable facts passing the ERM test or other criteria.


reasoning: This paragraph provides a materiality assessment stating that cybersecurity risks have not materially affected and are not reasonably likely to materially affect the business, directly answering a Strategy Integration question per Rule 5 SI materiality rule, with a cross-reference that does not change the primary focus. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, confirming Generic Boilerplate specificity.


reasoning: The paragraph primarily describes processes and contract reviews for managing cybersecurity risks from third-party service providers, directly answering the Third-Party Risk question as the central topic. No domain-specific terminology, firm-unique facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a boilerplate forward-looking statements disclaimer with no cybersecurity content or measures described, fitting None/Other; no specific facts of any level are present, confirming Generic Boilerplate specificity.


fact: Chief Information Officer

fact: cybersecurity governance committee

fact: Chief Financial Officer

fact: Chief Legal Officer

fact: Head of Internal Audit

reasoning: Paragraph primarily describes management-level organization including IT team leadership under CIO, cybersecurity governance committee membership (CFO, CLO, CIO, Head of Internal Audit), and their responsibilities for policies and program execution, fitting Management Role per rules on management committees and roles. Specificity reaches Firm-Specific due to named cybersecurity committee and executive roles like CIO and Head of Internal Audit in cyber context; no domain terms or verifiable claims elevate higher.


reasoning: This paragraph describes the board's oversight of cybersecurity risks, including direct administration and delegation to the audit committee, directly answering the Board Governance question; executive officers are mentioned secondarily for day-to-day management, but the focus is board structure per Rule 1. No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


fact: Chief Risk Officer designated as Chief Privacy Officer

fact: Chief Information Security Officer

fact: Board's Risk Oversight Committee

fact: over 13 years previously serving as the Company's Chief Financial Officer

fact: over 20 years of work experience in cybersecurity at financial institutions

reasoning: Paragraph primarily describes management-level leadership roles (Chief Privacy Officer/CRO, CISO), their responsibilities, reporting lines, and qualifications, fitting Management Role per person-removal test where roles and org structure dominate. Specificity reaches Quantified-Verifiable due to verifiable quantified experience claims ('over 13 years', 'over 20 years') alongside firm-specific named roles and committee.


fact: Board's Technology Committee

reasoning: Paragraph describes board-level oversight structure and delegation to the Technology Committee for cybersecurity risks, directly answering 'How does the board oversee cybersecurity?' (BG). Named 'Technology Committee' is a firm-specific committee elevating specificity to Firm-Specific (Level 3); no domain terms or verifiable facts present.


reasoning: Paragraph centrally describes reliance on third-party service providers for information systems, exposure to their cyber attacks, and continuous monitoring of associated risks, directly answering the Third-Party Risk question per Rule 3 (vendor oversight as central topic). No domain terms passing ERM test, no firm-specific facts (e.g., named roles/committees), and no verifiable claims (e.g., numbers, dates, named firms), resulting in empty specific_facts and Generic Boilerplate specificity.


reasoning: Paragraph describes elements of the cybersecurity risk management program, specifically asset-related procedures, directly answering 'What does the cybersecurity program do?' (RMP). No domain-specific terminology, firm-specific facts, or verifiable claims present; generic processes like asset identification and assessment fail ERM test for Level 2, resulting in Generic Boilerplate.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with speculative language about potential material effects, fitting None/Other per Rule 5 and Rule 6 as it lacks substantive cybersecurity disclosure. No specific facts of any level are present, resulting in Generic Boilerplate specificity.


content_category: Incident Disclosure

fact: third quarter of fiscal year 2023

fact: zero-day vulnerability

fact: Note 15. Commitments and Contingencies

reasoning: The paragraph primarily describes a specific past material cybersecurity incident, including its timing (Q3 FY2023), nature (unauthorized access to personal information via zero-day vulnerability in vendor software), scope, and remediation (expenses detailed in Note 15), directly answering 'What happened in a cybersecurity incident?'; forward-looking and risk reference elements are secondary. Specificity reaches Quantified-Verifiable due to the specific dated incident and verifiable cross-reference to Note 15, alongside the domain term 'zero-day vulnerability'.


reasoning: Paragraph states a materiality conclusion about no material past or likely future impacts from cybersecurity on business strategy, results, or finances, directly matching Strategy Integration per Rule 5 (backward- and forward-looking assertions). No domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes board-level oversight of cybersecurity risks, including delegation to the Audit Committee and management's Technology Steering Committee, fitting Board Governance per governance-chain default (Rule 1). Specificity reaches Firm-Specific due to the named non-generic 'Technology Steering Committee', a firm-unique organizational detail; no domain terms or verifiable claims present.


fact: In June 2024, a cybersecurity incident occurred

fact: involving CDK, a third-party provider

reasoning: The paragraph centers on a real cybersecurity incident in June 2024 involving third-party CDK, detailing its timing, nature (disruption via provider), response (triggered incident plan), and impact (no material financial effect), directly answering 'What happened in a cybersecurity incident?' per ID criteria over RMP plan description. Specificity reaches Quantified-Verifiable due to the specific date and named firm CDK as verifiable facts.


reasoning: Paragraph cross-references risk factors and asserts no material cybersecurity incidents have occurred, directly addressing materiality and business impact per SI rules (negative assertion). No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: regularly scanning our environment for vulnerabilities

fact: performing penetration testing

reasoning: Paragraph describes the activities of the cybersecurity program, including vulnerability scanning and penetration testing, directly answering 'What does the cybersecurity program do?' (RMP); third-party engagement is for internal assessment, not vendor oversight (Rule 3). Specificity driven by domain terms like vulnerability scanning and penetration testing that pass ERM test (Level 2), with no firm-specific roles or verifiable claims.


reasoning: This paragraph describes the Board's oversight responsibilities and awareness of cybersecurity risks, directly answering 'How does the board oversee cybersecurity?' fitting Board Governance. No domain terms, firm-specific details, or verifiable facts are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph contains speculative language about potential cybersecurity impacts and a cross-reference to Item 1A, fitting None/Other per Rule 5 (speculation like 'could have a material impact' is not SI) and Rule 6 (no substantive measures). No specific facts of any level are present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily details the company's third-party information risk management program, including periodic security risk assessments, remediation or termination actions, and contractual security provisions, making Third-Party Risk the central topic per Rule 3 (requirements imposed on vendors). No domain terminology passing the ERM test, firm-specific elements like named roles/committees/programs, or verifiable facts (e.g., numbers, dates, certifications) are present, yielding Generic Boilerplate specificity.


fact: CSIRPs (Cybersecurity Incident Response Plans)

fact: detection, analysis, containment, eradication, recovery, post-incident review

reasoning: Paragraph describes the components and activities of Cleco's incident response plans (CSIRPs), directly answering 'What does the cybersecurity program do?' under Risk Management Process. Specificity reaches Firm-Specific due to the named internal program 'CSIRPs' and domain-specific incident response phases that demonstrate cybersecurity expertise.


reasoning: Paragraph centrally describes vendor risk assessments, control requirements, and compliance monitoring, directly answering the Third-Party Risk question per Rule 3 (requirements imposed on vendors). No domain terms passing ERM test (e.g., 'cybersecurity controls' is generic L1), no firm-specific elements like named roles/committees/programs beyond boilerplate, and no verifiable facts, yielding empty specific_facts and Generic Boilerplate specificity.


fact: Deputy Chief Executive Officer and Chief Financial Officer

fact: more than seven years of operational responsibility for IT

reasoning: Paragraph primarily details management organization for cybersecurity, naming specific leaders (Deputy CEO/CFO), their responsibilities (leading execution, protocols, etc.), reporting (manages external IT team), and qualifications (experience), outweighing the initial generic board oversight sentence per Rule 1 and text volume. Specificity reaches Quantified-Verifiable due to the verifiable lower-bound experience claim ('more than seven years') and firm-specific C-level role with IT/cyber portfolio.


reasoning: Paragraph describes information flow from senior management to the Audit Committee (board-level) for oversight of material cybersecurity matters, directly answering 'How does the board oversee cybersecurity?' with no substantive program details. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: utilize third-party risk monitoring security rating services

reasoning: The paragraph primarily describes methods for managing cybersecurity risks from third-party technology and services (diligence, contracts, security ratings), making Third-Party Risk the central topic per category rules. It includes the domain term 'third-party risk monitoring security rating services' that passes the ERM test for cybersecurity expertise, setting specificity to Domain-Adapted with no higher-level facts.


reasoning: This paragraph describes hypothetical cybersecurity risks and potential adverse effects in speculative terms ('could expose', 'may also cause'), which matches pure speculation without any substantive cybersecurity measures, processes, or assessments, defaulting to None/Other per Rule 6 and Rule 5. No specific facts of any level are present—no domain terminology passing the ERM test, no firm-specific details, and no verifiable claims—resulting in Generic Boilerplate specificity.


fact: Enterprise Risk Management Committee (ERMC)

fact: TISC meetings

fact: Director of Enterprise Risk Management

fact: Chief Risk Officer

reasoning: Paragraph details the structure, membership, responsibilities, and reporting lines of the management-level ERMC, which oversees cyber risks among other risks, fitting Management Role per Rule 1 (management committee structure) and person-removal test leaving oversight activities but focused on organization. Specificity reaches Firm-Specific due to named committees (ERMC, TISC) and roles (Director of Enterprise Risk Management, Chief Risk Officer) that distinguish the company's setup.


fact: CISO

fact: CISO responsible for leading cybersecurity strategy centrally at Roivant and the majority of Vants

reasoning: Paragraph describes the CISO's leadership role and responsibilities in cybersecurity, directly answering 'How is management organized to handle cybersecurity?' (MR per rules); firm-specific facts like the named CISO role and its unique scope at Roivant/Vants elevate to Firm-Specific (Level 3), with no domain terms or verifiable claims.


reasoning: The paragraph primarily assesses the lack of material impact from past and 2024 cybersecurity incidents on business strategy, financial condition, or operations, directly answering a Strategy Integration question per the materiality rule for negative assertions. No domain terms, firm-specific facts, or verifiable claims (negative assertions like 'no material incidents' are not externally verifiable) elevate specificity beyond Generic Boilerplate.


fact: management team has primary responsibility for overall cybersecurity risk management program

fact: supervises internal cybersecurity personnel and retained external cybersecurity consultants

fact: industry-recognized certifications such as CISSP, CISM, and CISA

fact: decades of experience as part of our IT team

fact: previous cybersecurity leadership positions at various Fortune 500 companies and U.S. Defense contractors

reasoning: Paragraph primarily describes management's responsibilities (monitoring threats, oversight of program and personnel) and qualifications (certifications, experience), fitting Management Role per person-removal test as it collapses without team references. Specificity reaches Quantified-Verifiable due to named certifications (CISSP, CISM, CISA) that are externally verifiable and 'decades of experience' as a lower-bound quantified claim.


reasoning: Paragraph describes external regulations, oversight by banking agencies, and SEC disclosure rules with a cross-reference to another section, answering no substantive cybersecurity question and fitting None/Other (cross-references, non-cyber content). None/Other always gets Generic Boilerplate regardless of any incidental facts like dates.


reasoning: This paragraph states a conclusion about no material cybersecurity incidents or likely future material effects, directly matching Strategy Integration per the materiality rule for negative assertions and forward-looking likelihood. No domain terms, firm-specific facts, or verifiable claims present; the date is reporting period context and the negative assertion is not externally verifiable, resulting in Generic Boilerplate.


reasoning: The paragraph centrally describes the process for identifying, assessing, and mitigating cybersecurity risks from third-party service providers, including initial assessments based on access criteria and contractual specifications, directly answering the Third-Party Risk question. No domain terminology passing the ERM test, firm-specific facts, or verifiable claims are present, leading to Generic Boilerplate specificity.


reasoning: This paragraph outlines oversight responsibilities for implementing cybersecurity policies and promoting commitment, directly answering how the board or committee oversees cybersecurity, fitting Board Governance. It contains no domain terminology, firm-specific details, or verifiable facts, warranting Generic Boilerplate specificity.


fact: cybersecurity assessors

fact: threat assessments

fact: proactive detection tools

reasoning: Paragraph describes the company's cybersecurity program activities, including engaging external assessors for audits/threat assessments and using proactive detection tools, directly answering 'What does the cybersecurity program do?' (RMP per Rule 3, as these are third parties hired to serve the company). Domain terms like 'cybersecurity assessors,' 'threat assessments,' and 'proactive detection tools' pass the ERM test for expertise, setting specificity to Domain-Adapted with no firm-specific or verifiable facts.


fact: phishing simulations

fact: malware detection

reasoning: Paragraph describes employee training, simulations, and testing activities, directly answering 'What does the cybersecurity program do?' (RMP). Contains domain-specific terms like 'phishing simulations' and 'malware detection' that demonstrate cybersecurity expertise beyond generic ERM language, setting specificity to Domain-Adapted; no firm-specific roles or verifiable facts.


reasoning: Paragraph is a cross-reference to Item 1A Risk Factors with hypothetical risk language, matching N/O rule for cross-references and speculation without substantive disclosure. No domain terms, firm-specific facts, or verifiable claims anywhere, confirming Generic Boilerplate.


fact: In August 2020, we discovered ransomware on a server

fact: ransomware

fact: engaged third-party forensics experts

reasoning: Paragraph describes a specific past ransomware incident including timing (August 2020), nature (ransomware on a server), response (third-party forensics and counsel), scope (no personal data accessed), and remediation (security enhancements), directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to the specific date 'August 2020' which is externally verifiable, plus domain terms like 'ransomware' and 'forensics experts'.


fact: Information Security Officer

fact: Chief Information Officer

reasoning: Paragraph describes responsibilities of specific management roles (Information Security Officer and Chief Information Officer) for training, directly answering 'How is management organized to handle cybersecurity?' (MR per person-removal test as content ties to roles). Specificity reaches Firm-Specific due to named cybersecurity leadership roles (ISO and CIO), with no higher verifiable facts.


reasoning: This paragraph describes the audit committee's oversight of cybersecurity risks, updates from the CFO, and reporting to the board, directly answering the Board Governance question about board oversight structure. No domain terms passing the ERM test, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: phishing security test

fact: email that mimics a potentially harmful phishing attempt

reasoning: Paragraph describes employee cybersecurity training and monthly phishing simulations, directly answering 'What does the cybersecurity program do?' (RMP); third-party for internal testing is RMP per Rule 3. Specificity driven by domain terms like 'phishing security test' and simulated phishing emails, passing ERM test for cybersecurity expertise (Level 2), with no firm-specific roles/committees or verifiable claims like numbers/names.


reasoning: Paragraph describes regulatory oversight and SEC disclosure rules with cross-reference, not answering any substantive cybersecurity question (board, management, processes, etc.), fitting None/Other. Specificity is Generic Boilerplate per rules for None/Other regardless of dates or regulatory facts present.


fact: System and Organizational Control ("SOC") type reports

reasoning: Paragraph primarily describes cybersecurity program activities including software deployment for threat mitigation, internal audits for threat identification, and vendor SOC report requirements, answering 'What does the cybersecurity program do?' (RMP) with third-party elements as subordinate (not central TP). Specificity is Domain-Adapted due to the domain-specific SOC reports term passing the ERM test; no firm-specific roles or verifiable claims present.


reasoning: Paragraph primarily describes management roles (Senior Director of IT, CEO, GC, CFO) and their cybersecurity responsibilities like hiring, integration, budgeting, incident escalation, fitting Management Role per person-removal test (focus on who over program activities). No domain terms passing ERM test, no firm-specific roles per rules (Director of IT lacks security qualifier; CEO/CFO/GC generic), no verifiable facts, so Generic Boilerplate.


reasoning: This paragraph discusses general reliance on secure information processing and speculative future cybersecurity threats without addressing any of the six substantive questions like oversight, processes, or incidents, making it None/Other per Rule 6 (pure speculation without measures). No domain terms passing the ERM test, firm-specific facts, or verifiable claims are present anywhere in the text, driving Generic Boilerplate specificity.


fact: IT Steering Committee

fact: trend analysis on attack vectors

fact: reported vulnerabilities

reasoning: Paragraph primarily describes the cybersecurity program's activities including risk identification, evaluation, mitigation assessment, continuous monitoring, and quarterly expert updates on threats/vulnerabilities/attack vectors, making RMP the best fit (person-removal test leaves substantive program details); specificity reaches Firm-Specific due to the named IT Steering Committee, with supporting domain terms like 'attack vectors' and 'reported vulnerabilities'.


reasoning: This paragraph states a conclusion that no cybersecurity risks or incidents have materially affected the business, directly answering how cybersecurity affects business/financial outcomes per SI materiality rule (backward-looking negative assertion). No specific facts elevate specificity: generic negative claim about absence of material impacts is not verifiable, firm-specific, or domain-adapted.


fact: real time threat detection and mitigation

fact: Company's CCO

reasoning: Paragraph primarily describes the cybersecurity program activities (assessment/management via third-party resources, monitoring platform for threat detection/mitigation, incident notifications), with substantive program details remaining after person-removal test, making it RMP over MR. Specificity reaches Firm-Specific due to named role (CCO) and domain term (real-time threat detection/mitigation).


reasoning: Paragraph states a conclusion on no known cybersecurity risks reasonably likely to materially affect business outcomes and cross-references Item 1A, directly matching SI materiality rule for assessments of impact. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: February and April 2025

fact: Microsoft notified the Company

fact: unauthorized activity within our Azure environment

fact: suspected nation-state threat actor

fact: enhanced rotation of credentials

fact: strengthened security monitoring

reasoning: The paragraph primarily describes a specific cybersecurity incident including timing (February and April 2025 notifications), nature (unauthorized activity in Azure by nation-state actor), and response actions, directly answering 'What happened in a cybersecurity incident?' despite preceding materiality statements. Specificity reaches Quantified-Verifiable due to verifiable elements like exact months, named Microsoft and Azure.


reasoning: This paragraph states a conclusion about no material past impacts from cybersecurity on business strategy, operations, or finances, directly matching Strategy Integration per materiality rule (backward-looking negative assertion), with cross-reference not changing the primary focus. No domain terms, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph centrally describes vendor due diligence, evaluation of cybersecurity practices, and contractual requirements, directly answering how third-party cyber risks are managed (Third-Party Risk). No domain terminology passing ERM test, firm-specific details, or verifiable facts found anywhere, yielding Generic Boilerplate specificity.


reasoning: Paragraph primarily describes processes and measures for overseeing and mitigating cybersecurity risks from third-party vendors, customers, and technologies, directly answering the Third-Party Risk question as vendor assessments are central. No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


fact: ransomware

fact: confidentiality, integrity, or availability (CIA triad)

fact: threat actors... use of AI and machine-learning technologies

reasoning: Paragraph describes general reliance on IT systems and speculative cybersecurity threats without detailing governance, management, processes, incidents, or strategy integration, fitting None/Other as pure speculation per Rule 6 and Rule 5. Specificity reaches Domain-Adapted due to domain terms like ransomware and CIA triad passing ERM test, showing cybersecurity expertise, but no firm-specific or verifiable facts.


fact: Senior Director, Information Protection & Compliance

fact: CIO

fact: management committee on cybersecurity

reasoning: Paragraph describes board and committee oversight of cybersecurity via briefings from management, including frequency and specific providers, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1, board-level focus). Specificity driven by firm-specific named roles (Senior Director with security qualifier, CIO) and named management cybersecurity committee, reaching Firm-Specific (L3) with no higher verifiable facts.


reasoning: The paragraph centers on managing cybersecurity risks from third-party IT service providers via vendor management processes, reports on sensitive data handling, and issue follow-ups, directly answering the Third-Party Risk question as the central topic per Rule 3. No domain terminology passing the ERM test, firm-specific elements like named roles/committees, or verifiable facts like quantities/dates/names are present, yielding Generic Boilerplate specificity.


reasoning: This paragraph provides a generic statement on cybersecurity risks and cross-references Item 1A, qualifying as None/Other per rules on cross-references and non-substantive content. No domain terms, firm-specific facts, or verifiable claims are present anywhere in the text, confirming Generic Boilerplate specificity.


fact: Chief Information Security Officer (CISO)

fact: Chief Information Officer (CIO)

fact: Chief Legal Officer

fact: over 30 years of experience in the fields of cybersecurity and intelligence

fact: CIO Program Certificate from the College of Information and Cyberspace, National Defense University

fact: Certified Information System Security Professional (CISSP) designation

fact: Certified Information Privacy Professional (CIPP) designation

reasoning: Paragraph primarily describes management organization, leadership roles (CISO reporting to CIO and CLO), responsibilities, and CISO qualifications/career history, fitting Management Role per Rule 1 and 2 (person-specific content central, collapses without it). Specificity reaches Quantified-Verifiable due to verifiable claims like 'over 30 years of experience,' named certifications (CISSP, CIPP), and specific credential from National Defense University.


reasoning: Paragraph centers on third-party vendor risk management, including assessments, tier categorization, due diligence questionnaires, and incident response procedures imposed on vendors, directly answering 'How are third-party cyber risks managed?' → Third-Party Risk. No domain-specific cybersecurity terminology passing ERM test, no firm-specific roles/committees/teams, and no quantified or verifiable facts → Generic Boilerplate.


reasoning: Paragraph primarily describes board-level oversight structure, including delegation to the Audit Review Committee for reviewing cybersecurity risks, controls, mitigation plans, and incident response, directly answering the Board Governance question. No domain-specific cybersecurity terminology (e.g., NIST, EDR), firm-specific roles/committees beyond generic Audit Committee equivalent, or verifiable facts like numbers/dates/named certifications, resulting in Generic Boilerplate specificity.


fact: In December 2022, the Company learned of a cybersecurity threat

fact: certain data, including personal data of employees, had been extracted

fact: employing containment protocols

fact: engaging third-party information technology cyber security and forensics experts

reasoning: This paragraph details a specific past cybersecurity incident including timing, nature (data extraction), response actions, and impact assessment, directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to the verifiable specific date ('December 2022') tied to the real event, with additional domain terms like 'containment protocols' and 'forensics experts'.


fact: April 28, 2023, identified payment

fact: $54,300 payment

fact: June 29, 2023, recovered funds

fact: phishing attack

reasoning: Paragraph describes a real phishing incident with nature, timing (April 28 and June 29, 2023), scope ($54,300), investigation, and remediation, directly answering 'What happened?' for Incident Disclosure. Specificity is Quantified-Verifiable due to specific dates and dollar amount that are externally verifiable, with phishing as a domain term.


fact: over 20 years of experience managing and securing global enterprises

reasoning: Paragraph describes governance-chain oversight structure (Board → Audit Committee → CISO/CIO → program), defaulting to BG per Rule 1 despite MR elements like leadership roles/experience; integration into ERM is secondary. Specificity reaches Quantified-Verifiable due to 'over 20 years of experience' (verifiable lower bound) and named VP-level roles (CISO/CIO) elevating from firm-specific.


reasoning: The paragraph primarily describes processes for assessing and monitoring third-party providers' security and compliance, directly answering how third-party cyber risks are managed (TP). No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph is a cross-reference to Item 1A Risk Factors with generic speculation about IT dependency and cybersecurity risks, fitting None/Other as it lacks substantive cybersecurity disclosure or measures. No specific facts of any level are present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph from a SPAC with no operations states no significant cybersecurity risks or program exist, with only generic conditional board oversight; per Rule 6, this is None/Other as no substantive cybersecurity disclosure. No domain terms, firm-specific facts, or verifiable claims anywhere, so empty specific_facts and Generic Boilerplate.


reasoning: Paragraph centrally describes oversight processes for third-party service providers, including due diligence, monitoring, communication protocols, and meetings, directly answering 'How are third-party cyber risks managed?' with vendor oversight as the main topic (TP per Rule 3). No domain terms passing ERM test, firm-specific facts (e.g., no named roles/committees/providers), or verifiable claims (no numbers, dates, named firms), resulting in empty specific_facts and Generic Boilerplate specificity.


fact: CISO

fact: FedEx Executive Committee

fact: DTRC

fact: CyTOC

fact: threat intelligence briefings

reasoning: Paragraph primarily describes management organization including CISO reporting to CEO, leadership team activities, and management-level committees like Executive Committee, CyTOC, DTRC overseeing risks, with subordinate mention of board escalation; firm-specific named roles and committees drive Firm-Specific level, augmented by domain term.


fact: Cybersecurity Program Manager

reasoning: Paragraph centrally describes vendor/third-party cybersecurity risk management via monitoring, evaluation, due diligence, and policy, making Third-Party Risk the primary category over RMP as vendor oversight is the focus (Rule 3). Specificity reaches Firm-Specific due to the named cybersecurity role 'Cybersecurity Program Manager'; no domain terms pass ERM test beyond generic language, and no verifiable claims present.


fact: Fortra, LLC

fact: GoAnywhere managed file transfer as a service system (MFTaaS)

fact: fiscal 2023

fact: zero-day vulnerability

fact: protected health information, as defined by the Health Insurance Portability and Accountability Act

reasoning: Paragraph describes a real past incident including nature, scope, timing, impact, and response, directly answering 'What happened?' for Incident Disclosure. Specificity is Quantified-Verifiable due to named vendor/firm (Fortra, LLC), named system (GoAnywhere), specific timeframe (fiscal 2023), and domain terms like zero-day vulnerability.


reasoning: Paragraph centrally describes third-party risk management via due diligence and monitoring of partners' cybersecurity practices, directly answering 'How are third-party cyber risks managed?' with vendor oversight as the primary topic (TP per Rule 3). No domain terms passing ERM test, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily describes how management informs the Board on cybersecurity risks, briefing frequency, topics covered, ongoing dialogue, and Board's oversight role including annual reviews, directly answering the Board Governance question about board oversight structure and information flow. No domain-specific terminology, firm-unique facts (roles like Director of Internal Audit/IT and CFO are generic or lack security qualifiers), or verifiable claims (e.g., generic cadences like 'once per year') elevate specificity beyond Generic Boilerplate.


fact: 24x7 Security Operations Center (SOC)

fact: Security Information and Event Management (SIEM) systems

reasoning: This paragraph describes specific security operations and tools (SOC and SIEM) used for monitoring and threat response, directly answering 'What does the cybersecurity program do?' making it Risk Management Process. Specificity reaches Firm-Specific due to the 24x7 SOC as a firm-unique operational claim, with SIEM as a supporting domain term; no verifiable hard facts like quantities or named products elevate it to Level 4.


fact: external and internal penetration testing

fact: emulate the common tactics and techniques of cyber threat actors

fact: remediate identified vulnerabilities across a wide range of severities

reasoning: The paragraph primarily details policies and procedures for overseeing cybersecurity risks from third-party service providers (onboarding assessments, contractual terms, periodic assessments), making Third-Party Risk the central topic despite some RMP elements like pen testing; specificity is Domain-Adapted due to cybersecurity-specific practices like penetration testing and vulnerability remediation that pass the ERM test, with no firm-specific or verifiable facts.


reasoning: This paragraph states conclusions about no material past or reasonably likely future effects of cybersecurity on business strategy, results of operations, or financial condition, directly matching Strategy Integration's materiality assessment rule (Rule 5). No domain terms, firm-specific facts, or verifiable claims (negative assertions are not QV) anywhere in the text, yielding Generic Boilerplate specificity.


fact: CCDC

reasoning: Paragraph centers on Vendor Management Program for cybersecurity risks from vendors/suppliers, including due diligence, requirements, monitoring → Third-Party Risk (central topic is vendor oversight). Specificity at Firm-Specific due to named committee 'CCDC' (qualifies as firm-unique fact); no domain terms pass ERM test, no verifiable claims.


reasoning: Paragraph details cybersecurity program elements like incident response plans/policies and annual employee training, directly answering 'What does the cybersecurity program do?' for RMP category. Lacks domain terminology passing ERM test, firm-specific facts, or verifiable claims, yielding empty specific_facts and Generic Boilerplate specificity.


fact: SOC reports

reasoning: The paragraph primarily describes processes for overseeing third-party providers, including security assessments, ongoing monitoring, and annual SOC report reviews, making Third-Party Risk the central topic with most text dedicated to it over the brief materiality statement at the end. Specificity is Domain-Adapted due to the domain term 'SOC reports' demonstrating cybersecurity expertise, with no firm-specific roles or verifiable claims present.


fact: confidentiality, integrity, or availability (CIA triad)

reasoning: This paragraph provides a definitional statement without addressing any substantive cybersecurity oversight, roles, processes, incidents, or strategy questions, fitting None/Other. It includes the CIA triad, a domain-specific cybersecurity concept that passes the ERM test, elevating specificity to Domain-Adapted with no higher-level facts.


reasoning: This paragraph is pure speculation about general cybersecurity risks and their potential impacts, matching None/Other as it lacks any substantive disclosure on governance, processes, or incidents (per Rule 5 and 6). No specific facts of any level are present anywhere in the text, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily describes processes for overseeing third-party providers through security assessments and ongoing monitoring, directly answering the Third-Party Risk question as the central topic. No domain terminology passing the ERM test, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: on July 23, 2023, we experienced a cybersecurity incident

fact: $14.3 million of costs

fact: forensic investigation

reasoning: This paragraph primarily describes a specific past cybersecurity incident, including its date, scope (data and IT systems), costs, investigation, and impact, directly answering 'What happened in a cybersecurity incident?' per Incident Disclosure criteria. Specificity reaches Quantified-Verifiable due to the verifiable specific date (July 23, 2023) and quantified cost ($14.3 million), with forensic investigation as a supporting domain term.


reasoning: The paragraph primarily assesses that no cybersecurity incidents have materially affected business strategy, results of operations, or financial condition to date, directly matching Strategy Integration's materiality rule for negative assertions; forward-looking speculation and cross-reference are secondary. No domain terminology passing the ERM test, firm-specific details, or verifiable facts (negative assertions are not externally verifiable) found anywhere, yielding Generic Boilerplate specificity.


reasoning: This paragraph describes generic data handling without addressing any substantive cybersecurity question like oversight, processes, or incidents, fitting None/Other as non-cybersecurity content or boilerplate setup. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes the company's information security processes for identifying, assessing, and managing cybersecurity risks to systems and data, directly answering 'What does the cybersecurity program do?' (RMP); no domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes a SPAC with no operations, no cybersecurity program, minimal generic board oversight, and no incidents, fitting None/Other per Rule 6 for no substantive cybersecurity disclosures. No specific facts, domain terms, roles, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes general IT systems used and data collection in business operations without addressing cybersecurity oversight, processes, roles, or impacts, making it None/Other. No domain terms, firm-specific cybersecurity facts, or verifiable claims present, resulting in Generic Boilerplate.


fact: Chief Information Officer

reasoning: The paragraph primarily details processes for overseeing third-party service providers, including pre-engagement security assessments and ongoing monitoring by the CIO, directly answering the Third-Party Risk question as the central topic. Specificity is Firm-Specific due to the named cybersecurity leadership role (CIO), with no domain terms passing the ERM test or verifiable claims present.


reasoning: Paragraph describes third-party involvement in internal risk assessment, security controls maintenance, incident response coordination, and security enhancements, which details program activities (RMP) rather than vendor oversight (TPR per Rule 3). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily describes the Board's oversight of enterprise risk management and the Audit Committee's role in overseeing cybersecurity risks, including updates from the CFO, directly answering the Board Governance question about board oversight structure. No domain-adapted terminology, firm-specific facts (e.g., Audit Committee and CFO are generic), or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: As a SPAC with no operations, the paragraph provides no substantive cybersecurity disclosure or program details, fitting None/Other per Rule 6. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph centrally describes third-party vendor management program focused on cybersecurity risks and additional scrutiny for PII/trade secrets handlers, directly answering 'How are third-party cyber risks managed?' → Third-Party Risk. No domain terminology passing ERM test (PII/trade secrets are common in ERM/privacy contexts, not cyber-specific expertise), no firm-specific facts (e.g., named roles/committees), and no verifiable claims → Generic Boilerplate.


fact: IT Lead has 5 years of experience in roles that include oversight of cybersecurity risk management programs

reasoning: Paragraph primarily describes management roles (IT Lead) and their qualifications/experience in handling cybersecurity processes, collapsing to generic without person details (MR per person-removal test). Specificity driven by the verifiable quantified fact of '5 years of experience' (Level 4), with 'IT Lead' as potential named role but not needed for max level.


fact: Information Technology Committee

reasoning: Paragraph describes board and committee oversight of cybersecurity, including briefing frequency and approval processes, directly answering the Board Governance question; firm-specific due to the named 'Information Technology Committee' which distinguishes this company's structure.


reasoning: This paragraph is a generic introductory statement recognizing the importance of cybersecurity without describing any oversight structure, roles, processes, incidents, or impacts, fitting None/Other. No domain terms, firm-specific facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


reasoning: As a SPAC with no operations, the paragraph explains lack of internal cybersecurity personnel or processes and reliance on third parties without describing oversight, roles, program activities, or management of risks, defaulting to None/Other per Rule 6; contains no domain terms, firm-specific details, or verifiable facts, resulting in Generic Boilerplate.


reasoning: This paragraph is generic boilerplate speculation about potential cybersecurity threats and impacts without describing any governance, processes, roles, incidents, or measures, fitting None/Other per Rule 6 and Rule 5. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily answers how cybersecurity affects the business via a direct SEC Item 106 materiality assessment concluding no material past or likely future impact on business strategy, results, or finances, fitting Strategy Integration per materiality rule. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: penetration testing

fact: forensic analysis

fact: NIST framework

fact: Global Corporate Continuity Program

reasoning: Paragraph centrally describes risk-based oversight, diligence, and monitoring of cybersecurity risks from third parties (vendors, service providers), making Third-Party Risk the primary category despite some internal uses of third-party assessors. Specificity reaches Firm-Specific due to the named 'Global Corporate Continuity Program' distinguishing this company's structure, plus domain terms like penetration testing, forensic analysis, and NIST framework.


reasoning: Paragraph centrally describes a process for assessing third-party vendors' data protection practices, directly answering the Third-Party Risk question per Rule 3 (requirements imposed on vendors). No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: CTO

fact: CISO

reasoning: Paragraph focuses on qualifications, experience, and credentials of management roles (CTO, CISO, internal working group members), directly answering 'How is management organized to handle cybersecurity?' per MR definition and person-removal test. Specificity reaches Firm-Specific due to named VP-level cybersecurity roles (CTO, CISO); no domain terms pass ERM test and no verifiable claims present.


fact: insider threat controls designed to identify, assess, and address potential risks

fact: controls and tools to alert on suspicious or unusual insider activity

fact: controls ... to prevent data loss and external sharing of company information

reasoning: Paragraph details insider threat controls, alerting, and data loss prevention as part of the cybersecurity program, directly answering 'What does the cybersecurity program do?' for Risk Management Process. Domain-specific terms like insider threat controls, activity alerting, and data loss prevention pass the ERM test for Domain-Adapted specificity, with no firm-specific roles or verifiable claims.


reasoning: Paragraph states conclusions about no material impact on business strategy/results/financial condition and no material incidents to date, directly answering Strategy Integration's question per materiality rule (backward-looking negative assertions). No domain terms passing ERM test, firm-specific facts, or verifiable claims (negative assertions not verifiable), so Generic Boilerplate with empty specific_facts.


reasoning: Paragraph describes third-party cybersecurity partners and consultants providing cyber risk advisory as integral to the company's risk management strategy and infrastructure, primarily answering 'What does the cybersecurity program do?' (RMP per Rule 3, as these are hired service providers, not vendor risks managed); no domain terms passing ERM test, firm-specific facts, or verifiable claims present anywhere, resulting in Generic Boilerplate.


reasoning: This paragraph primarily describes the company's approach to identifying and overseeing cybersecurity risks from third parties (vendors, CROs, service providers), making Third-Party Risk the central topic per category rules. It contains no domain-specific cybersecurity terminology beyond generic risk management language, no firm-specific elements like named roles or committees, and no verifiable facts, warranting Generic Boilerplate specificity.


reasoning: Paragraph describes Audit Committee oversight and reporting to the Board on cybersecurity risks and annual Board reviews, directly answering 'How does the board oversee cybersecurity?' with governance-chain structure (BG per Rule 1). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


fact: Security Steering Committee

fact: CSIRT

fact: PSIRT

reasoning: Paragraph describes management roles (CISO, CTO, Security Steering Committee) and reporting lines (CISO informed by CSIRT/PSIRT) for reviewing cybersecurity policies and monitoring incidents, fitting Management Role per person-removal test where structure is primary; firm-specific named roles, committee, and teams drive Firm-Specific level with no higher verifiable facts.


reasoning: Paragraph speculates on potential cybersecurity risks and adverse effects using generic hypothetical language ('may be unable', 'could expose', 'could have a material adverse effect') without describing any oversight, processes, incidents, or measures, classifying as None/Other per rules 5 and 6. No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate.


fact: vulnerability management

reasoning: Paragraph describes CEO direction and management updates to the Audit Committee (board-level) on cybersecurity programs, risks, and activities, answering 'How does the board oversee cybersecurity?' making it Board Governance per governance-chain and Rule 1. Specificity is Domain-Adapted due to the domain term 'vulnerability management' passing the ERM test; no firm-specific roles or verifiable facts present.


fact: Form 8-K filed on February 29, 2024

fact: MOVEit Cybersecurity Incident

fact: together with PBI

fact: approximately 2.5 million to 2.7 million of our policyholders' or other customers' personal information

fact: social security numbers

reasoning: The paragraph primarily describes a specific cybersecurity incident (MOVEit), including its scope, investigation, impact, and remediation, directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure despite a concluding materiality statement. Multiple verifiable facts like the 8-K filing date, quantified records affected, named incident (MOVEit), and partner (PBI) drive Quantified-Verifiable specificity.


reasoning: Paragraph primarily describes the Board's role in addressing and planning to implement cybersecurity policies and a risk management program, fitting Board Governance as it outlines oversight structure and delegation. No domain-specific terminology, firm-unique facts (e.g., named roles or committees), or verifiable claims (e.g., dates, numbers, certifications) are present, resulting in Generic Boilerplate specificity.


reasoning: This paragraph describes the Audit Committee's oversight of cybersecurity risks through periodic discussions and annual reviews of the program, directly answering the Board Governance question about board-level oversight structure and frequency. No domain-specific terminology, firm-unique facts, or verifiable claims are present, resulting in Generic Boilerplate specificity.


fact: ransomware

fact: denial-of-service

reasoning: Paragraph discusses general cybersecurity threats and hypothetical impacts without describing any governance, management, processes, incidents, or measures, fitting None/Other per Rule 6 (pure speculation). Domain terms like 'ransomware' and 'denial-of-service' pass ERM test for cybersecurity expertise, setting specificity to Domain-Adapted with no higher-level facts.


reasoning: Paragraph describes a SPAC with no operations and no cybersecurity program, fitting Rule 6 for None/Other as there is no substantive cybersecurity disclosure despite minimal board oversight mention; no specific facts of any level found, resulting in Generic Boilerplate.


reasoning: Paragraph primarily describes the cybersecurity program's integration into ERM and its components (assessments, team responsibilities for risk processes/security controls/incident response, external providers for testing), directly answering 'What does the cybersecurity program do?' (RMP per person-removal test and Rule 3). No domain terminology passing ERM test, firm-specific elements (e.g., no named roles/teams), or verifiable facts (no numbers/dates/names), resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily describes the Board's delegation of cybersecurity oversight to the Audit Committee and the committee's evaluation role, directly answering the board governance question per Rule 1 (board-level committee). No domain terminology passing ERM test, firm-specific facts (Audit Committee is generic), or verifiable claims present, confirming Generic Boilerplate specificity.


fact: In May 2025, we detected unauthorized changes

fact: DNS

fact: data exfiltration

reasoning: This paragraph describes a specific cybersecurity incident including timing (May 2025), nature (unauthorized changes to domain/DNS/email via former employee credentials), scope (email-routing disruption, no data exfiltration), and remediation (contained same day, internal/external reviews), directly answering 'What happened in a cybersecurity incident?' → Incident Disclosure. Specificity reaches Quantified-Verifiable due to the verifiable specific date 'May 2025' tied to the event, with supporting domain terms like DNS and data exfiltration.


reasoning: Paragraph describes oversight structure and information flow from management/program to Audit Committee and Board (notifications and quarterly briefings), fitting Board Governance per governance-chain rule and Rule 1. No domain terms passing ERM test, firm-specific facts (e.g., Audit Committee is generic), or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: This paragraph primarily asserts that no cybersecurity incidents have materially affected business strategy, results of operations, or financial condition, directly answering a Strategy Integration question per Rule 5 (negative materiality assertion). It contains no domain terminology passing the ERM test, no firm-specific facts like named roles or committees, and no verifiable claims such as dates, numbers, or certifications, resulting in Generic Boilerplate specificity.


fact: email spoofing effort

reasoning: Paragraph details a specific past cybersecurity incident (email spoofing scam in May 2014, detection, and no loss), directly answering 'What happened?' for Incident Disclosure. Specificity is Quantified-Verifiable due to the verifiable specific date 'May 2014' and domain term 'email spoofing' that passes the ERM test.


fact: CFO has been responsible for oversight function as CFO for three years

fact: CFO has worked in financial services industry for more than 30 years

fact: CCO has been responsible for oversight functions for three years

fact: current CCO has been serving since April 2025

fact: CCO has worked in financial services industry for more than 35 years

reasoning: Paragraph details management roles (CFO, CCO), responsibilities, and qualifications/experience in cybersecurity risk management, directly answering 'How is management organized to handle cybersecurity?' per MR category (person-removal test confirms focus on roles over activities). Specificity reaches Quantified-Verifiable due to multiple hard, verifiable facts like specific tenures ('three years'), experience lower bounds ('more than 30/35 years'), and start date ('April 2025').


fact: system scans

fact: threat intelligence analysis

reasoning: The paragraph primarily describes components of the cybersecurity program including employee training, third-party support for system scans and threat intelligence (internal activities), and vendor contractual requirements, answering 'What does the cybersecurity program do?' (RMP per Rule 3 as third parties support internal program). Domain terms 'system scans' and 'threat intelligence analysis' pass the ERM test, setting specificity to Domain-Adapted with no firm-specific or verifiable facts.


reasoning: Paragraph describes board and management oversight through periodic meetings to assess cybersecurity status, directly answering 'How does the board oversee cybersecurity?' with a focus on governance structure and frequency. No domain terms, firm-specific details, or verifiable facts present, resulting in Generic Boilerplate specificity.


fact: stronger privileged access policies

fact: enhanced and expanded multi-factor authentication

reasoning: The paragraph primarily describes remediation measures implemented following a specific referenced incident ('the incident'), directly answering 'What happened?' via response actions, fitting Incident Disclosure over RMP (activities not central) or SI (speculative forward-looking language excluded per Rule 5). Specificity is Domain-Adapted due to cybersecurity domain terms like 'privileged access policies' and 'multi-factor authentication' passing the ERM test, with no firm-specific roles/committees or verifiable quantities/dates.


reasoning: Paragraph states a backward-looking materiality conclusion ('have not... materially affected') and negative incident assertion, directly matching SI per Rule 5; cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes management roles (CEO, MIS consultant, MIS supervisor) and their responsibilities/reporting for cybersecurity, fitting Management Role per person-focused organization and Rule 2 (roles over activities). No domain terms passing ERM test, no firm-specific roles (CEO generic, MIS titles lack security qualifier or VP+ level), no verifiable facts, so Generic Boilerplate.


reasoning: This paragraph provides generic boilerplate on business reliance on IT systems and secure data processing without addressing board oversight, management roles, risk processes, third parties, incidents, or strategy impacts, defaulting to None/Other. No domain-specific terminology passing the ERM test, firm-specific details, or verifiable facts are present anywhere in the text.


fact: 26 BTC

fact: approximately $560,000

fact: Sphere 3D Corp.

fact: Sphere 3D CFO

fact: Company's former CEO

fact: Gryphon

fact: threat actor

reasoning: This paragraph details a specific 2023 cybersecurity incident involving a business email compromise scam, including timeline, scope (26 BTC lost, ~$560k value), parties involved, and remediation efforts with law enforcement, directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Multiple quantified facts (26 BTC, $560k), specific dates (2023), and named entities (Sphere 3D, Gryphon, former CEO) drive Quantified-Verifiable specificity.


reasoning: The paragraph primarily describes management's involvement, responsibilities, and oversight in cybersecurity risk management, including coordination with external specialists and evaluation of the program, directly answering 'How is management organized to handle cybersecurity?' (MR per person-removal test showing role focus). No domain-specific terminology, firm-unique facts, or verifiable claims present; all language is generic ERM boilerplate, resulting in Generic Boilerplate specificity.


fact: Vice President of Information Technology

fact: phishing and penetration tests

fact: conducted its phishing and penetration tests in 2023

reasoning: Paragraph primarily describes the cybersecurity risk management process (centralized function aiding risk activities, third-party phishing/pen tests, remediation implementation), passing person-removal test as program substance remains (RMP per Rule 2/3). Specificity reaches Quantified-Verifiable due to 2023 test date (verifiable claim) alongside VP of IT role (firm-specific) and domain terms like phishing/penetration tests.


reasoning: Paragraph states a negative assertion about no material cybersecurity incidents in fiscal year 2025 and their lack of impact on business strategy, results of operations, etc., directly matching SI per materiality rule for backward-looking assessments. No domain terms passing ERM test, firm-specific facts, or verifiable claims (negative assertions about incidents are not externally verifiable), so specificity is Generic Boilerplate.


fact: IASME Cyber Essentials framework approved by UK government Cyber Security NCSC

fact: NIST framework

reasoning: This paragraph primarily describes the cybersecurity program's use of specific frameworks for assessments and policies, answering 'What does the cybersecurity program do?' (Risk Management Process). Specificity is Domain-Adapted due to named cybersecurity frameworks (IASME Cyber Essentials, ISO 27001, NIST) that pass the ERM test for domain expertise, with no firm-specific or verifiable facts.


fact: confidentiality, integrity, and availability (CIA triad)

reasoning: Paragraph primarily describes the overarching purpose and activities of the cybersecurity program (evaluate and improve CIA of systems/data/operations), directly answering 'What does the cybersecurity program do?' for RMP; includes the domain-specific CIA triad concept that passes the ERM test (non-security ERM pros wouldn't naturally use this terminology), setting Domain-Adapted specificity with no higher-level facts.


fact: email spoofing incident

fact: April 9, 2024, at 10:25 p.m. Hong Kong SAR time

fact: By April 11, 2024, verified wire transfer

fact: Chief Information Security Officer distributed internal incident report

fact: Actions adopted as of April 12, 2024

reasoning: Paragraph describes a real email spoofing incident with timeline, scope ($30,825 loss), investigation, and remediation actions, directly answering 'What happened in a cybersecurity incident?' for Incident Disclosure. Specificity is Quantified-Verifiable due to multiple verifiable facts like precise dates (April 9, 11, 12, March 27, 2024), exact dollar amount, and CISO role.


reasoning: This paragraph provides a materiality assessment concluding no material past or reasonably likely future impacts from cybersecurity on business strategy, results of operations, or financial condition, directly matching Strategy Integration per Rule 5. No domain terms, firm-specific facts, or verifiable claims (negative assertions about absence are not verifiable) are present anywhere, yielding Generic Boilerplate specificity.


fact: vice president of information technology services

reasoning: Paragraph primarily describes board and Audit Committee oversight of cybersecurity risks and program leadership structure, answering 'How does the board oversee cybersecurity?' (BG per governance-chain and Rule 1). Specificity driven by firm-specific VP of IT services role (L3 named_role); no domain terms or verifiable facts elevate higher.


fact: Executive Vice President of Technology

fact: reports directly to the Chief Executive Officer

fact: over 16 years of experience managing information technology and cybersecurity matters

reasoning: Paragraph primarily describes management's organizational structure for cybersecurity, focusing on the EVP of Technology's role, reporting line to CEO, experience, and responsibilities with senior leadership, fitting Management Role per Rule 2 (person-specific content central). Specificity reaches Quantified-Verifiable due to the verifiable 'over 16 years of experience' claim and firm-specific named role/title.


reasoning: Paragraph states a negative assertion of no cybersecurity incidents to date and speculates on potential business impacts, directly answering a Strategy Integration question per Rule 5 (negative assertion → SI) rather than describing processes or incidents; no domain terms passing ERM test, firm-specific facts, or verifiable claims present anywhere, yielding Generic Boilerplate specificity.


fact: ransomware attack in May 2020

fact: cybercriminal removed a copy of a subset of data from our self-hosted environment

reasoning: Paragraph primarily describes a specific past ransomware incident including timing (May 2020), nature, scope (data removal from self-hosted environment), and ongoing impacts (legal proceedings), fitting Incident Disclosure as it references a real event. Specificity reaches Quantified-Verifiable due to the specific date 'May 2020' and verifiable incident details like ransomware and self-hosted environment.


fact: Chief Information Officer (CIO)

fact: more than 20 years of experience in information and operational technology

reasoning: Paragraph primarily describes the CIO's leadership role, responsibilities, and qualifications for the cybersecurity program, fitting Management Role per person-specific focus on organization and expertise (MR via Rule 2 person-removal test leaves generic remnants). Specificity reaches Quantified-Verifiable due to the named CIO role (Firm-Specific) and 'more than 20 years of experience' (verifiable lower-bound quantity).


reasoning: Paragraph centrally describes oversight and evaluation processes for third-party vendors, including requesting SOC reports, directly answering 'How are third-party cyber risks managed?' (TP). Specificity driven by 'System and Organization Controls reports' as a domain term demonstrating cybersecurity expertise beyond generic ERM language (Level 2); no firm-specific roles or verifiable claims.


reasoning: Paragraph describes regulatory oversight by banking agencies, SEC cybersecurity disclosure rules, and cross-references another section, answering no substantive cybersecurity question and fitting None/Other. As None/Other, specificity is Generic Boilerplate with no qualifying facts listed.


fact: Chief Information Security Officer

reasoning: Paragraph describes oversight structure from cybersecurity program managed by CISO to Audit Committee oversight, fitting Board Governance per governance-chain default (Rule 1) despite touches of RMP and MR. Specificity driven by firm-specific CISO role (Level 3), no domain terms or verifiable facts elevating higher.


fact: Risk Management Committee of the Board of Directors

fact: IT Risk Assessment

fact: Cybersecurity Risk Assessment

fact: Annual IT Program Status Report

fact: Vendor Management Risk Assessment

fact: current Cyber Events briefings

reasoning: Paragraph describes board-level Risk Management Committee's oversight of cybersecurity risks, including specific reports received and decisions made, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1). Specificity reaches Firm-Specific due to named committee and firm-unique report names like 'Quarterly Internal Vulnerability Reports'; domain terms like vulnerability reports elevate but do not exceed Level 3 without verifiable claims.


reasoning: Paragraph is a cross-reference to Item 1A risk factors, providing no substantive cybersecurity disclosure on governance, processes, incidents, or strategy, per rules for N/O on cross-references. No domain terms, firm-specific facts, or verifiable cybersecurity claims present, resulting in empty specific_facts and Generic Boilerplate.


fact: penetration testing

fact: vulnerability scanning

reasoning: Paragraph describes cybersecurity program activities including employee training, penetration testing, vulnerability scanning, and remediation processes, directly answering 'What does the cybersecurity program do?' (RMP); contains domain-specific terms like penetration testing and vulnerability scanning that demonstrate cybersecurity expertise (Level 2), but no firm-specific roles/committees or verifiable quantities/names (no Level 3/4).


fact: ransomware groups that steal data, encrypt systems, and demand a payment

reasoning: Paragraph primarily states conclusions on cybersecurity's lack of material past impact on business/financials and potential future materiality, directly matching Strategy Integration per Rule 5 (backward- and forward-looking assessments). Specificity at Domain-Adapted due to domain-specific threat description (ransomware mechanics) passing ERM test; no firm-specific roles/committees or verifiable quantities/names present.


reasoning: This paragraph is pure forward-looking speculation about potential cybersecurity incidents and their hypothetical impacts, matching the 'could have a material adverse effect' pattern excluded from Strategy Integration and lacking any substantive cybersecurity disclosure per Rule 6, making it None/Other. No domain terms, firm-specific facts, or verifiable claims anywhere in the text, resulting in Generic Boilerplate specificity.


reasoning: Paragraph describes board-level oversight of cybersecurity risks via delegation to the Audit Committee and receipt of periodic reports/updates, directly answering the Board Governance question. No domain terminology, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: Paragraph provides a generic company description with a vague mention of security commitment, lacking any substantive cybersecurity disclosure on governance, processes, or incidents, thus None/Other. No domain terms, firm-specific facts, or verifiable claims found, resulting in Generic Boilerplate specificity.


fact: constant managed detection and response services

fact: intrusion prevention and detection applications

reasoning: The paragraph primarily describes vendor risk management, oversight of third-party cybersecurity providers, and assessing risks from critical third parties, making Third-Party Risk the central topic over RMP per Rule 3. Specificity is Domain-Adapted due to domain-specific terms like penetration testing, managed detection and response, and intrusion prevention/detection that demonstrate cybersecurity expertise via the ERM test, with no firm-specific or verifiable facts.


fact: Technology Committee of our Board

fact: Information Security Policy

reasoning: Paragraph describes board-level oversight of cybersecurity via responsibilities and committee approvals, directly answering 'How does the board oversee cybersecurity?' (BG per Rule 1). Named board committee and specific policy elevate to Firm-Specific (Level 3), no domain terms or verifiable facts found.


fact: we have no personnel or processes of our own for this purpose

fact: prior to filings with the SEC, our board of directors reviews our risk factors, including the descriptions of the risks we face from cybersecurity threats

reasoning: Paragraph primarily describes board oversight of risks including cybersecurity via review of risk factors before SEC filings, fitting Board Governance; firm-specific facts like having no internal personnel/processes and the SEC filing-tied review process elevate to Firm-Specific without domain terms or verifiable claims.


reasoning: Paragraph discusses cybersecurity insurance coverage and its potential limitations on financial impact, directly answering how cybersecurity affects business/finances (SI). No specific facts, domain terms, firm-unique details, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: completed our forensic investigation on December 13, 2023

fact: deployed a type of malware that is not self-propagating

fact: last confirmed date of unauthorized third-party activity in our network occurred on November 20, 2023

reasoning: Paragraph describes a real cybersecurity incident's nature (malware deployment, data exfiltration), scope (no customer impact), timing (specific dates), and investigation, directly answering 'What happened?' for Incident Disclosure. Specificity is Quantified-Verifiable due to verifiable specific dates (December 13, 2023; November 20, 2023) and domain term 'non-self-propagating malware'.


fact: cybersecurity incident in August 2021

fact: cybersecurity incident in January 2023

reasoning: Paragraph primarily describes actual past cybersecurity incidents with specific timing (August 2021, January 2023), nature (cyberattacks), and impacts (lawsuits, regulatory inquiries, costs), directly answering 'What happened in a cybersecurity incident?' making it Incident Disclosure. Specificity reaches Quantified-Verifiable due to specific dates tied to real, publicly known events that are externally verifiable.


reasoning: This paragraph describes the Board's recognition of cybersecurity risks and delegation of oversight to the Audit Committee, directly answering how the board oversees cybersecurity (BG per governance-chain rule). No domain terms pass the ERM test, no firm-specific elements like unique roles or committees (Audit Committee is generic), and no verifiable facts, resulting in Generic Boilerplate specificity.


reasoning: Paragraph primarily states conclusions on no material past cyber incidents and low likelihood of future material impact on business/financials, directly matching Strategy Integration materiality assessments (Rule 5). No domain terms, firm-specific details, or verifiable facts anywhere, yielding Generic Boilerplate.


fact: Chief Technology Officer ("CTO")

fact: Chief Information Security Officer ("CISO")

fact: vulnerability assessments

fact: third-party and independent reviews

reasoning: This paragraph primarily describes Board (via Audit Committee) oversight of cybersecurity risks, including briefing frequency, scope, and information flow from CTO/CISO, directly answering the Board Governance question per governance-chain rules. Specificity reaches Firm-Specific due to named cybersecurity leadership roles (CTO, CISO), with supporting domain terms like vulnerability assessments elevating above Generic Boilerplate.


fact: ransomware

fact: phishing attacks

reasoning: Paragraph describes general cybersecurity risks, threats, vulnerabilities, and potential impacts with a cross-reference to Risk Factors, fitting None/Other as pure speculation without substantive program details or measures (per Rule 5 and 6); domain terms like 'ransomware' and 'phishing attacks' demonstrate cybersecurity expertise, elevating specificity to Domain-Adapted.


fact: ISIRP

fact: System and Organization Control reports

reasoning: The paragraph centrally describes vendor due diligence, contractual protections, ongoing monitoring with SOC reports, annual reassessments, and escalation processes for third-party providers, directly answering how third-party cyber risks are managed (TP). Specificity reaches Firm-Specific due to the named internal program 'ISIRP' (Level 3) and domain term 'System and Organization Control reports' (Level 2).


reasoning: Paragraph centrally describes managing third-party vendor cybersecurity risks through a developing vendor risk management program, directly answering the Third-Party Risk question per Rule 3 (vendor oversight as central topic). No domain terms passing ERM test, firm-specific facts, or verifiable claims found anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph states conclusions on past and forward-looking materiality of cybersecurity risks to business strategy, results of operations, and financial condition, directly matching Strategy Integration per Rule 5. No domain terms, firm-specific facts, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: forensic investigation

fact: 24/7 SIEM/SOC monitoring

fact: identity and domain anomalies

fact: DNS

fact: automated off-boarding and access-revocation processes

reasoning: Paragraph describes remediation actions (forensic investigation, new processes, monitoring, training) and non-material impact following a specific incident, directly answering 'what happened in a cybersecurity incident' per ID definition. Specificity reaches Firm-Specific due to 24/7 SIEM/SOC monitoring as a firm-unique organizational claim, with multiple domain terms like forensic investigation and DNS elevating from boilerplate.


reasoning: Paragraph describes general business dependency on IT systems and third parties without addressing cybersecurity oversight, processes, risks management, or any substantive cyber question, fitting None/Other as pure introductory context. No domain terms, firm-specific details, or verifiable facts present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily states conclusions about no material past effects and forward-looking likelihood of material impact on business strategy, results of operations, or financial condition, directly matching Strategy Integration per materiality rule. No domain terms, firm-specific facts, or verifiable claims are present anywhere, resulting in Generic Boilerplate specificity.


reasoning: Paragraph states a negative assertion about no material cybersecurity incidents impacting operations or financials historically, directly matching SI materiality rule for backward-looking conclusions; no specific facts, domain terms, firm-specific details, or verifiable claims present, resulting in Generic Boilerplate specificity.


fact: Senior Director and Head of Information Technology

fact: management committee on cybersecurity

reasoning: Paragraph primarily describes management-level roles, responsibilities, and reporting lines for cybersecurity oversight, fitting Management Role per person-removal test and Rule 1 (management committee). Specificity reaches Firm-Specific due to named role and cybersecurity-specific management committee, with no higher verifiable facts.


fact: CISO

fact: joined Workday in 2010

fact: served as our CISO since April 2018

fact: more than 15 years of experience in cybersecurity and information technology risk management

fact: degree in information systems management

reasoning: Paragraph focuses on the CISO's leadership role, responsibilities, tenure, and qualifications, directly answering 'How is management organized to handle cybersecurity?' per Management Role (person-removal test shows role-centric content). Specificity is Quantified-Verifiable due to verifiable facts like specific join date (2010), CISO start date (April 2018), >15 years experience, and degree.


reasoning: This is a cross-reference to Item 1A Risk Factors quoting speculative risks about potential systems failures or breaches, which per rules is None/Other as it lacks substantive cybersecurity disclosure and is pure speculation without measures. No domain terms, firm-specific details, or verifiable facts present, resulting in Generic Boilerplate specificity.


fact: Head of Information Technology for Latin America, who oversees Cybersecurity

fact: 25 years of experience in strategic IT leadership and global project management

reasoning: Paragraph primarily describes a management leadership role, responsibilities, and qualifications, fitting Management Role per person-removal test (collapses without person details). Specificity reaches Quantified-Verifiable due to the hard-number '25 years of experience' (verifiable claim) and firm-specific named role.


fact: Chief Operating Officer

fact: Chief Compliance Officer

reasoning: Paragraph details management's leadership roles (COO, CCO), responsibilities in assessing/managing cyber risks, and expertise, directly answering 'How is management organized to handle cybersecurity?' per MR category and Rule 1/2; specificity reaches Firm-Specific due to named executive roles with cyber responsibilities, no higher verifiable facts.


fact: posture and intelligence reviews

reasoning: Paragraph centrally describes vendor monitoring, evaluations, and SLA assessments to embed cyber standards, directly answering third-party risk management (TP per Rule 3). Domain terms like 'open-source intelligence risk assessments' and 'posture reviews' demonstrate cybersecurity expertise (L2 via ERM test), with no firm-specific roles or verifiable claims elevating higher.


reasoning: The paragraph primarily states a conclusion about no material cybersecurity incidents occurring as of December 31, 2024, which is a negative materiality assertion fitting Strategy Integration per Rule 5. No domain terminology passing the ERM test, firm-specific facts, or externally verifiable claims are present anywhere in the text, resulting in Generic Boilerplate specificity.


reasoning: Paragraph states a backward-looking materiality conclusion about past cyber incidents having no material adverse effect, directly answering how cybersecurity affects business/financials (SI per Rule 5); cross-reference is secondary. No domain terms, firm-specific facts, or verifiable claims anywhere, resulting in Generic Boilerplate specificity.


fact: forensic investigation completed on December 13, 2023

fact: malware that is not self-propagating

fact: last confirmed date of unauthorized third-party activity on November 20, 2023

reasoning: This paragraph describes the details of a specific cybersecurity incident, including timeline, malware deployment, data exfiltration, and lack of customer impact, directly answering 'What happened in a cybersecurity incident?' for Incident Disclosure. Specificity reaches Quantified-Verifiable due to verifiable specific dates (December 13, 2023, and November 20, 2023) and domain term 'malware that is not self-propagating'.


fact: Head of Resources Management

fact: Head of Resources Management is also a member of our Board of Directors

fact: CCO

fact: more than 20 years directly assessing and managing our cyber information technology and human resources systems

fact: more than 30 years of overall experience as a CPA

fact: more than 15 years managing information technology systems and databases

fact: 15-plus years supporting our Adviser's and Administrator's resource management department

reasoning: Paragraph focuses on specific management personnel (Head of Resources Management, CCO), their qualifications, experience, and involvement in cybersecurity risk management, directly answering 'How is management organized?' for Management Role; board mentions are secondary. Specificity is Quantified-Verifiable due to multiple lower-bound experience quantifiers (e.g., 'more than 20 years') and named roles that are verifiable.


fact: Chief Information Security Officer ("CISO")

fact: Information Technology Committee

fact: penetration test results

reasoning: Paragraph describes board-level oversight of cybersecurity risks, including annual Board reviews, Information Technology Committee responsibilities for control effectiveness, and CISO reporting cadence to Committee quarterly and Board annually, fitting Board Governance as a governance-chain structure. Specificity reaches Firm-Specific due to named CISO role and Information Technology Committee, with domain term 'penetration test results' supporting but not exceeding Level 3.


fact: National Institute of Standards and Technology Cybersecurity Framework (NIST CSF)

reasoning: Paragraph describes framework adoption (NIST CSF) for designing/assessing the cybersecurity program and managing risks, directly answering 'What does the cybersecurity program do?' (RMP). NIST CSF is a domain-specific framework passing the ERM test, setting specificity to Domain-Adapted with no higher-level facts like firm-specific roles or verifiable claims.


reasoning: The paragraph primarily addresses how cybersecurity risks from third-party service providers (suppliers, manufacturers) are managed through selection, oversight, and contractual requirements, directly answering the Third-Party Risk question as the central topic. It contains no domain-specific terminology passing the ERM test, no firm-specific facts like named roles or committees, and no verifiable claims like numbers or dates, resulting in Generic Boilerplate specificity.


fact: Cyber Risk Committee comprised of the CIO and other executive officers

fact: CIO (Chief Information Officer)

fact: CIO has more than twenty years of experience

fact: CIO has been CIO since 2007

fact: periodic calls with a third-party virtual Chief Information Security Officer

reasoning: Paragraph primarily describes management organization including the Cyber Risk Committee structure, CIO role/responsibilities/qualifications, and reporting, fitting Management Role per Rule 1 (management-level committee) and Rule 2 (person-specific content central). Specificity reaches Quantified-Verifiable due to verifiable claims like '>20 years experience' and 'CIO since 2007', plus firm-specific elements like named committee and CIO role.


reasoning: Paragraph assesses materiality of past cybersecurity incidents on business/financial outcomes ('prior cybersecurity incidents have not had a material adverse effect'), directly matching SI backward-looking materiality rule; no specific facts, domain terms, firm-specific details, or verifiable claims present, resulting in Generic Boilerplate specificity.


reasoning: The paragraph primarily provides a materiality assessment stating no cybersecurity risks or incidents in 2024 have materially affected or are likely to affect business strategy, results of operations, or financial condition, fitting Strategy Integration per Rule 5; the brief third-party mention is subordinate. No domain terms, firm-specific details, or verifiable facts (e.g., '2024' on a negative assertion is not independently verifiable) elevate beyond Generic Boilerplate.


reasoning: This paragraph directly addresses the materiality of past and potential cybersecurity impacts on business strategy, operations, and finances, matching Strategy Integration per Rule 5 (backward- and forward-looking assertions). No domain terms, firm-specific facts, or verifiable claims (negative assertions are not externally verifiable) are present anywhere, yielding Generic Boilerplate specificity.


fact: Cybersecurity Committee

fact: senior IT executive

fact: ten years of cybersecurity experience

fact: thirty-five years of experience in various technology domains

reasoning: Paragraph primarily describes management roles (executives, IT management, Cybersecurity Committee, senior IT executive) and their responsibilities for assessing, managing, and overseeing cybersecurity risks and processes, fitting Management Role per Rule 1 (management-level committee) and Rule 2 (collapses without person-specific content). Specificity reaches Quantified-Verifiable due to hard numbers like 'ten years' and 'thirty-five years' of experience, verifiable against credentials, plus firm-specific elements like the named Cybersecurity Committee.


reasoning: This paragraph is a cross-reference to Item 1A risk factors, providing no substantive cybersecurity disclosure and fitting None/Other per Rule 5 and Rule 6 (no actual measures or processes described). No specific facts of any level are present anywhere in the paragraph, resulting in Generic Boilerplate specificity.