text: To continually manage and control the material risks that cybersecurity threats present to the organization, IRadimed invests significantly in the cybersecurity elements outlined above. In addition, the Company has made investments to fulfill the operational and financial regulatory requirements laid out by the Sarbanes-Oxley Act of 2002.


text: IRadimed faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected us, including our business strategy, results of operations, or financial conditions, to date, we have, from time to time, experienced threats to and breaches of our data systems, including malware, phishing and computer virus attacks.

companyName: IRADIMED CORP

ticker: IRMD

secItem: Item 1C


text: The underlying processes and controls of our cyber risk management protocol incorporate recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF").

companyName: iBio, Inc.

ticker: IBIO


text: In addition, we maintain policies over areas such as information security, access on/offboarding, and access and account management, to help govern the processes put in place by management designed to protect our IT assets, data, and services from threats and vulnerabilities. We consult with a third-party specialist with regard to our cyber risk management processes and controls.


text: Our management team is responsible for oversight and administration of our cyber risk management protocol, and for informing senior management and other relevant stakeholders regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents. iBio's management team has prior experience selecting, deploying, and overseeing cybersecurity technologies, initiatives, and processes and relies on threat intelligence as well as other information obtained from governmental, public, or private sources. Our Audit Committee also provides oversight of risks from cybersecurity threats.


text: As part of its review of the adequacy of our system of internal controls over financial reporting and disclosure controls and procedures, the Audit Committee is specifically responsible for reviewing the adequacy of our computerized information system controls and security related thereof. The cybersecurity stakeholders, including member(s) of management assigned with cybersecurity oversight responsibility and/or third-party consultants providing cyber risk services, brief the Audit Committee on cyber vulnerabilities identified through the risk management process, the effectiveness of our cyber risk management program, and the emerging threat landscape and new cyber risks on at least an annual basis. This includes updates on iBio's processes to prevent, detect, and mitigate cybersecurity incidents. In addition, cybersecurity risks are reviewed by our Board of Directors at least annually, as part of the Company's corporate risk oversight processes.


text: We face risks from cybersecurity threats that could have a material adverse effect on our business, financial condition, results of operations, cash flows or reputation. iBio acknowledges that the risk of cyber incidents is prevalent in the current threat landscape and that a future cyber incident may occur in the normal course of its business. To date, we have not had a cybersecurity incident. We proactively seek to detect and investigate unauthorized attempts and attacks against our IT assets, data, and services, and to prevent their occurrence and recurrence where practicable through changes or updates to internal processes and tools and changes or updates to service delivery; however, potential vulnerabilities to known or unknown threats will remain. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, investors, and additional stakeholders, which could subject us to additional liability and reputational harm. See Item 1A. "Risk Factors" for more information on cybersecurity risks.


text: Cybersecurity, Risk Management, Strategy and Governance There continues to be a rise in electronic fraudulent activity security breaches and cyber-attacks within the financial services industry. We are confronted with a spectrum of cyber threats, ranging from common attacks such as ransomware to sophisticated, organized assaults by nation-state actors. These risks extend to our customers, shareholders, suppliers, and partners. Maintaining resilience in our cybersecurity posture is not just a priority but a fundamental necessity to safeguard our operations, performance, and to maintain customer confidence in our financial services.

companyName: SOUTHERN MISSOURI BANCORP, INC.

ticker: SMBC


text: The Board of Directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk appetite with our strategic objectives. Our risk management program is designed to identify, measure, monitor and control all significant risks across various aspects of the Company. Cybersecurity risk management processes are integrated into this program, given the increasing reliance on technology and potential of cyber threats. Our Information Security ("IS") Officer leads our cybersecurity program, reporting directly to the Chief Risk Officer ("CRO") and provides reports and updates to the information Technology ("IT") Committee, and the Board of Directors monthly or more frequently as required.


text: Our objective for managing cybersecurity risk is to maintain appropriate layers of safeguards to protect information systems from possible threats and to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt or misuse our systems or information. Our information security program aligns with industry frameworks, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, Federal Financial Institutions Examination Council ("FFIEC") Information Technology Examination Handbooks, and the FFIEC Cybersecurity Assessment Tool, and is periodically reviewed and updated at least annually or more frequently upon significant changes to our operating environment. Our Information Security Program is led by our Information Security Officer in conjunction with our Information Technology Officer.


text: We maintain an Incident Response Plan ("IRP") that provides a documented framework for responding to actual or potential cybersecurity incidents. The Incident Response Team ('IRT") members include senior management and other relevant personnel with defined roles and responsibilities. The IRP addresses roles, responsibilities, and communication and contract strategies in the event of a compromise, including analysis of reportable events in accordance with applicable legal and compliance requirements. The IRT is notified of all incidents, and incidents are elevated to the Board of Directors when warranted.


text: We rely on a series of processes to identify threats, hazards, and other risks to our information assets. We employ a variety of preventative and detective tools designed to monitor, detect, block, and provide alerts regarding suspicious and unauthorized activity and to report on suspected advanced persistent threats. In addition to regular risk assessments, we rely on independent assessments, audits, and cybersecurity feeds from vendors, including directly into patch and vulnerability management tools. We engage cybersecurity experts and third-party specialists to perform regular assessments of our infrastructure, software systems and network architecture. We also leverage internal and external auditors and independent external partners to periodically review our processes, systems, and controls, including with respect to our information security program, to assess their design and operating effectiveness. We have regular and ongoing security education and training for employees and recovery and resilience tests. The Bank also retains third-party experts to conduct intrusion and penetration testing on an annual basis. All risk and security assessments results are shared with the IT Committee and Board of Directors.


text: Our information assets are classified and protected based on the results of our risk assessment practices, which assess a variety of critical factors, including the type of data stored, system availability needs, confidentiality requirements, recovery time objectives, transactional processing, the number of users, and the volume and magnitude of transactions. Our IS and IT teams meet to ensure that risks are timely identified, patches and vulnerability requirements are monitored, and the necessary changes are implemented.


text: Our IT governance ensures alignment between the Company's technological strategy and business goals. We strive for efficient utilization of IT resources while effectively managing IT risks within the Company's risk appetite.


text: Oversight and Identification of Risks Associated with Third Parties Third party risk management is a component of our vendor management program. New vendors are reviewed prior to onboarding to ensure proper oversight and identify potential risks. Ongoing monitoring of emerging risks related to third-party services providers is performed periodically according to the vendor's risk rating. Vendor reviews include risk reviews for financial, reputation, information security, cybersecurity and business resiliency risk. These reviews are reported to the IT Committee and Board of Directors for approval..


text: Identified Cybersecurity Risks Federal regulators have issued multiple statements and guidance regarding cybersecurity and that financial institutions need to design multiple layers of security controls to establish lines of defense and to ensure that their risk management processes also address the risk posed by compromised client credentials, including security measures to reliably authenticate clients accessing internet-based services of the financial institution. In addition, a financial institution's management is expected to maintain sufficient business continuity planning processes to ensure the timely recovery, resumption and maintenance of the institution's operations in the event of a cyber-attack. A financial institution is also expected to develop appropriate processes to enable recovery of data and business operations and address rebuilding network capabilities and restoring data if the institution or its critical service providers fall victim to a cyber-attack. If a financial institution fails to observe the regulatory guidance, they could be subject to various regulatory sanctions, including financial penalties.


text: In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations to store and transmit sensitive data. We employ a layered, defensive approach that leverages people, processes, and technology to manage and maintain cybersecurity controls. We employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity, as well as to report on any suspected advanced persistent threats. Notwithstanding the strength of our defensive measures, the threat from cyber-attacks is severe, attacks are sophisticated and increasing in volume, and attackers respond rapidly to changes in defensive measures. While to date we have not detected a significant compromise, significant data loss or any material financial losses related to cybersecurity attacks, our systems and those of our clients and third-party service providers are under constant threat and there can be no assurance that our cybersecurity risk management program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats, as well as due to the expanding use of internet banking, mobile banking and other technology-based products and services by us and our customers. See Item 1A. Risk Factors for a further discussion of risks related to cybersecurity. See "Risks Related to Cybersecurity, Third Parties and Technology" under "Item 1A. Risk Factors" in this Form 10-K for a further discussion of risks related to cybersecurity.


text: Management and Board Oversight of Cybersecurity Risks Our cybersecurity program is managed by the Information Security Officer who leads our IS team responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Information Security Officer provides periodic reports to the IT Committee and Board of Directors. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation, and remediation of cybersecurity incidents. The Chief Operations Officer, Chief Risk Officer, and board-level risk committees of the Bank provide comprehensive reports to the full Board of Directors regarding pertinent cybersecurity risk management topics.


text: Our Information Security Officer has more than 40 years' experience in financial services, substantial relevant expertise and formal training in the areas of information security, information technology, and cybersecurity risk management and is accountable for managing our enterprise information security department and developing and implementing our cybersecurity and information security programs. These qualifications, certifications, and experience include a degree from Missouri State University with focus on Business Administration Systems coursework.


text: Processes for Assessing, Identifying and Managing Risks from Cybersecurity Threats We, like any other organization operating in the biotechnology and pharmaceutical space, are subject to cybersecurity threats. In order to be prepared to respond to a potential cybersecurity threat, we have implemented an Information Technology ("IT") Security Guidelines Policy. Such policy sets forth a framework for management of all Company-managed IT systems and equipment. In connection with such policy, we have also implemented an IT Security Incident Response Plan, which sets forth processes in the event of a suspected cybersecurity incident. The processes set forth in such IT Security Incident Response Plan are part of our overall enterprise risk management system. As set forth in the IT Security Incident Response Plan, we may engage third-party consultants to assist us with the response to any suspected cybersecurity incident. We engage third parties on a periodic basis in connection with our overall enterprise risk management assessment. With respect to third-party service providers that we may engage in connection with our day-to-day operations, we attempt to assess such service provider's processes regarding potential cybersecurity threats in connection with first engaging such service provider.

companyName: PROTHENA CORP PUBLIC LTD CO

ticker: PRTA


text: Oversight of Risks Related to Cybersecurity Threats Both our Board of Directors and members of our management team are responsible for oversight of risks related to cybersecurity threats. Our Audit Committee reviews our major risk exposures, including risks related to cybersecurity threats. Our Head of IT, who reports to our Head of Human Resources, who reports to our Chief Legal Officer, is primarily responsible for assessing and managing risks related to cybersecurity threats. Our Head of IT has approximately 30 years of experience managing IT systems for organizations similarly situated to ours. As set forth in the IT Security Incident Response Plan, the Chief Legal Officer and the Head of Human Resources would be informed of any cybersecurity incident, and depending on the severity of the cybersecurity incident, many other functions of the management team would be informed as well. At the discretion of the Chief Legal Officer, the Audit Committee would be informed of a cybersecurity incident. Additionally, our Head of IT presents an annual report, which sets forth risks related to cybersecurity threats, to the Audit Committee and is available to the committee to discuss any aspect of the report.


text: As of the date of this report, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition for the years of financial statements presented in this report.


text: Notwithstanding the approach we take to cybersecurity threats, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of risks related to cybersecurity threats.


text: Oversight of Risks Related to Cybersecurity Threats Both our Board of Directors and members of our management team are responsible for oversight of risks related to cybersecurity threats. Our Audit Committee reviews our major risk exposures, including risks related to cybersecurity threats. Our Head of IT, who reports to our Chief Legal Officer, is primarily responsible for assessing and managing risks related to cybersecurity threats. Our Head of IT has approximately 30 years of experience managing IT systems for organizations similarly situated to ours. As set forth in the IT Security Incident Response Plan, the Chief Legal Officer and the Head of Human Resources would be informed of any cybersecurity incident, and depending on the severity of the cybersecurity incident, many other functions of the management team would be informed as well. At the discretion of the Chief Legal Officer, the Audit Committee would be informed of a cybersecurity incident. Additionally, our Head of IT presents an annual report, which sets forth risks related to cybersecurity threats, to the Audit Committee and is available to the committee to discuss any aspect of the report.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: TXO Partners, L.P.

ticker: TXO


text: Our cybersecurity risk management program is part of our overall enterprise risk management program, and shares common reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • a team of IT and risk management professionals principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; and • cybersecurity awareness training of all our employees.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Our business could be negatively affected by security threats, including cybersecurity threats, and other disruptions".


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program described above.


text: Our Manager of Information Technology periodically reports to the Audit Committee and leads the Company's overall cybersecurity function. The Audit Committee receives reports from our IT team on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents.


text: Our IT team, including our Manager of Information Technology, oversees efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents that impact our systems and information through various means, which include briefings from internal personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our corporate IT environment.


text: Our Manager of Information Technology is responsible for assessing and managing our material risks from cybersecurity threats, and has primary responsibility for leading our overall cybersecurity risk management program. Our Manager of Information Technology has over 20 years of experience in the cybersecurity field.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including information pertaining to Hosts, guests, employees, and other users. Our cybersecurity risk management program includes a cybersecurity incident response plan ("Incident Response Plan").

companyName: Airbnb, Inc.

ticker: ABNB


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and, while distinct in certain aspects described below, the program shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • an information security team who, in collaboration with the broader technology organization, manages and maintains our (1) cybersecurity risk assessment processes including our Incident Response Plan, (2) security controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • an Incident Response Plan that includes procedures for recognizing and responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Risk and Compliance Committee (the "Audit Committee") oversight of cybersecurity, privacy and other information technology risks. The Audit Committee has responsibility for oversight of management's implementation of our cybersecurity risk management program.


text: The Audit Committee receives regular reports and briefings from management on our cybersecurity risks and cybersecurity risk management program updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team, including our Chief Legal Officer, our Chief Security Officer and our Chief Technology Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information security team and our retained external cybersecurity consultants. Our management team has over 20 years of cybersecurity technology leadership experience.


text: Our management team supervises our information security team's efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, or external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information, including information pertaining to hosts, guests, employees, and other users. Our cybersecurity risk management program includes a cybersecurity incident response plan ("Incident Response Plan").


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and confidential information. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: EVERTEC, Inc.

ticker: EVTC


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, and digital assets; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, senior management and our Board of Directors; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, based on their critically and risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk factors - We rely on our information technology systems, employees and certain suppliers and counterparties, and certain failures or disruptions in those systems or chains could materially adversely affect our operations."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Information Technology Committee (the "IT Committee") oversight of cybersecurity and other information technology risks, which includes, among others things: • oversight of IT and cybersecurity related risks with regard to the Company's IT platforms and investments; • advising and making recommendations to the Board regarding the state of the Company's cybersecurity preparedness, including review of the threat landscape facing the Company; and • monitoring and evaluating the effectiveness of IT security and cybersecurity protocols within the Company, including disaster recover capabilities.


text: The IT Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the IT Committee, as necessary, regarding any significant cybersecurity incidents.


text: Board members receive presentations on cybersecurity topics. For example, February 2024, the full Board held a cybersecurity tabletop exercise to help prepare to respond to a cyberattack or other security incident.


text: Our management team, including our Chief Information Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Security Officer experience includes approximately 17 years in different information security roles, including recent roles as Chief Information Security Officer of Unum and Deputy Chief Information Security Officer of MasterCard.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—We rely on our information technology systems, employees and certain suppliers and counterparties, and certain failures or disruptions in those systems or chains could materially adversely affect our operations."


text: Our management team, including our Chief Information Security Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Information Security Officer experience includes approximately 18 years in different information security roles, including recent roles as Chief Information Security Officer of Unum and Deputy Chief Information Security Officer of MasterCard.


text: At Rapid7, cybersecurity risk management is integrated into our overall enterprise risk management program and is one of the pillars of our broader cybersecurity program. Our cybersecurity risk management program is designed based on prevailing security standards and controls, such as NIST-800 and ISO 27001, and to continuously evaluate cybersecurity risks in alignment with our business objectives and operational needs. Our information security team manages a framework for handling both information security risk management and operational cybersecurity threats and incidents, including those associated with the use of products and services provided by third-party service providers, suppliers, and vendors. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of such cybersecurity threat or incident (including whether such cybersecurity threat or incident is associated with a third-party service provider, supplier, or vendor), implementing cybersecurity countermeasures and mitigations and an escalation path for informing management, the audit committee of the board of directors (the "Audit Committee"), and our full board of directors (the "Board") of cybersecurity threats, incidents and risks.

companyName: Rapid7, Inc.

ticker: RPD


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, consultants, and auditors in evaluating and supporting our risk management systems. Our collaboration with these third parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Our cybersecurity program, which is managed by our information security team, includes: • efforts to comply with prevailing cybersecurity standards; • regular risk assessments and annual penetration tests designed to help identify potential cybersecurity risks to our critical systems, networks, products, services, and our broader enterprise information technology environment; • a cybersecurity incident response plan and procedures for responding to cybersecurity threats and incidents; • a security operations team responsible for detection of, and response to, cybersecurity threats and incidents; • a third-party risk management process for third-party service providers, suppliers, and vendors; and • annual cybersecurity awareness training of our employees, including senior management.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity risk management. Our Audit Committee consists of Board members with a diversity of expertise in risk management, technology, finance, and cybersecurity, including oversight of security teams. The Audit Committee is responsible for overseeing that management has processes in place designed to identify, assess and manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. The Audit Committee also reports on the cybersecurity program to our Board.


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Security Officer ("CSO"), who receives reports from our information security team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CSO and dedicated personnel are certified and experienced information systems security professionals and information security managers with decades of experience and industry certifications. Management, including the CSO and our information security team, regularly update the Audit Committee on the Company's cybersecurity program, including cybersecurity vulnerabilities, risk, threats and incidents, and developments in the cybersecurity risk landscape.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident. While we have implemented a risk management process designed to mitigate cybersecurity risks that arise from utilizing third-party service providers, suppliers, and vendors, our control over and ability to monitor the security posture of third parties with whom we do business remains limited and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the security infrastructure owned or controlled by such third parties. Additionally, any contractual protections with such third parties, including our right to indemnification, if any at all, may be limited or insufficient to prevent a negative impact on our business from such compromise or failure. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: At Rapid7, cybersecurity risk management is integrated into our overall enterprise risk management program and one pillar of our broader cybersecurity program. Our cybersecurity risk management program is designed based on prevailing security standards and controls, such as NIST-800 and ISO 27001, and to continuously evaluate cybersecurity risks in alignment with our business objectives and operational needs. Our information security team manages a framework for handling both information security risk management and operational cybersecurity threats and incidents, including those associated with the use of products and services provided by third-party service providers, suppliers, and vendors. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of such cybersecurity threat or incident (including whether such cybersecurity threat or incident is associated with a third-party service provider, supplier, or vendor), implementing cybersecurity countermeasures and mitigations and an escalation path for informing management, the audit committee of the board of directors (the "Audit Committee"), and our full board of directors (the "Board") of cybersecurity threats, incidents and risks.


text: Recognizing the complexity and evolving nature of cybersecurity threats, incidents and risks, we engage with a range of third-party experts, including cybersecurity penetration testers, consultants, and auditors in evaluating and supporting our risk management systems. Our collaboration with these third parties includes regular independent audits, threat assessments, and consultation on security enhancements.


text: Our cybersecurity program, which is managed by our information security team, includes: • efforts to comply with prevailing cybersecurity standards; • regular risk assessments, security assessments and penetration tests designed to help identify potential cybersecurity risks to our critical systems, networks, products, services, and our broader enterprise information technology environment; • a cybersecurity incident response plan and procedures for responding to cybersecurity threats and incidents; • a security operations team responsible for detection of, and response to, cybersecurity threats and incidents; • a third-party risk management process for third-party service providers, suppliers, and vendors; and • annual cybersecurity awareness training of our employees, including senior management.


text: Management is responsible for identifying, assessing and managing material cybersecurity risks on an ongoing basis, establishing processes designed to ensure that potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation and remediation measures, and maintaining cybersecurity programs. Our cybersecurity programs are under the direction of our Chief Security Officer ("CSO"), who receives reports from our information security team and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. Our CSO and dedicated personnel are certified and experienced information systems security professionals and information security managers with decades of experience and industry certifications. Management, including the CSO and our information security tea m, regularly update the Audit Committee o n the Company's cybersecurity program, including cybersecurity vulnerabilities, risk, threats and incidents, and developments in the cybersecurity risk landscape.


text: As discussed further in "Item 1. Business—Our Manager and Ellington," we are externally managed and advised by our Manager, an affiliate of Ellington. Our Manager does not have any employees and instead relies on the employees of Ellington to fulfill its obligations to us pursuant to a services agreement. We rely on Ellington's information systems in conducting our day-to-day operations. As such, we also rely on Ellington's processes for assessing, identifying, and managing material risks from cybersecurity threats.

companyName: Ellington Credit Co

ticker: EARN


text: Ellington's cybersecurity processes and practices are integrated into Ellington's risk management and oversight program. In general, Ellington seeks to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that Ellington collects and stores by identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents when they occur.


text: Ellington's Risk Management and Strategy Ellington's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board of Trustees' oversight of cybersecurity risk management is supported by the Audit Committee of our Board of Trustees (the "Audit Committee"), which regularly interacts with our management team and other professionals who are responsible for assessing and managing material risks from cybersecurity threats at Ellington. • Collaborative Approach: Ellington has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows Ellington to make timely decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Ellington deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security including identity protection, anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Ellington regularly evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Ellington has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible, such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Ellington follows a risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers and other external users of Ellington's systems, as well as the systems of third-parties that could adversely impact Ellington's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Ellington to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Ellington: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via email; (iii) delivers additional training to all users who have access to personally identifiable information on Ellington's processes for handling such information; and (iv) conducts regular, monthly phishing tests to assess user alertness, and retains a separate external cybersecurity vendor to conduct similar tests on an annual basis.


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous depreciation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: Ellington also regularly engages third parties to perform assessments of Ellington's cybersecurity posture, including penetration testing, user access control reviews and independent reviews of Ellington's information security control environment, and operating effectiveness. The results of such assessments, tests and reviews are reported to the Audit Committee and our Board of Trustees, and Ellington adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.


text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect the Company. While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.


text: Our Board of Trustees, through the Audit Committee, oversees our cybersecurity risk management process. Our Audit Committee receives regular presentations and reports on cybersecurity risks at Ellington, each of which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Ellington employs internal or external resources whose responsibilities include oversight of their respective firm's cybersecurity posture.


text: Ellington's cybersecurity team is lead by Ellington's outsourced Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO has lead large technical efforts such as the development of Ellington's proprietary whole loan management system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has lead several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.


text: As discussed further in "Item 1. Business—Our Adviser and Ellington," we are externally managed and advised by our Adviser, an affiliate of Ellington. Our Adviser does not have any employees and instead relies on the employees of Ellington to fulfill its obligations to us pursuant to a services agreement. We rely on Ellington's information systems in conducting our day-to-day operations. As such, we also rely on Ellington's processes for assessing, identifying, and managing material risks from cybersecurity threats.


text: Ellington's Risk Management and Strategy Ellington's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail below under "Governance," our Board's oversight of cybersecurity risk management is supported by the Audit Committee of our Board (the "Audit Committee"), which regularly interacts with our management team and other professionals who are responsible for assessing and managing material risks from cybersecurity threats at Ellington. • Collaborative Approach: Ellington has implemented a cross-functional approach to identifying and evaluating, preventing, mitigating and remediating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents. Such escalation allows Ellington to make timely decisions regarding its response to such incidents and whether disclosure to senior management, our Audit Committee and/or the public is appropriate. • Technical Safeguards: Ellington deploys technical safeguards that are designed to protect information systems from cybersecurity threats. These systems cover many facets of cyber security including identity protection, anti-virus and anti-malware defense, data loss prevention, endpoint protection (including managed detection and response services), patch and vulnerability management and others. Ellington regularly evaluates new technologies as the cyber security landscape evolves. • Incident Response and Recovery Planning: Ellington has established and maintains incident response and recovery plans that we believe properly address the response to a cybersecurity incident or other business disruption. To the extent feasible, such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: Ellington follows a risk-based approach to identifying and overseeing cybersecurity risks presented by third-parties, including vendors, service providers and other external users of Ellington's systems, as well as the systems of third-parties that could adversely impact Ellington's business in the event of a cybersecurity incident affecting their systems. Third-party service providers are regularly evaluated by Ellington to assess their cyber security posture and general information technology practices to determine if they are suitable partners; where applicable, relevant certifications are obtained such as SOC 2 or ISO 27001. • Education and Awareness: Ellington: (i) provides regular, mandatory cyber security training to all personnel to equip them with tools to identify and address cybersecurity threats; (ii) communicates evolving information security policies, standards, processes and practices to employees via email; (iii) delivers additional training to all users who have access to personally identifiable information on Ellington's processes for handling such information; and (iv) conducts regular, monthly phishing tests to assess user alertness, and retains a separate external cybersecurity vendor to conduct similar tests on an annual basis.


text: Ellington's technology team assesses the firm's cybersecurity and infrastructure postures regularly with two separate working groups—one group, meeting weekly, focused on IT implementation and one group, meeting bi-weekly, focused on engineering integration. Both groups include senior members of the technology team. These meetings cover a broad range of topics including implementation planning for the deployment of new hardware and software, patch and vulnerability management, considerations for disaster recovery and business continuity, user access controls, data security and more. In such continued monitoring of its cybersecurity posture, Ellington conducts continuous deprecation of obsolete or unsuitable technology, including legacy hardware and software, has a robust patch and vulnerability management process, and has personnel dedicated to the continued monitoring of new developments in threat actors' activities in order to take preventative actions.


text: Ellington also regularly engages third parties to perform assessments of Ellington's cybersecurity posture, including penetration testing, user access control reviews and independent reviews of Ellington's information security control environment, and operating effectiveness. The results of such assessments, tests and reviews are reported to the Audit Committee and our Board, and Ellington adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, tests and reviews, including the implementation of new software and technologies.


text: To date, no risks from cybersecurity threats to Ellington have materially affected or are reasonably likely to materially affect us. Cyber criminals do, however, target us, Ellington and Ellington's employees and other third parties. Ongoing or future attacks such as these could have impacts on our or Ellington's operations. For additional information on these ongoing risks, please refer to "Part 1. Item 1A. Risk Factors—We are highly dependent on Ellington's information systems and those of third-party service providers, including mortgage servicers, and system failures could significantly disrupt our business, which could materially adversely affect our business, financial condition and results of operations, and our ability to pay dividends to our shareholders." and "—Because we are highly dependent on information systems when sharing information with third party service providers, systems failures, breaches or cyber-attacks could significantly disrupt our business, which could have a material adverse effect on our results of operations and cash flows."


text: While Ellington did experience two business email compromise incidents in recent years, neither had a material impact on our business strategy, results of operations or financial condition.


text: Our Board, through the Audit Committee, oversees our cybersecurity risk management process. Our Audit Committee receives regular presentations and reports on cybersecurity risks at Ellington, each of which addresses a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. Ellington employs internal or external resources whose responsibilities include oversight of their respective firm's cybersecurity posture.


text: Ellington's cybersecurity team is led by Ellington's Chief Technology Officer (the "CTO"), who is primarily responsible for assessing and managing material risks from cybersecurity threats to Ellington. The CTO has extensive experience in application development, database architecture, systems design, and third-party software integration. During his tenure at Ellington, the CTO has led large technical efforts such as the development of Ellington's proprietary internally hosted rapid application system and the overhaul of Ellington's engineering infrastructure and development services. The CTO works closely with Ellington's head of Data Platform and Infrastructure (the "DPI Head") to manage Ellington's infrastructure and cybersecurity posture. During his tenure at Ellington, the DPI Head has led several critical efforts such as the revitalization of Ellington's hardware, networking and disaster recovery facilities, major improvements to Ellington's cybersecurity infrastructure, and the development and maintenance of Ellington's Data Engineering infrastructure. Ellington's Senior Systems Administrator (the "SSA") works closely with both the CTO and the DPI Head to implement Ellington's cybersecurity program and infrastructure. The SSA is responsible for all systems and telecommunication design and implementation, with a focus on cybersecurity. The SSA ensures that Ellington's systems are secure and resilient against cyber threats. Prior to joining Ellington in 1997, the SSA was a Senior PC Technical Support at Bear Stearns for seven years. The CTO, after consultation with others, including the DPI Head and the SSA, regularly provides an assessment of Ellington's cybersecurity posture and reviews Ellington's information technology roadmap with the Audit Committee. The CTO's reports cover a range of topics including, at various times, a discussion of the primary cybersecurity risks facing Ellington, an overview of Ellington's cybersecurity program, common attack vectors and types, the primary functions of Ellington's cybersecurity program, how Ellington's cybersecurity programs are applied to critical cybersecurity areas, any recent cybersecurity incidents, Ellington's ongoing focus areas in its cybersecurity program, Ellington's employee education program, management of patches and system vulnerabilities, various threat detection methods, malicious activity monitoring, any new cybersecurity focus areas for Ellington, a review of Ellington's key technologies, Ellington's incident response procedures and Ellington's backup systems and redundancy and disaster recovery processes.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify, and manage material risks. Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.

companyName: National Healthcare Properties, Inc.

ticker: NHPAP


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • Monitor emerging data protection laws and implement changes to our processes to comply; • Conduct periodic data handling and use requirement training for our employees; • Conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and • Conduct regular phishing email simulations for all employees Our incident response plan coordinates the activities that we and our third-party cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations.


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement, and compliance.


text: Our processes also include assessing cybersecurity threat risks associated with our use of third-party services providers in normal course of business use, including those in our supply chain or who have access to our tenant and employee data or our systems. Third-party risks are included within our cybersecurity risk management processes discussed above. In addition, we assess cybersecurity considerations in the selection and oversight of our third-party services providers, including due diligence on the third parties that have access to our systems and facilities that house systems and data.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this Annual Report on Form 10-K, we have not encountered risks from cybersecurity threats that have materially affected us, or are reasonably likely to materially affect, our business strategy, results of operations or financial position.


text: We understand the importance of preventing, assessing, identifying and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process. On a regular basis we implement into our operations these cybersecurity processes, technologies and controls to assess, identify and manage material risks. Specifically, we engage a third-party information technology and cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.


text: To manage our material risks from cybersecurity threats and to protect against, detect and prepare to respond to cybersecurity incidents, we undertake the below listed activities: • monitor emerging data protection laws and implement changes to our processes to comply; • conduct periodic data handling and use requirement training for our employees; • conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data; and • conduct regular phishing email simulations for all employees.


text: Our incident response plan coordinates the activities that we and our third-party information technology and cybersecurity providers take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain and remediate an incident, as well as to comply with potentially applicable legal obligations.


text: As part of the above processes, we engage with third party providers to review our cybersecurity program and help identify areas for continued focus, improvement and compliance.


text: Our Audit Committee of the Board is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Members of the Board regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Our management is responsible for assessing and managing our material risks from cybersecurity threats. Management has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology and cybersecurity personnel and our third-party vendors. Our management team supervises efforts to prevent, detect and mitigate cybersecurity risks and incidents through various means, which may include briefings from both internal and external information technology and cybersecurity personnel, threat intelligence and other information obtained from governmental, public or private sources as well as alerts and reports produced by security tools deployed in our information technology environment.


text: Risk Management and Strategy We utilize various processes and tools to assess, identify, and manage risks from cybersecurity threats. In the development of our products and features, our security teams work with our engineering and product teams to identify, assess, and agree upon mitigation or remediation measures with respect to product development. On an ongoing basis, we encourage an environment of openness in which our engineering and product teams, led by our security teams, proactively identify, manage and discuss actual or perceived cybersecurity risks. These teams also use automated and manual processes to identify and track risks from cybersecurity threats. The identified risks are triaged, prioritized for remediation, and reported by the security teams to various levels of our senior management, as appropriate. We also deploy technical safeguards that are designed to protect our platform and systems from cybersecurity threats, including firewalls, intrusion prevention, and detection systems. We have established an incident response plan that addresses our response to cybersecurity incidents, and we require periodic training for our employees on cybersecurity threats. In addition, we maintain cybersecurity insurance, however, the costs related to cybersecurity threats or disruptions may not be fully insured.

companyName: Datadog, Inc.

ticker: DDOG


text: In addition, we maintain third-party vendor management standards that are used to evaluate cybersecurity risks associated with our third-party service providers, and we assess information technology and software vendors to determine their security posture and maturity. All vendors that process our data or access our systems go through a security and privacy review before they are engaged that is targeted to the services to be provided and the systems and data involved. Based on the information provided by the vendor and depending on the nature of the services provided, our vendor management process may involve security questionnaires and contractual obligations such as audit rights and breach reporting.


text: We also periodically perform various types of security audits and assessments, including penetration tests, via internal and external parties. In addition, certain Datadog products are subject to specific compliance requirements and standards, including, as applicable, ISO 27001, SOC 2, PCI, and FedRAMP (Low and Moderate), and are tested and evaluated by third-party auditors against those applicable compliance requirements and standards. The identified risks from such audits and assessments are triaged, prioritized, reported by our security teams to various levels of our senior management and tracked and remediated depending on the severity.


text: Our internal audit function conducts annual interviews across business groups to identify key areas of risk, including cybersecurity risk. This enterprise risk assessment helps inform the internal audit plan, and both the assessment and progress against the internal audit plan are periodically presented to the Audit Committee. Our Chief Information Security Officer also reports separately to our Audit Committee on cyber and information security risk on a quarterly basis.


text: We have previously and may in the future become the target of cyber-attacks by third parties seeking unauthorized access to our or our customers' data or to disrupt our ability to provide our services. As a result, we have expended and plan to continue to expend significant resources in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities. Notwithstanding the measures and processes we take to manage cybersecurity risk, there is no guarantee that these measures and processes will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For a description of the risks from cybersecurity threats that may materially affect the Company and how those risks may affect the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including without limitation "Strategic and Operational Risks—If we or our third-party service providers experience, or are unable to protect against cyber-attacks, ransomware, security incidents, or security breaches, or if unauthorized parties otherwise obtain access to or otherwise compromise our customers' data, our data, or our platform and information technology systems, then our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced, and we may incur significant liabilities or additional expenses."


text: Our Board of Directors has delegated its oversight of risks associated with cybersecurity to its Audit Committee. Generally, each quarter, the Audit Committee reviews and discusses with our Chief Information Security Officer material cybersecurity risks and our processes for assessing, identifying, and managing such risks, and the Audit Committee will receive updates as necessary between each quarterly meeting. In the event of a material cybersecurity incident, the Audit Committee will be notified, and the Board of Directors will also receive updates on cybersecurity risks and incidents, as appropriate.


text: Our Chief Information Security Officer and Chief Technology Officer are the members of our executive team who are principally responsible for overseeing our cybersecurity risk management program. Our Chief Information Security Officer and Chief Technology Officer are informed about cybersecurity threats through their involvement with the processes set forth above. For example, our Chief Information Security Officer receives regular reports on identified cybersecurity risks and progress toward remediation from our security teams and both our Chief Information Security Officer and Chief Technology Officer are notified of cybersecurity incidents and the management of such incidents in accordance with the escalation procedures of our incident response plan.


text: We believe these members of our executive team have the appropriate expertise, background, and experience to manage risks arising from cybersecurity threats. Alexis L -Qu c is one of the co-founders of our company and has served as our Chief Technology Officer and a member of our board of directors since June 2010. Mr. L -Qu c has extensive knowledge and experience from building and leading the development of our technology and from his decades of experience in the technology industry. Prior to co-founding Datadog, Mr. L -Qu c worked at Wireless Generation from March 2004 to December 2010, where he most recently served as Director of Live Operations. Previously, Mr. L -Qu c held engineering positions at a number of technology and software companies, including IBM Research and France T l com S.A. Mr. L -Qu c received his M.S. in Computer Science from CentraleSup lec. Emilio Escobar has served as our Chief Information Security Officer since September 2020. With two decades of experience in information security and compliance, Mr. Escobar has worked at large enterprises, medium-sized companies, and governmental organizations. Previously, Mr. Escobar served as the Vice President of Information Security for Hulu, where he played a pivotal role in setting up key security functions. Prior to that, Mr. Escobar worked for PlayStation, where he built and ran the software security teams. Mr. Escobar holds a BS in Computer Science from the University of Puerto Rico.


text: We have previously and may in the future become the target of cyber-attacks by third parties seeking unauthorized access to our or our customers' data or to disrupt our ability to provide our services. As a result, we have expended and plan to continue to expend significant resources in an effort to protect against security incidents and to mitigate, detect, and remediate actual and potential vulnerabilities. Notwithstanding the measures and processes we take to manage cybersecurity risk, there is no guarantee that these measures and processes will be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. For a description of the risks from cybersecurity threats that may materially affect the Company and how those risks may affect the Company, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including without limitation "Strategic and Operational Risks—If we or the third parties with whom we work experience, or are unable to protect against cyber-attacks, ransomware, security incidents, or security breaches, or if unauthorized parties otherwise obtain access to or otherwise compromise our customers' data, our data, or our platform and information technology systems, then our solution may be perceived as not being secure, our reputation may be harmed, demand for our platform and products may be reduced, and we may incur significant liabilities or additional expenses."


text: We maintain a cybersecurity program that is designed to protect our information, and that of our customers, against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems. We have implemented a comprehensive risk-based approach to identifying, preventing, and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.

companyName: Tri Pointe Homes, Inc.

ticker: TPH


text: Our Risk Assessment Committee, which is comprised of individuals from our information technology, risk management, and internal audit departments, meets periodically to discuss our exposure to cyber risks as well as our efforts to mitigate the potential impact of such risks to our business or otherwise transfer such risk, including through the use of insurance products. Additionally, as part of our risk-based approach to cybersecurity: • our information technology systems and internal controls undergo annual audit; • we conduct annual penetration testing in consultation with a third-party consultant to assess any vulnerabilities in our systems and utilize the results to evaluate and remediate any identified issues; • we perform daily vulnerability scans of all computers within our system; • we use single sign-on and multi-factor authentication; • we conduct diligence on, and seek engagements of, sophisticated, cloud-based third-party service providers for critical functions; • we have implemented a zero-trust security model with group-based access to resources on our network; • we monitor applicable privacy and data protection laws and regulations and implement changes, as necessary, to remain in compliance; • we maintain cyber liability and crime insurance policies; • we maintain immutable backups of the files on our systems to aid in the recovery of our data and for operational continuity, in the event of an incident or incursion; and • our employees participate in mandatory cybersecurity training, including a recurring cyber-phishing awareness campaign designed to assess our employees' awareness of and responses to phishing requests.


text: We also maintain a written Cyber Security Policy that establishes a framework for how we respond to data breaches, cyber attacks, and other security incidents, and discusses our employees' obligations with respect thereto. We maintain additional policies, including regarding the establishment of physical and environmental security requirements for protection of our information assets and security measures taken to protect privileged accounts with access to critical resources, sensitive data, and system configurations. Further, we have adopted a Cyber Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents.


text: Due to evolving cybersecurity threats, it has been and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats, or incidents or that we will be successful in mitigating the consequences any such incidents. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this report under the heading "Risks Related to Our Business," which should be read in conjunction with the foregoing information.


text: Our Board has delegated the primary responsibility to oversee cybersecurity matters to our Audit Committee. Our Board and Audit Committee regularly review the measures implemented to identify and mitigate data protection and cybersecurity risks. As part of such reviews, our Board and Audit Committee receive reports and presentations from team members responsible for overseeing our cybersecurity risk management, including our Chief Information Officer (CIO), which address a wide range of topics, including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security considerations arising with respect to our peers and third parties. We have implemented protocols by which certain cybersecurity incidents are escalated internally and, where appropriate, reported timely to our Board and Audit Committee.


text: At the management level, our CIO, certain directors on our information technology team, and our director of risk management, in consultation with our senior management team, have broad oversight of our cyber risk management processes. Our information technology team regularly discusses the risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks.


text: Through December 31, 2023, the date on which our CIO retired, our CIO, who had extensive cybersecurity knowledge and skills gained from over 25 years of experience in the construction industry, including four years as our CIO, led the team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business and reported directly to our Chief Financial Officer. This team, during our search for a new CIO, continues to implement, monitor, and maintain our cybersecurity program and provides reports on cybersecurity threats to management on an ongoing basis. In conjunction with management, this team regularly reviews our risk management measures to identify and mitigate data protection and cybersecurity risks and also works closely with our legal team to oversee compliance with legal, regulatory, and contractual security requirements.


text: Our Risk Assessment Committee, which is comprised of individuals from our information technology, risk management, and internal audit departments, meets periodically to discuss our exposure to cyber risks as well as our efforts to mitigate the potential impact of such risks to our business or otherwise transfer such risk, including through the use of insurance products. Additionally, as part of our risk-based approach to cybersecurity: • our information technology systems and internal controls undergo annual audit; • we conduct annual penetration testing in consultation with a third-party consultant to assess any vulnerabilities in our systems and utilize the results to evaluate and remediate any identified issues; • we conduct tabletop exercises in consultation with third-party consultants to enhance our readiness and response strategies in safeguarding against potential threats to our data, information technology systems, and critical business functions; • we perform daily vulnerability scans of all computers within our system; • we use single sign-on and multi-factor authentication; • we conduct diligence on, and seek engagements of, sophisticated, cloud-based third-party service providers for critical functions; • we have implemented a zero-trust security model with group-based access to resources on our network; • we monitor applicable privacy and data protection laws and regulations and implement changes, as necessary, to remain in compliance; • we maintain cyber liability and crime insurance policies; • we maintain an alternate recovery site and immutable backups of the files on our systems to aid in the recovery of our data and for operational continuity, in the event of an incident or incursion; and • our employees participate in mandatory cybersecurity training, including a recurring cyber-phishing awareness campaign designed to assess our employees' awareness of and responses to phishing requests.


text: We also maintain a written Cyber Security Policy that establishes a framework for how we respond to data breaches, cyber attacks, and other security incidents, and discusses our employees' obligations with respect thereto. We maintain additional policies, including regarding the establishment of physical and environmental security requirements for protection of our information assets and security measures taken to protect privileged accounts with access to critical resources, sensitive data, and system configurations. Further, we have adopted a Cyber Security Incident Response Plan that applies in the event of a cybersecurity threat or incident (the "IRP") to provide a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to responding to, containing, investigating, documenting, and mitigating incidents.


text: Due to evolving cybersecurity threats, it has been and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. We also rely on information technology and third-party vendors to support our operations, including our secure processing of personal, confidential, sensitive, proprietary, and other types of information. Despite ongoing efforts to continued improvement of our and our vendors' ability to protect against cyber incidents, we may not be able to protect all information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. While we have not experienced any material cybersecurity incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats, or incidents or that we will be successful in mitigating the consequences of any such incidents. A cybersecurity incident could materially and adversely affect our business strategy, results of operations, or financial condition due to a loss, or loss of access to, our funds, reputational damage, a loss of customers and related revenues, and/or the institution of governmental enforcement actions or civil litigation against us. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this report under the heading "Risks Related to Our Business," which should be read in conjunction with the foregoing information.


text: At the management level, our CIO, certain directors on our information technology team, and our director of risk management, in consultation with our senior management team, have broad oversight of our cyber risk management processes. Our information technology team regularly discusses the risk management measures implemented by us to identify and mitigate data protection and cybersecurity risks. Our CIO joined the Company in 2024 and has extensive cybersecurity knowledge and skills gained from over three decades of experience in technology management, product management, strategic planning, and team leadership. She leads the team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across our business and reports directly to our Executive Vice President and Chief Marketing Officer. Our CIO and her team continue to implement, monitor, and maintain our cybersecurity program and provides reports on cybersecurity threats to management on an ongoing basis. In conjunction with management, this team regularly reviews our risk management measures to identify and mitigate data protection and cybersecurity risks and also works closely with our legal team to oversee compliance with legal, regulatory, and contractual security requirements.


text: Risk management and strategy We have implemented and maintain various information security processes at each of our remote and office locations designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: HA Sustainable Infrastructure Capital, Inc.

ticker: HASI


text: Our Chief Technology Officer ("CTO"), who also serves as our chief information security officer, and Deputy Chief Information Security Officer ("Deputy CISO") help identify, assess and manage our cybersecurity threats and risks. Collaborating with their team, they are responsible for steering the company-wide cybersecurity strategy, policy, standards, architecture, and processes. They also identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods.


text: The Company's information security program, led by our CTO and Deputy CISO, collaborates with various departments within the organization, such as information technology, legal, enterprise risk management, human resources, accounting, finance, and internal audit, as well as external third-party partners. This collaboration aims to identify, mitigate, and plan for potential cybersecurity threats comprehensively. Additionally, the Company consistently evaluates and enhances its processes, procedures, and management approaches in response to evolving cybersecurity landscapes.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data. These include incident management, change management, network segmentation, cyber protection and containment, detection and response, and recovery. We measure our programs against the National Institute of Standards and Technology Cyber Security Framework and regularly test our controls and incident response plans.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the information security function works with our leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our CTO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Finance & Risk Committee of our board of directors (the "Finance and Risk Committee"), which evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, as well as to perform a variety of other functions throughout our business. We have enlisted the services of a third-party managed detection and response firm to conduct continuous monitoring of our information systems, including intrusion detection and alerting. We also regularly engage with assessors, consultants, auditors, and other third parties to review our cybersecurity program to help identify areas for continued focus, improvement, and compliance.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under "Part 1. Item 1A. Risk Factors" in this Annual Report on Form 10-K, including "Cybersecurity risks and cyber incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, a misappropriation of funds, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The Finance & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO and Deputy CISO. The CTO and Deputy CISO have a combined four decades of information technology and cybersecurity leadership experience across public and private sectors.


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO and Deputy CISO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO, CFO, Chief Legal Officer and other members of our leadership team. Our leadership team works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan and vulnerability management processes include reporting to our board of directors for certain cybersecurity incidents.


text: The Finance & Risk Committee receives periodic reports from CTO concerning our significant cybersecurity threats and risk and the processes we have implemented to address them. The Finance & Risk Committee also receives various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Chief Technology Officer ("CTO"), who also serves as our chief information security officer, helps identify, assess and manage our cybersecurity threats and risks. Collaborating with their team, they are responsible for steering the company-wide cybersecurity strategy, policy, standards, architecture, and processes. They also identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods.


text: The Company's information security program, led by our CTO, collaborates with various departments within the organization, such as information technology, legal, enterprise risk management, human resources, accounting, finance, and internal audit, as well as external third-party partners. This collaboration aims to identify, mitigate, and plan for potential cybersecurity threats comprehensively. Additionally, the Company consistently evaluates and enhances its processes, procedures, and management approaches in response to evolving cybersecurity landscapes.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of our enterprise risk management program; (2) the information security function works with our leadership team to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our CTO evaluates material risks from cybersecurity threats against our overall business objectives and reports to the Finance & Risk Committee of our Board (the "Finance and Risk Committee"), which evaluates our overall enterprise risk.


text: Our Board addresses our cybersecurity risk management as part of its general oversight function. The Finance & Risk Committee is responsible for overseeing the Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our CTO. The CTO has a over two decades of information technology and cybersecurity leadership experience.


text: Our CTO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CTO is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our CEO, CFO, Chief Legal Officer and other members of our leadership team. Our leadership team works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response plan and vulnerability management processes include reporting to our Board for certain cybersecurity incidents.


text: Risk Management and Strategy The Company has a structured risk management process for identifying, reviewing, and assessing material risks from cybersecurity threats. These processes are included in the Company's overall risk management process, which is overseen by the Audit Committee of the Company's Board of Directors. As part of the cybersecurity risk management process the Company uses various methods to monitor and evaluate its threat environment and its risk profile. These methods include using manual and automated tools such as vulnerability scanning software; monitoring current and emerging cybersecurity threats; studying reports of threats and threat actors; performing scans of the threat environment; assessing our industry's risk profile; conducting internal and external audits and assessments; and carrying out threat and vulnerability assessments. To manage and mitigate material risks from cybersecurity threats to our information systems and data, the Company implements and maintains a variety of technical, physical, procedural, and organizational measures. These measures include access controls for networks, devices, and applications; firewalls and antivirus/antimalware software; management of network and user device configurations; encryption of data; monitoring of networks, devices, applications, and accounts; penetration testing; asset management procedures; risk assessments; incident detection and response plans; vulnerability management processes; business continuity and disaster recovery plans; internal IT controls; and employee cybersecurity awareness training.

companyName: Crimson Wine Group, Ltd

ticker: CWGL