content_category: Board Governance

category_confidence: high

specificity_confidence: high

reasoning: Annotators A and C applied the board-vs-management rule correctly: the paragraph’s primary subject is the board of directors overseeing cybersecurity risks, while management reporting is ancillary. Annotator B erred by making management the main focus; the text contains no IS-list facts, so specificity is Generic Boilerplate.

provider: openai


content_category: Risk Management Process

reasoning: The paragraph is primarily about the company's internal cybersecurity risk management activities: assessments, audits, risk mitigation exercises, incident response planning, third-party testing support, and training. On specificity, Annotators B and C correctly filtered out NOT-list items; Annotator A erred by treating 'Cyber Incident Response Plan' as specific, but without a unique identifier/abbreviation it is a generic program name. After filtering, no genuine IS-list facts remain, so the paragraph is Generic Boilerplate.


reasoning: The paragraph’s dominant purpose is to describe the company’s internal cybersecurity controls and mitigation processes (monitoring, detection, anti-malware, training, audits, back-up systems). The Head of IT mention is incidental and does not make this a Management Role disclosure; Annotators A and B got the category right, while C over-weighted the reporting line. After filtering out generic items like Head of IT, CEO, Audit Committee, and common security practices, no IS-list facts remain, so the specificity is Generic Boilerplate.


content_category: Management Role

reasoning: I agree with Annotator A on specificity: the paragraph contains two QV-eligible hard facts under the dispute rules—January 2022 and over 20 years of experience—so it exceeds the Firm-Specific threshold. Annotators B and C correctly identified the Management Role category, but they understated specificity by counting only the role/organizational details, which do not matter for the 2-fact QV test.


reasoning: The paragraph is about the company’s internal ERM process for identifying, evaluating, and managing cybersecurity risk, so Risk Management Process is the best category. For specificity, the text contains only generic items (ERM program, risk framework, board reporting, training) and no valid IS-list facts after filtering; Annotator B was correct, while A and C incorrectly treated boilerplate governance/process language as firm-specific.


specificity_confidence: medium

reasoning: I agree with the category label: the paragraph is centered on Garmin’s internal cybersecurity risk management program, its alignment with NIST, and how cybersecurity is managed within the company’s own processes. For specificity, I side with Annotator C over A/B because the integration with Garmin’s product development and technology management teams is a firm-specific organizational detail; NIST alone would only make it Sector-Adapted, but there is at least one IS-list fact here, so the correct level is Firm-Specific rather than Sector-Adapted.


reasoning: The paragraph is clearly about the Board’s oversight structure, so Board Governance is correct. Annotator A erred by treating the Audit and Risk Committee as a qualifying non-generic committee; the codebook excludes standard audit-style committees, and after filtering out generic board, cadence, and risk-language, no IS-list facts remain. B and C correctly identified the text as boilerplate governance disclosure.


reasoning: The paragraph is about the company’s internal incident-response workflow and escalation process, so Risk Management Process is the right category. Annotators A and B were correct to treat the named teams as specific facts; Annotator C erred by treating the paragraph as generic even though it names the Incident Response Team (CIRT) and the Cyber Security Watch Team.


reasoning: The paragraph is centered on a specific executive management role and her qualifications/responsibilities overseeing technology and security, so Management Role is the best fit. Annotators A and B were correct on specificity because the text contains two hard verifiable facts (35 years of experience and 24 years in the role); Annotator C erred by downgrading this to Firm-Specific despite the two qualifying numbers.


reasoning: Annotators A and B applied the codebook correctly: the paragraph mainly describes the company’s internal cybersecurity risk-identification, monitoring, mitigation, and program-maintenance processes, so it fits Risk Management Process. Annotator C erred by treating the generic term “Management” as a Management Role disclosure, but the role itself is not identified and the communicative purpose remains process-oriented; there are no qualifying specific facts, so the paragraph is Generic Boilerplate.


reasoning: The paragraph is chiefly about the CIO’s identity, qualifications, and reporting structure, so Management Role is the best fit. Annotator B is correct on specificity because the text contains multiple hard-number facts (four years, over 13 years, over 40 years), which exceed the QV threshold; A and C understated this by treating those quantified claims as only firm-specific.


category_confidence: medium

reasoning: I agree with Annotators A and B that this is Board Governance because the paragraph is about management reporting cybersecurity incidents to the Audit Committee, which is an oversight/briefing function. Annotator C misclassified it as Management Role: the text does not identify a cybersecurity-specific executive role, qualifications, or reporting line; it only describes generic management updates. There are no qualifying IS-list facts, since “Audit Committee,” “management,” and “executives” are generic and the rest is boilerplate.


content_category: Third-Party Risk

reasoning: Annotator C applied the specificity rules correctly: after filtering out the generic company reference and the generic program name ('Third-Party Risk Management Program'), no IS-list facts remain. Annotators A and B incorrectly treated that generic program label as firm-specific; the rest of the paragraph consists of common vendor-oversight practices like due diligence, monitoring, and recertification.


reasoning: Annotators A and B applied the codebook correctly: the paragraph is centrally about vendor qualification and due diligence, so Third-Party Risk is the right category. Annotator C overcounted generic process terms like pre-engagement, tier level, and due diligence as specificity; after filtering out NOT-list items, no IS-list facts remain, so the paragraph is Generic Boilerplate.


reasoning: I agree with Annotator C on the category: the paragraph’s dominant purpose is describing the company’s internal information security program, controls, monitoring, and exercises; the CIO/CISO mentions are incidental to that process description. For specificity, I agree with A/C that it is Firm-Specific, not Quantified-Verifiable, because only one hard QV-eligible fact appears (the CISO’s 38 years of experience); B incorrectly counted the cybersecurity roles as enough for QV.


reasoning: I agree with Annotator C on specificity and the Management Role category. The paragraph centers on the VP of IT’s cybersecurity oversight duties and experience; although it includes one hard verifiable fact ('over 20 years'), the role title and framework references do not create a second QV-eligible fact, so the right specificity level is Firm-Specific rather than Quantified-Verifiable. Annotator B incorrectly counted the role title and frameworks toward QV, and Annotator A was right to stop at Firm-Specific but incorrectly treated the frameworks as supporting that level.


reasoning: Annotators A and C were correct that this is about the company’s internal cybersecurity risk management process, not board oversight or an incident; B erred by treating 'Software Engineer' as a specific cybersecurity role, but it is not on the IS list. After filtering out generic references to the IT team, software engineer, external assessments, and employee training, no qualifying specific facts remain, so the paragraph is generic boilerplate.


reasoning: I agree with Annotator C that the paragraph is about the company’s internal risk assessment process rather than governance, incidents, or third-party oversight. A and B overcalled the specificity: MLPS is a named framework/scheme, which supports Sector-Adapted specificity, but the IT Manager, CFO, and unnamed third party are all generic and do not justify Firm-Specific.


reasoning: Annotator B best applies the codebook: the paragraph does describe internal cybersecurity activities by saying the company is developing, implementing, and maintaining cybersecurity measures. Annotators A and C overreached into None/Other or Strategy Integration, but the text does not focus on mere IT-dependence alone, nor on financial impact, insurance, budget, or materiality.


reasoning: Annotators A and C applied the codebook correctly: the grammatical subject is 'Senior management,' and the sentence describes management’s responsibility for creating and recommending cybersecurity risk appetite metrics. Annotator B erred by elevating the brief reference to the Board of Directors to Board Governance; the Board is only the approval recipient, not the subject of the paragraph. No IS-list facts remain after filtering, so the paragraph is generic boilerplate.


reasoning: The paragraph is mainly about how the company’s cybersecurity risk management is implemented through its Manager and an IT service provider, so the central topic is internal risk management rather than vendor oversight. Annotators A and C were correct on category; Annotator B misapplied Third-Party Risk because the provider is supporting the company’s process, not being governed as the main subject. For specificity, both A and C missed the firm-specific fact that the company has no employees; SOC 2 alone would only be sector-adapted, but the employee fact makes the paragraph firm-specific.


reasoning: Risk Management Process is the best fit because the paragraph primarily describes how the company assesses and mitigates cybersecurity risk—ERM integration, annual IT security review, penetration testing, and risk ranking—while board/Audit Committee references are secondary oversight context. Annotators A and C applied the board-vs-process rule correctly; B over-weighted the committee reporting language, which the codebook treats as Board Governance only when oversight is the dominant topic.


reasoning: Annotator B applied the subject-focus rule correctly: the paragraph is centered on the CEO’s role in briefing the Audit Committee, so the primary category is Management Role. Annotators A and C over-weighted the Audit Committee, but it is only the recipient of briefings, not the grammatical subject; no IS-list facts remain after filtering, so the paragraph is generic boilerplate.


reasoning: Annotator C applied the dominant-purpose rule correctly: the paragraph mostly describes the company’s internal cybersecurity controls and response processes, while the Head of IT mention is incidental. Annotators A and B over-weighted the role/reporting line; for specificity, only the Head of IT department role is a genuine firm-specific fact, while the other items are generic practices or excluded boilerplate.


reasoning: I agree with the annotators who chose Firm-Specific: the paragraph contains a named firm, Harley-Davidson, which is an IS-list fact. The annotator who marked Sector-Adapted appears to have counted only the NIST Cybersecurity Framework, but NIST alone would support Sector-Adapted only if no firm-specific facts were present; here the named Harley-Davidson agreement makes the disclosure Firm-Specific.


reasoning: The paragraph is about the company’s internal cybersecurity posture—its lack of own processes, reliance on third parties, and incident-response planning—so Risk Management Process is the best fit. Annotators A and C were correct to mark it generic; annotator B appears to have overcounted NOT-list items like 'third parties' and 'incident response plan,' leaving no valid IS-list facts.


reasoning: I agree with Annotators A and B: the paragraph is mainly about the company’s own cybersecurity risk assessment and management processes conducted through a services agreement, not vendor oversight as the central topic. Annotator C overcalled Third-Party Risk; the Liberty reference is just the service provider context for internal risk management, and there are no qualifying specific facts after filtering out generic/self-referential entities.


reasoning: I agree with Annotator C: the dominant subject is the audit committee and Board of Directors overseeing the cybersecurity program and receiving reports, which makes this Board Governance. Annotators A and B overweighted the incident escalation/reporting line; the management roles are incidental, and the paragraph contains firm-specific cybersecurity roles (ISO, CISO) but no hard verifiable dates, amounts, or named third parties/tools.


reasoning: I agree with Annotator A on category: the CEO mention is incidental and the paragraph’s main purpose is to describe the company’s incident response process and team structure. Annotators B and C both over-weighted the CEO reference; for specificity, C is correct that the cross-functional team composition is a company-specific fact, while A and B incorrectly treated it as generic.


content_category: None/Other

reasoning: Annotators A and B applied the codebook correctly: the passage is a standard risk-factor style disclaimer about IT dependence and hypothetical harms, not a substantive strategy or business-impact disclosure. Annotator C overread the generic statement that risks have not materially affected the business to date; there is no concrete incident narrative, insurance/budget discussion, or meaningful materiality analysis beyond boilerplate.


reasoning: I agree with Annotators A and B on the category because the paragraph primarily describes the company’s own cybersecurity approach, with the consultant mentioned only as one input to that process rather than as a vendor-oversight program. For specificity, Annotators A and B correctly treated the consultant’s over-30-years of experience as a qualifying specific fact; Annotator C erred by filtering out that numeric experience detail as if it were generic boilerplate.


reasoning: The paragraph is primarily about the qualifications of cybersecurity management roles, so Management Role is the best fit. For specificity, it contains multiple QV-eligible hard facts: two experience-duration numbers and a named certification; Annotator C was correct on QV, while Annotator A incorrectly downgraded it to Firm-Specific.


reasoning: I agree with Annotators A and C: the paragraph describes the company’s internal cybersecurity controls and recovery procedures, so Risk Management Process is the right category. Annotator B erred by treating generic tools and infrastructure (firewalls, antivirus, internal cloud, tape backups) as firm-specific facts; after filtering the NOT-list items, no genuine IS-list facts remain, so the specificity is Generic Boilerplate.


reasoning: Annotator A applied the codebook correctly: this is forward-looking risk-factor language about possible consequences of a cyberattack, not a substantive discussion of cyber strategy, insurance, budgeting, or a materiality assessment. Annotators B and C over-called Strategy Integration by treating generic potential impact language as substantive disclosure, but the paragraph contains no specific facts, dates, named entities, or actual incident details.


reasoning: Annotator A applied the codebook correctly: this paragraph only explains that the company handles sensitive data and depends on IT systems, but it does not describe any actual cybersecurity activities or processes. Annotators B and C սխ? mistakenly treated general risk context as Risk Management Process, but the text contains no concrete monitoring, assessment, vulnerability management, or other security action.


reasoning: The paragraph primarily describes the company’s internal cybersecurity controls and monitoring, so Risk Management Process is the right category. For specificity, the only qualifying IS-list fact is the specific cross-functional team composition; the other annotators either missed that fact or incorrectly treated generic practices like daily scans as specificity drivers.


reasoning: The paragraph is primarily about Board and Audit Committee oversight of cybersecurity risk, so Board Governance is the best fit. I agree with Annotator A that the reference to the ‘cybersecurity and data privacy leadership team’ is a qualifying team composition; Annotators B and C incorrectly treated the paragraph as entirely generic by ignoring that specific team reference and over-weighting generic cadences and standard governance language.


reasoning: Annotators A and C applied the codebook correctly: the paragraph’s main point is the company’s own cybersecurity risk management approach and integration into its broader risk management framework. Annotator B overweighted the brief board-oversight mention; under the dispute rule, that does not make this Board Governance because oversight is incidental rather than the paragraph’s primary subject.


reasoning: Annotators A and B applied the codebook correctly: the paragraph is a cross-reference/heading-style statement that does not actually disclose a cybersecurity program, incident, or materiality conclusion. Annotator C erred by treating the generic phrase about material effects on business strategy, results, or financial condition as substantive Strategy Integration, but no actual impact analysis or firm-specific facts are provided.


reasoning: Annotators A and C applied the codebook correctly: this is a generic forward-looking risk statement about possible cyber-attack impacts, not substantive disclosure about an incident, process, governance, or strategy. Annotator B erred by treating ordinary risk-factor language about potential disruption to sales and cash flows as Strategy Integration; the paragraph does not discuss cyber insurance, budget, materiality, or any other substantive business/financial strategy topic.


reasoning: I agree with Annotators A and B on the category: the paragraph is centered on Centuri’s internal cybersecurity reviews, risk assessments, risk register, and mitigation activities, so it is plainly Risk Management Process. For specificity, only the named NIST Cybersecurity Framework qualifies from the IS list; the quarterly cadence, Executive Leadership Team, Cybersecurity Risk Register, and third-party evaluations are generic or not unique enough, so Annotator C overcalled this as Firm-Specific.


reasoning: Annotator A applied the codebook correctly: the paragraph’s dominant purpose is to describe the company’s internal cybersecurity risk-identification and assessment processes, with the role mention serving mainly as attribution. Annotators B and C over-weighted the opening leadership sentence and missed that, if the role reference were removed, the paragraph would still read as a process description.


reasoning: The paragraph is squarely about the Board and Audit Committee overseeing cybersecurity risk, so Board Governance is the best fit. Annotators A and B applied the specificity rules correctly: after filtering out generic items like Board, Audit Committee, management, and the generic incident response plan, no ✓ IS-list facts remain; Annotator C erred by treating the paragraph as Firm-Specific without any qualifying specific facts.


reasoning: I agree with Annotator B on category because the paragraph is about the company’s internal ERM process and how cybersecurity fits into it; board review is secondary. For specificity, B correctly treated the enterprise risk management committee as a listed non-generic committee fact, while A and C incorrectly discounted it as boilerplate; no second hard verifiable fact appears, so it is not Quantified-Verifiable.


reasoning: The paragraph is about the company’s own cybersecurity monitoring, training, encryption, access controls, and AI-use guidelines, so Risk Management Process is the clear category. Annotator A was closer on specificity because the named Information Systems Security department is a firm-specific internal team; Annotators B and C treated the paragraph as fully generic and missed that named department.


content_category: Strategy Integration

reasoning: I agree with Annotators B and C that the dominant purpose is a standalone materiality/impact conclusion: the paragraph says no known cybersecurity threats or prior incidents have materially affected operations, strategy, results, or financial condition. Annotator A over-weighted the brief mention of the cybersecurity risk management program and processes; under the tiebreaker, that process language is incidental to the broader strategic/materiality disclosure.


reasoning: The paragraph’s main purpose is to describe the company’s cybersecurity program processes—use of technical experts, monitoring, and management reporting—with the VP role serving as an introductory attribution rather than the primary focus. Annotator C is closest to the codebook; Annotator B over-weighted the role mention, and Annotator A incorrectly upgraded specificity to Quantified-Verifiable because only one hard verifiable fact (the experience length) is present.


reasoning: Annotator C applied the vendor-oversight rule correctly: the first sentence is primarily about requiring third-party service providers to maintain security measures and report breaches, which makes Third-Party Risk the dominant topic. Annotators A and B treated the paragraph as internal risk management, but the codebook says requirements imposed on vendors are Third-Party Risk even when the company’s own board oversight is also mentioned; no IS-list facts remain after filtering, so the specificity is Generic Boilerplate.


reasoning: Annotator C applied the category rule correctly: the paragraph’s dominant purpose is to describe the company’s cybersecurity program, monitoring, and incident-response processes, while the IT Engineer/Cybersecurity Council are mainly attribution for those processes. Annotators A and B over-weighted the role references; for specificity, the only qualifying firm-specific facts are the named Cybersecurity Council and Risk Management Committee, with no QV-eligible facts present.


reasoning: I agree with Annotator B on category and specificity. The paragraph is centered on the company’s internal cybersecurity risk management processes, and the named team composition (cybersecurity professionals plus data privacy professionals) is a qualifying specific fact; Annotators A and C incorrectly treated that detail as generic boilerplate.