text: Monitor Cybersecurity Incidents The Vice President of Information Technology is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The Vice President of Information Technology implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Vice President of Information Technology is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. As part of the managed monitoring and remediation platform, the Company benefits from a $100,000 breach prevention warranty. Since its inception, the Company has not had a security breach, and has not incurred any resulting expenses, penalties or settlements.


text: Reporting to the Board of Directors The Vice President of Information Technology, in his capacity, regularly informs the Chief Executive Officer and Chief Financial Officer of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.

companyName: Community Healthcare Trust Inc

ticker: CHCT

secItem: Item 1C


text: Cybersecurity Risk Management and Strategy We employ a layered security approach leveraging people, process and technology — structuring our cybersecurity program to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We also intend that our cybersecurity program aligns with applicable laws and regulatory requirements. Our program and the related controls we employ are designed to identify and assess risk with the aim of preventing, detecting or mitigating cybersecurity risks to avoid material harm to our business, customers, associates and other stakeholders.

companyName: Cable One, Inc.

ticker: CABO


text: Our program addresses physical threats caused by infrastructure failures, logical threats caused by threat-actors and viruses, as well as other threats we identify by auditing our operations. We conduct annual assessments of our internal control over financial reporting as required for compliance with the Sarbanes-Oxley Act of 2002. Additionally, we conduct annual self-assessments and annual third-party penetration testing of our cybersecurity controls such as for compliance with Payment Card Industry ("PCI") standards, and otherwise where applicable. Our cybersecurity team also monitors supply chain and third-party cybersecurity risks to minimize the likelihood of business disruption, as well as conducts annual incident response plan rehearsals and risk assessments based on NIST standards, including the CSF.


text: We have a dedicated internal cybersecurity team that maintains our readiness and security posture by overseeing our cybersecurity program's information security policies and standards. In doing so, our cybersecurity team works with independent external cybersecurity advisors to develop appropriate standards to identify, assess, mitigate and remediate material cyber risks and issues. For example, PCI standards include quarterly external vulnerability scans that are conducted by a vendor approved by the PCI security standards council. Further, as part of our annual risk assessment controls, we obtain and review the SSAE (SOC-1 Type 2) reports of our key third-party service providers. The annual assessment includes consideration of materiality, identification and prioritization of financial reporting elements ("FREs") using quantitative and qualitative risk factors (including fraud risk), and identification of business processes and information technology systems linked to FREs. The reports are reviewed to identify and evaluate subservice providers, key reports, exceptions and complementary user entity controls and determines the appropriate response on any identified concerns.


text: We also incorporate intelligence sharing about emerging threats through collaboration with other companies in our industry, consultants and public-private partnerships with government intelligence agencies, such as the Arizona Cyber Threat Response Alliance ("ACTRA") and The Internet and Television Association ("NCTA").


text: As part of our cybersecurity program, we provide regular training on our information security policies and standards to help further prevent, detect and mitigate cybersecurity risks. We require mandatory cybersecurity, privacy and information handling training for all new associates upon onboarding and annually thereafter for all associates. We also conduct regular training throughout the year for our associates, as well as third-party contractors, on cybersecurity topics. We conduct training on phishing, social engineering and general cybersecurity awareness. To validate the effectiveness of our training, simulated phishing campaigns are conducted periodically for all associates. Additionally, third party software vendors and service providers who have access to our data or systems are obligated to adhere to our information security policies and standards as part of their service agreements.


text: Cybersecurity Governance Our Board of Directors (the "Board") employs a principles-based approach to identify and monitor the myriad of risks impacting the Company, including cybersecurity risks. The executive leadership team monitors our risk environment, including attempting to identify potential unknown risks, and regularly reports on such matters to our Board or committees thereof. We have an enterprise risk management ("ERM") program designed to identify, assess, prioritize, manage and mitigate major risk exposures that could affect our ability to execute on our corporate strategy and fulfill our business objectives. Our ERM program is administered by a risk council made up of members of senior management supported by subject matter experts within our organization. The Board fulfills certain risk oversight functions through its standing committees. Representatives of the risk council report to the Audit Committee on risk exposure, management and tolerance, and related matters. The Audit Committee oversees the risks related to the integrity of the Company's financial statements and receives an ERM report at least annually. Further, the Company's Disclosure Controls Committee reports directly to the Audit Committee on certain matters relating to our public disclosures. Our Nominating and Governance Committee has the responsibility of periodically monitoring, reviewing and discussing with management the Company's cybersecurity preparedness, vulnerabilities, defenses and planned responses, including related risk management programs and practices.


text: As discussed above, our cybersecurity team oversees information security, cyber and technology risk and IT compliance. As of December 31, 2023, our cybersecurity team consisted of 13 associates with an average of approximately 14 years of cybersecurity experience, all of whom hold college degrees, including three that hold a master's degree (two of which are in the field of information security), along with 52 professional certifications in aggregate. Our cybersecurity team is led by a Senior Director of Cybersecurity, who reports through one of our Vice Presidents to our Chief Technology and Innovation Officer, who is a member of the executive team.


text: At least quarterly, our cybersecurity team provides a report to our Nominating and Governance Committee and, at least annually, to the full Board regarding our technology and cybersecurity risk profile, programs and key initiatives, including the maturity of our cybersecurity framework and how we compare to selected industry benchmarks.


text: Our risk oversight activities, including those related to cybersecurity, are supported by internal reporting structures. These structures include protocols in the event of an incident, including the escalation by the cybersecurity team through its reporting structure to the executive team, our Disclosure Controls Committee, our risk council made up of members of our senior management supported by subject matter experts within our organization that administers our ERM program, our Nominating and Governance Committee and the Board, depending on the level of the threat or incident.


text: For additional information regarding how cybersecurity threats are reasonably likely to materially affect our business strategy, results of operations or financial condition, see "Risk Factors — Risks Relating to Our Business — We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cybersecurity incidents, as well as outages, natural disasters (including extreme weather), pandemics, terrorist attacks, accidental releases of information or similar events, may disrupt our business" and "Risk Factors — Risks Related to Our Business — Security breaches and other disruptions, including cyber-attacks, and our actual or perceived failure to adequately protect business and consumer data could give rise to liability or reputational harm."


text: Cybersecurity Risk Management and Strategy We employ a layered security approach leveraging people, process and technology — structuring our cybersecurity program to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We also intend that our cybersecurity program aligns with applicable laws and regulatory requirements. For example, CALEA requires broadband providers to affirmatively secure their networks from unlawful access to or interceptions of communications. Our program and the related controls we employ are designed to identify and assess risk with the aim of preventing, detecting or mitigating cybersecurity risks to avoid material harm to our business, customers, associates and other stakeholders.


text: We also incorporate intelligence sharing about emerging threats through collaboration with other companies in our industry, consultants and public-private partnerships with government intelligence agencies, such as the Arizona Cyber Threat Response Alliance ("ACTRA") and NCTA-The Internet and Television Association ("NCTA").


text: Cybersecurity Governance Our Board employs a principles-based approach to identify and provide oversight with respect to the myriad of risks impacting the Company, including cybersecurity risks. The executive leadership team monitors our risk environment, including attempting to identify potential unknown risks, and regularly reports on such matters to our Board or committees thereof. We have an enterprise risk management ("ERM") program designed to identify, assess, prioritize, manage and mitigate major risk exposures that could affect our ability to execute on our corporate strategy and fulfill our business objectives. Our ERM program is administered by a risk council made up of members of senior management supported by subject matter experts within our organization. The Board fulfills certain risk oversight functions through its standing committees. Representatives of the risk council report to the Audit Committee on risk exposure, management and tolerance, and related matters. The Audit Committee oversees the risks related to the integrity of the Company's financial statements and receives an ERM report at least annually. Further, the Company's Disclosure Controls Committee reports directly to the Audit Committee on certain matters relating to our public disclosures. Our Nominating and Governance Committee has the responsibility of periodically monitoring, reviewing and discussing with management the Company's cybersecurity preparedness, vulnerabilities, defenses and planned responses, including related risk management programs and practices.


text: As discussed above, our cybersecurity team oversees information security, cyber and technology risk and IT compliance. As of December 31, 2024, our cybersecurity team consisted of 14 associates with an average of over ten years of cybersecurity experience, most of whom hold advanced degrees in the fields of information security and/or cybersecurity, along with over 50 professional certifications in the aggregate. Our cybersecurity team is led by a Senior Director of Cybersecurity, who has over 30 years of global experience across various industries in the areas of information risk, privacy, security and the leadership of cybersecurity teams dedicated to the identification of risks and protection against potential threats as well as the swift detection, response and recovery from adverse incidents. Our Senior Director of Cybersecurity has earned several professional certifications including Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), Certified in Risk & Information Systems Control (CRISC) and Certified Information Security Manager (CISM) and reports through one of our Senior Vice Presidents to our Chief Operating Officer, who is a member of the executive team.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For additional information regarding cybersecurity-related risks we face, see "Risk Factors — Risks Relating to Our Business — We rely on network and information systems and other technology, and a disruption or failure of such networks, systems or technology as a result of cybersecurity incidents, as well as outages, natural disasters (including extreme weather), pandemics, terrorist attacks, accidental releases of information or similar events, may disrupt our business" and "Risk Factors — Risks Related to Our Business — Security breaches and other disruptions, including cyber-attacks, and our actual or perceived failure to adequately protect business and consumer data could give rise to liability or reputational harm."


text: Cybersecurity Risk Management and Strategy We recognize the importance of information security and we are committed to protecting and preserving the confidentiality, integrity and continued availability of the information we own or that is in our care. We have developed and implemented a cybersecurity program that strives to comply with applicable industry standards, and we assess our program against the National Institute of Standards and Technology (NIST) Cybersecurity Framework.

companyName: ENERGIZER HOLDINGS, INC.

ticker: ENR


text: Our enterprise risk management framework considers cybersecurity risk alongside other applicable risks as part of our overall risk assessment process. Within our comprehensive enterprise risk management framework, our cybersecurity program is led by the Company's Vice President and Chief Information Officer ("CIO") and is overseen by the Company's Executive Vice President and Chief Financial Officer ("CFO"). The program includes the following processes, activities and resources to identify, assess, manage, and mitigate our cybersecurity threats: • An IT security team responsible for managing our cybersecurity risk, assessment processes, security controls, and responses for security breaches and cyberattacks • A cyber incident response plan that provides controls and procedures for responding to cybersecurity incidents and for timely and accurate reporting of any material cybersecurity incident; • The use of external service providers, where appropriate, to assess, perform tabletop exercises, or otherwise assist with aspects of our security controls designed to anticipate cyberattacks and respond to breaches. Procedures include annual internal vulnerability scans and external penetration tests; • Annual cybersecurity training for all employees to provide a better understanding of the issues and risks related to cybersecurity. We realize that cybersecurity is not just the job of the IT security team; the Company and all employees play a critical role in managing the risk; • Periodic phishing testing and other exercises performed by our IT department to test our systems and reinforce the training provided to all colleagues to ensure our employees remain vigilant and compliant with expectations • Easy-to-use tools to report potential phishing emails; and • A third-party cybersecurity risk management process for service providers, suppliers, and vendors performed throughout the year.


text: We have not identified any risks from known cybersecurity threats, including any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion on the Company's cybersecurity related risks, see "Risk Factors - We rely significantly on information technology and any inadequacy, interruption, theft or loss of data, malicious attack, integration failure, failure to maintain the security, confidentiality or privacy of sensitive data residing on our systems or other security failure of that technology could harm our ability to effectively operate our business and damage the reputation of our brands" and "Risk Factors - Our business is subject to increasing government regulations in both the U.S. and abroad that could impose material costs" and other risk factors contained in Part 1, Item 1A of this Annual Report on Form 10-K. Cybersecurity Governance The Audit Committee of our Board of Directors is tasked with providing oversight of cybersecurity risk.


text: The Audit Committee receives regular briefings from the CIO regarding the Company's cybersecurity program, cyber threats, and the results of exercises and response readiness assessments performed by outside advisors that assess our cybersecurity program and internal response preparedness, and to receive periodic briefings on cyber threats and our cybersecurity program. The full Board meets with the CIO at least annually to review the Company's cybersecurity program.


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. The IT security team is led by our CIO, who has significant experience across information security, infrastructure, operations and compliance. The team has primary responsibility for our overall cybersecurity risk management program and oversees both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Members of our executive leadership team, including our CFO and General Counsel, as well as the other members as needed, supervise efforts to identify, assess, manage and mitigate cybersecurity risks and incidents through various means, including briefings from internal personnel and other information obtained from governmental, public, or private sources, including external consultants engaged by us.


text: Cybersecurity Risk Management and Strategy We recognize the importance of information security and we are committed to protecting and preserving the confidentiality, integrity and continued availability of the information we own or that is in our care. We have developed and implemented a cybersecurity program that strives to comply with applicable industry standards, and we assess our program against the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: Our information technology networks, those of our operators and managers and those of third parties on whom we rely are important enablers to our ability to perform day-to-day operations of our business. Our business operations depend on the secure collection, storage, transmission and other processing of proprietary, confidential or sensitive data.

companyName: American Healthcare REIT, Inc.

ticker: AHR


text: We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our cybersecurity program includes several safeguards such as access controls, multi-factor authentication, continuous monitoring and alerting systems for internal and external threats and external vulnerability testing. Additionally, we conduct regular evaluation of our cybersecurity program, encompassing internal reviews and third-party assessments to ensure its effectiveness and resilience.


text: Our board retains ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program. Our board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and seeking to confirm that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee reviews with the management team our cybersecurity risk exposures and the steps that management has taken to monitor and control such exposures. This review may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and third parties. The scope and focus of each review are determined based on current priorities and emerging issues in cybersecurity.


text: Management and Cybersecurity Working Group Reporting to the Chief Operating Officer, our Vice President of Information Technology, with extensive cybersecurity knowledge and skills from over 15 years of relevant work experience at our company and elsewhere, leads the team responsible for developing and implementing our information security program across our business. This team comprises individuals with relevant educational and technical experience, including a dedicated IT Systems & Security Administrator, with responsibility for various aspects of cybersecurity within our organizations. This team works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. Our Chief Operating Officer also leads our Cybersecurity Incident Management Team, which is comprised of a cross-functional team including Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and are informed about and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Chief Operating Officer is responsible for reporting on cybersecurity and information technology to the Audit Committee.


text: Information Security Program Our Vice President of Information Technology and his information security team provide regular reports to the Chief Operating Officer and other relevant teams on various cybersecurity threats, assessments and findings. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors or other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks. Our management team identifies and assesses information security risks using industry practices, including those informed by the National Institute of Standards and Technology.


text: To ensure that cybersecurity is an organization-wide effort, we provide mandatory cybersecurity training at least annually for all employees with network access, including training designed to simulate and help prevent phishing and other social engineering attacks. We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use. Additionally, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure.


text: Incident Response The Cybersecurity Incident Management Team maintains and oversees an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by the breach and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.


text: Material Cybersecurity Risks, Threats and Incidents While we employ several measures to prevent, detect and mitigate cybersecurity threats, there is no guarantee such efforts will be successful. We also rely on information technology and other third-party vendors to support our business, including securely processing personal, confidential, financial, sensitive or proprietary and other types of information. Despite our efforts to improve our ability, and the ability of relevant third parties', to protect against cyber threats, we may not be able to protect all information, systems, products and services. While we are not aware of any cybersecurity incidents that have materially affected us to date, there can be no guarantee that we will not be the subject of future attacks, threats or incidents that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A "Risk Factors" of this Annual Report on Form 10-K under the heading "A breach of information technology systems on which we rely could materially and adversely impact us," which should be read in conjunction with the foregoing information.


text: Risk Management and Strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats. Our risk management strategy begins with identifying areas of risk through risk assessment and an annual review of our practices and policies against the National Institute of Standards and Technology, or NIST, Cybersecurity Framework. This framework encompasses six major focus areas and 106 subcategories. The results of each assessment are thoroughly analyzed to strengthen our security posture and maintain a comprehensive cybersecurity program.


text: In connection with these focus areas, we have implemented a variety of technical, physical and administrative controls to proactively prevent, detect and mitigate cybersecurity threats. These measures are designed to limit the impact of potential breaches by employing advanced logging and monitoring, robust access controls, multifactor authentication, firewalls, anti-malware and antivirus solutions, endpoint detection and response systems, network inspection tools, intrusion prevention mechanisms, content filtering and comprehensive patch and vulnerability management. Endpoints are routinely reviewed and scanned, with our Information Technology team addressing any identified issues to ensure ongoing protection.


text: We also engage external vendors to conduct external vulnerability scanning and assess our policies and practices. To safeguard critical systems, we maintain encrypted, immutable backups and conduct regular testing to confirm their confidentiality, integrity and availability. These efforts are reinforced by routine disaster recovery tabletop exercises and restore testing, ensuring that our organization is prepared for any potential disruptions. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors and other third parties to provide consultation and advice to assist with assessing, identifying and managing cybersecurity risks. For instance, we engage third-party consultants to perform annual walkthroughs and design testing of information technology, or IT, general controls on behalf of our Internal Audit team, as well as to test IT control effectiveness throughout the year.


text: We have developed processes to identify and manage cybersecurity risks from our service providers. We assess our operators and managers through due diligence surveys, interviews and risk evaluations. We take cybersecurity and data privacy considerations into account when we source, select and engage with our third-party service providers. Moreover, we document our third-party vendors and suppliers in a centralized registry and review their cybersecurity practices through diligence meetings and SOC2 report evaluations for security, availability of data, processing integrity, confidentiality and privacy controls. These measures help ensure that our partners adhere to best practices and maintain safeguards for our data. We also employ systems and processes designed to oversee, identify and reduce the potential impact of a security incident at a third-party vendor, service provider or otherwise implicating the third-party technology and systems we use. Lastly, we maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our cybersecurity and information technology infrastructure.


text: As of December 31, 2024, we are not aware of any cybersecurity threats or incidents that have materially affected us; however, there can be no guarantee that we will not be the subject of future attacks, threats or incidents that may have a material impact on our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face can be found in Part I, Item 1A, Risk Factors, of this Annual Report on Form 10-K under the heading "A breach of, or failure in, information technology systems on which we rely could materially and adversely impact us," which should be read in conjunction with the foregoing information.


text: Reporting to the Chief Operating Officer, our Vice President of Information Technology, who has extensive cybersecurity knowledge and skills from over 16 years of relevant work experience at our company and elsewhere, leads our Information Technology team, which is responsible for developing and implementing our information security program across our business. The Information Technology team comprises individuals with relevant educational and technical experience, including a dedicated IT Systems & Security Administrator. It works closely with the Legal department to oversee compliance and regulatory and contractual security requirements. Our Chief Operating Officer leads the Cybersecurity Incident Management Team, a cross-functional team that comprises Internal Audit, Legal, Information Technology, Risk Management and Accounting leaders. These individuals meet regularly and receive reports of, and monitor, the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Chief Operating Officer is also responsible for reporting on cybersecurity and information technology to the Audit Committee.


text: We maintain and periodically review and update an incident response plan that applies in the event of a cybersecurity threat or incident to provide a standardized framework for responding to cybersecurity incidents. The incident response plan sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The objectives of the incident response plan are to reduce the number of systems and users affected by security incidents, reduce the time a threat actor spends within our network, reduce the damage caused by the breach and reduce the time required to restore normal operations. The incident response plan also specifies the use of third-party experts for legal advice, consulting and cyber incident response.


text: Our board has the ultimate oversight of cybersecurity risk, which it manages through our enterprise risk management program. Our board has delegated primary responsibility of overseeing cybersecurity risks to the Audit Committee. The Audit Committee's responsibilities include reviewing cybersecurity strategies with management, assessing processes and controls pertaining to the management of our information technology operations and their effectiveness and making sure that management's response to potential cybersecurity incidents is timely and effective. At least annually, the Audit Committee reviews with the management team our cybersecurity risk exposures and the steps that management has taken to monitor and control such exposures. This review may cover a variety of relevant topics, potentially including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations related to our operators, managers and other third-party partners. The scope and focus of each review are determined based on current priorities and emerging issues in cybersecurity. In addition, we engage third-party consultants to test our IT control effectiveness throughout the year, and any known exceptions and test results are communicated to management and the Audit Committee on a quarterly basis.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY Our Information Security Program is designed to support the Company in identifying, protecting, detecting, responding to, and recovering from cybersecurity threats and incidents (collectively, "cybersecurity risks") with the intention to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: PayPal Holdings, Inc.

ticker: PYPL


text: We design and regularly assess our Information Security Program guided by National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and ISO standards (including ISO 27001), proprietary controls and industry best practices.


text: Our Information Security Program is built on a three lines of defense model integrated into our overall Enterprise Risk and Compliance Management Program ("ERCM Program"). It shares common methodologies, reporting channels, and governance processes that apply across the ERCM Program to other legal, compliance, strategic, operational, and financial risk areas. The Program is governed by the Technology, Information Security, and Privacy Risk Management Committee and overseen by our Board of Directors ("Board") and its Audit, Risk and Compliance Committee ("ARC Committee").


text: The three lines of defense model is designed to provide a structure for risk accountability in the first line of defense ("FLOD"), effective challenge by the second line of defense ("SLOD"), and independent risk assurance by the third line of defense ("TLOD"). Our Office of the Chief Information Security Officer serves as FLOD and provides operational and technical controls and capabilities to protect against cybersecurity risks. The Technology and Information Security team serves as SLOD and provides independent oversight of our technology and cybersecurity risk mitigation practices and capabilities. As TLOD, Internal Audit independently assesses the effectiveness of our first and second line of defense organizations in managing cybersecurity risk and independently reports the results of audits to our ARC Committee to assist it in its oversight duties.


text: Our Information Security Program includes: • Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise Information Technology ("IT") environment; • Regular testing of our systems to identify and address potential vulnerabilities; • Integrated planning and preparedness activities supporting business continuity and operational resiliency; • Security teams principally responsible for managing (1) our annual cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; •24/7 monitoring and measurement of cybersecurity threats through our PayPal Cyber Defense Center ("CDC");


text: • The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • An information training and awareness program for our employees, contractors, incident response personnel, and senior management; and • A third-party risk management framework designed to monitor and address risks from cybersecurity incidents of service providers, suppliers, and vendors that includes due diligence over third-party's information security and technology control environment at onboarding and periodically throughout the lifecycle of the relationship. In addition, our standard contractual terms require notification and communication from third parties in the event of a cybersecurity incident. We maintain procedures to respond to, manage and mitigate third-party cybersecurity events and vulnerabilities when identified.


text: For a description of risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, see "Item 1A. Risk Factors" under the captions "Cyberattacks and security vulnerabilities could result in serious harm to our reputation, business, and financial condition" and "Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business."


text: CYBERSECURITY GOVERNANCE Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our ARC Committee oversight of cybersecurity and other information technology risks. The ARC Committee oversees PayPal's overall risk framework, including management's implementation of our cybersecurity risk management program, and reports to the full Board of Directors on a regular basis on cybersecurity and information technology risk management.


text: The ARC Committee receives periodic reports from the Chief Information Security Officer ("CISO") on our cybersecurity risks. Our CISO has numerous years of experience at PayPal and other organizations building security products, managing security infrastructure, providing a variety of security services, and overseeing incident response and management, escalation of security events, vulnerability scanning, and security defect management. Management also updates the ARC Committee, as necessary, regarding cybersecurity incidents.


text: The ARC Committee reports to the Board regarding its activities, including those related to cybersecurity risk oversight. The Board also receives briefings at least annually from management on our Information Security Program. Board members receive presentations on cybersecurity topics from our CISO and external experts from time to time as part of our continuing education to Board on topics relevant to their service as a member of our Board.


text: Our cybersecurity teams, overseen by our CISO, are responsible for assessing and managing our risks from cybersecurity threats, including defining security policy and board reporting of security risk. The CISO approves all security policies and oversees the identification, assessment, and management of cybersecurity risks, which provides a proactive and comprehensive approach to safeguarding our information assets. The teams have primary responsibility for our overall Information Security Program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity teams' experience includes cybersecurity incident response, in-depth security assessments and security emulation exercises to evaluate security profile, security research, education and outreach, and security tool development.


text: Our cybersecurity teams, in coordination with the CDC, supervise efforts to prevent, detect, mitigate, and remediate cybersecurity threats and incidents through the operation of our incident response plan and various other means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, as well as alerts and reports produced by security tools deployed in the IT environment. The CDC team oversees, identifies, and addresses security threats aimed at safeguarding PayPal employees, consumers, and merchants.


text: Our CISO organization is responsible for independently identifying, measuring, monitoring, controlling and reporting aggregate risks and for setting policies for the management and oversight of risk. The organization monitors cyber regulation requirements, reviews impacts of new products and initiatives, conduct reviews of cyber assessments and testing activities and provides effective challenge to the FLOD risk management activities.


text: The three lines of defense model is designed to provide a structure for risk management in the first line of defense ("FLOD"), monitoring and guidance by the second line of defense ("SLOD"), and independent audit by the third line of defense ("TLOD"). Our Office of the Chief Information Security Officer oversees the Company's information, cyber, and technology security. The Enterprise Risk Management Organization provides second line monitoring and guidance. The Technology and Information Security team serves as SLOD and provides independent oversight of our technology and cybersecurity risk mitigation practices and capabilities. As TLOD, Internal Audit independently assesses the effectiveness of our cybersecurity risk management and independently reports the results of audits to our ARC Committee to assist it in its oversight duties.


text: CYBERSECURITY GOVERNANCE Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to our ARC Committee oversight of cybersecurity and other information technology risks. The ARC Committee oversees PayPal's overall risk framework, including management's implementation of our cybersecurity risk management program, and reports to the full Board of Directors on a regular basis on cybersecurity and information technology risk management. The ARC Committee receives periodic reports from the Chief Information Security Officer ("CISO") on our cybersecurity risks. Management also updates the ARC Committee, as necessary, regarding cybersecurity incidents.


text: Our CISO is responsible for implementing the information security strategy, security engineering, enabling business partners, and securing customer data, digital assets, and payments. His organization also monitors cyber regulation requirements and reviews impacts of new products and initiatives. Our CISO has over two decades of experience as a cybersecurity professional, including as a CISO at PayPal and four other organizations including leading global financial services institutions and large scale U.S. government agencies (including within the Department of Defense). He has an extensive record of success shepherding digital transformation aligned with business goals, launching cybersecurity frameworks, building security engineering teams, ensuring protection of assets, data, privacy, and company reputation.


text: The ARC Committee reports to the Board regarding its activities, including those related to cybersecurity risk oversight. The Board also receives briefings at least annually from management on our Information Security Program. Board members receive presentations on cybersecurity topics from our CISO and external experts from time to time as part of our continuing education to the Board on topics relevant to their service as a member of our Board.


text: Our cybersecurity teams, overseen by our CISO, are responsible for assessing and managing our risks from cybersecurity threats, including defining security policy and board reporting of security risk. The CISO approves all security policies and oversees the identification, assessment, and management of cybersecurity risks, which provides a proactive and comprehensive approach to safeguarding our information assets. The teams have primary responsibility for our overall Information Security Program and supervise both our internal cybersecurity personnel and our external cybersecurity consultants. Our cybersecurity teams' experience includes cybersecurity incident response, in-depth security assessments, and security emulation exercises to evaluate security profile, security research, education and outreach, and security tool development.


text: Cybersecurity Risk Management and Strategic Approach The company's information security program is meticulously crafted, integrating administrative, technical, and physical safeguards. Embracing a risk-based approach, we proactively mitigate cybersecurity risks to ensure the confidentiality, integrity, and availability of our information systems and data assets. This comprehensive framework extends to overseeing service-provider relationships, aligning with the specific risks associated with each engagement.

companyName: Barnes & Noble Education, Inc.

ticker: BNED


text: Deploying a multi-tiered defense strategy, we fortify our defenses with layers of controls designed to identify, protect against, detect, respond to, and recover from cybersecurity incidents. Central to this effort is our Cyber Security Team, entrusted with the critical task of swiftly detecting, mitigating, and remediating cybersecurity threats. Guided by our documented incident response plans, we orchestrate a swift and decisive response, engaging functional areas, internal escalations, and stakeholders as dictated by the nature and severity of the incident.


text: Key to our cybersecurity resilience, we strategically leverage third-party expertise and tools to augment our defenses, ensuring a proactive stance against evolving threats. Rigorous assessments by third-party auditors validate the alignment of specific components of our technology environment with industry standards such as the Payment Card Industry Data Security Standards, ensuring robust compliance and resilience.


text: Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform our program and are the basis our compliance commitment. Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.


text: Although cybersecurity threats are an inherent part of the digital landscape, we stand resilient. While past incidents have been swiftly addressed without material impact on our operations or financial standing, we remain vigilant. Our Enterprise Risk Management program recognizes the ongoing nature of cybersecurity risks and our commitment to mitigating potential impacts on our operations, business strategy, and financial health.


text: Cybersecurity Governance Our Board of Directors, Audit Committee and Legal team oversee the cybersecurity processes of identifying and mitigating cybersecurity risks. Reporting directly to our Chief Information Officer, our Chief Information Security Officer ("CISO") leads the charge, ensuring that our cybersecurity posture remains robust and adaptive. Through quarterly updates to the Audit Committee and periodic briefings to the Board of Directors, senior management keeps governance structures informed and aligned with our evolving cybersecurity landscape.


text: With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience. The last two decades have focused on IT security and innovative ways to manage and lead a security team. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc. The CISO is experienced in deploying a Zero Trust framework, Identity and Access Management programs, Email and Web Gateways, managing IT compliance for SOX, PCI, and ADA and has developed and introduced new information security and computer risk management programs based on National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.


text: Supported by a dynamic leadership team comprised of seasoned professionals, our cybersecurity initiatives are not just policies; they're a testament to our commitment to securing customer information and upholding our privacy promises. Embedded in our Code of Conduct & Ethics and reinforced through our security awareness training program, cybersecurity awareness is not just a task; it's a shared responsibility, woven into the fabric of our corporate culture.


text: Industry standards such as the National Institute of Standards and Technology's Framework for Improving Critical Infrastructure Cybersecurity inform our program and are the basis of our compliance commitment. Regular maturity assessments, conducted by external experts, ensure that our cybersecurity program remains at the forefront of industry best practices, tailored to our unique operational landscape.


text: With over a decade of dedicated service to BNED, our current CISO brings a wealth of experience and expertise to the organization, including over three decades of Information Technology ("IT") experience. The last two decades have focused on IT security and innovative ways to manage and lead a security team. Previously, the CISO was the Director of IT Security and Infrastructure at The Children's Place Inc. The CISO is experienced in deploying a Zero Trust framework, Identity and Access Management programs, Email and Web Gateways, managing IT compliance for SOX, PCI, and ADA, and has developed and introduced new information security and computer risk management programs based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework across numerous platforms for multiple retail chains.


text: Supported by a dynamic leadership team comprised of seasoned professionals, our cybersecurity initiatives are not just policies; they are a testament to our commitment to securing customer information and upholding our privacy promises. Embedded in our Code of Conduct & Ethics and reinforced through our security awareness training program, cybersecurity awareness is not just a task; it is a shared responsibility, woven into the fabric of our corporate culture.


text: As a company that provides managed support services and security solutions for client applications, databases and technology infrastructure, we are committed to protecting the confidentiality, integrity and availability of our and our clients' information assets. We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws. As described further below, we maintain a formal and comprehensive information security management framework based on the ISO 27001:2013 Information Security Management System standard and have implemented policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats. Our Board, including the Audit Committee of our Board, and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component.

companyName: Rimini Street, Inc.

ticker: RMNI


text: Risk Management and Strategy Identifying and assessing cybersecurity risk is integrated into our overall risk management systems and processes. Cybersecurity risks related to our business, technical operations, privacy and compliance obligations are identified and addressed through a multi-faceted approach, which involves independent third-party assessments and testing, internal audit, IT security, governance, risk and compliance reviews.


text: To defend, detect and respond to cybersecurity incidents, we, among other things, invest in and deploy industry leading cybersecurity tools and platforms; conduct proactive cybersecurity and privacy reviews of software, systems, applications and third party vendors; develop applicable policies and processes; perform independent penetration testing to evaluate and test security controls; conduct employee training and testing; monitor emerging laws and regulations related to data protection and information security though a dedicated team of in-house attorneys with experience in privacy and security matters; and monitor and respond to emerging threats, implementing appropriate mitigating controls as necessary.


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with roles and responsibilities assigned to members of our Incident Response Team ("IRT"), to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our IRT is led by our Vice President, Global Security, with representatives from our IT, Security, Corporate Legal, Communications and Public Relations, Human Resources, Ethics & Compliance and Finance departments/functions.


text: We conduct post-incident reviews of our response to cybersecurity threats and incidents, in addition to evaluating the effectiveness of supporting recovery protocols. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through external and internal reporting channels.


text: Internally, we have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply and formally attest to these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees annually, and it is supplemented by testing initiatives, including periodic phishing tests.


text: Regarding data privacy, in 2023, our Ethics & Compliance Department implemented an annual privacy awareness initiative known as "Data Privacy Week," celebrating an event known as International Data Privacy Day, which is acknowledged in over 50 countries as promoting data privacy best practices and raising awareness about the importance of data protection. Data Privacy Week messaging includes highlighting the various departments and employees who support our data privacy and security compliance efforts, as well as trivia challenges designed to engage employees on this topic. Finally, our compliance program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: As noted above, we have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of onboarding, contract renewal, and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties. In addition, we require our providers to meet appropriate security requirements, controls and responsibilities and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Also as noted above, to ensure the confidentiality and integrity of data and to protect against security threats or data breaches, we regularly engage external auditors and consultants to assess our internal cybersecurity programs and compliance with applicable practices and maintain and certify to a formal and comprehensive security management standard: ISO 27001:2013 Information Security Management System.


text: Cyberattacks continue to increase in frequency and magnitude generally, and cyber criminals are becoming more sophisticated. Although we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and client expectations and will continue to make significant investments to maintain the security of our and our client's data and our cybersecurity infrastructure, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective against new and/or emerging threats, vulnerabilities and techniques designed to circumvent such measures. To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, please refer to "Risk Factors" (Part I, Item 1A of this Report).


text: Cybersecurity Governance The Audit Committee of our Board includes members with significant experience and/or expertise in technology or cybersecurity, as well as a member with cybersecurity training certifications, and is responsible for the primary oversight of enterprise risk assessment and management pertaining to the financial, accounting, liquidity, market, tax, cybersecurity and other information technology risks facing our company. At its regular meetings, the Audit Committee, which meets no less than four times per year, receives regular reports from our GVP & Chief Counsel, Chief Ethics and Compliance Officer on matters relating to data privacy and compliance, as well as from our Vice President of Risk Management on enterprise risk management, including the activities of our internal audit department surrounding audits and risk assessments of our information security management system, coverage by our insurance carriers for cybersecurity incidents, and our ISO 9001 and 27001 certifications (described above under the heading "Compliance and Certifications" in Part I, Item 1 ("Business") of this Report.


text: Beginning in the first quarter of 2024, the full Board, at least annually, and the Audit Committee of the Board, at least quarterly, will receive quarterly reports on our cybersecurity program and developments from our Vice President of Global Security. These reports will include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity. It is anticipated that Audit Committee oversight will include review of periodic tabletop exercises to test cybersecurity infrastructure and incident response measures.


text: Our Global IT and Global Security departments are led by our Executive Vice President and Chief Information Officer, Gertrude Van Horn, who joined us in January 2024. Ms. Van Horn is a globally recognized, award-winning executive with over 40 years of experience in global IT leadership, information security, crisis management, strategic planning and decision-making. Her expertise spans a diverse group of industries including financial services, chemicals, global manufacturing and retail. Prior to joining us, Ms. Van Horn served in C-level and executive IT leadership roles for NCH Corporation, IntegraColor, Haggar Clothing Company, JOANN Stores, Office Depot, Victoria's Secret, American Express, and J.P. Morgan.


text: Our Vice President of Global Security, Darren Remblence, reports to Ms. Van Horn and is responsible for the development of strategic direction, execution, and day-to-day management of global security. Mr. Remblence has more than 20 years of international experience and expertise in information security, cybersecurity, physical security, IT operations, investigations, business continuity and disaster recovery. Prior to joining us, Mr. Remblence worked at PayPal Inc., eBay Inc., The London Clearing House Ltd, Centrica Plc. and DHL International (UK) Ltd. He also served 14 years in the British Royal Air Force, where he specialized in cybersecurity and counterintelligence. He received his Master of Science in IT security from the University of Westminster, London and holds CISM (Certified Information Security Manager) and CISSP (Certified Information Systems Security Professional) certifications.


text: Generally, the implementation, management and oversight of our cyber risk strategy involves participation and input from Company personnel across a range of functional areas, including our IT, Security, Privacy, Risk Management and Legal departments/functions. Our strategy is designed to incorporate awareness of cyber risk into our day-to-day operations and functions, including the maintenance and establishment of client relationships, operating expectations, contract negotiations, the obtainment of insurance coverage and evaluations of third-party service providers.


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with roles and responsibilities assigned to members of our Incident Response Team ("IRT"), to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. Our IRT is led by our Chief Information Security Officer, with representatives from our IT, Security, Corporate Legal, Communications and Public Relations, Human Resources, Ethics & Compliance and Finance departments/functions.


text: Regarding data privacy, in 2023, our Ethics & Compliance function implemented an annual privacy awareness initiative known as "Data Privacy Week," celebrating an event known as International Data Privacy Day, which is acknowledged in over 50 countries as promoting data privacy best practices and raising awareness about the importance of data protection. Data Privacy Week messaging includes highlighting the various departments and employees who support our data privacy and security compliance efforts, as well as trivia challenges designed to engage employees on this topic. Finally, our compliance program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: Cyberattacks continue to increase in frequency and magnitude generally, and cyber criminals are becoming more sophisticated, including increased usage of emerging technologies such as advanced automation and artificial intelligence. Although we have devoted financial and personnel resources to implement and maintain security measures to meet regulatory requirements and client expectations and will continue to make significant investments to maintain the security of our and our client's data and our cybersecurity infrastructure, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective against new and/or emerging threats, vulnerabilities and techniques designed to circumvent such measures. To date, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, please refer to "Risk Factors " (Part I, Item 1A of this Report).


text: Cybersecurity Governance The Audit Committee of our Board includes members with significant experience and/or expertise in technology or cybersecurity and is responsible for the primary oversight of enterprise risk assessment and management pertaining to the financial, accounting, liquidity, market, tax, cybersecurity and other information technology risks facing our company. At its regular meetings, the Audit Committee, which meets no less than four times per year, receives regular reports from our Company's Ethics & Compliance function, on matters relating to data privacy and compliance, as well as from our Vice President of Risk Management on enterprise risk management, including the activities of our internal audit department surrounding audits and risk assessments of our information security management system, coverage by our insurance carriers for cybersecurity incidents, and our ISO 9001 and 27001 certifications (described above under the heading "Compliance and Certifications" in Part I, Item 1 ("Business") of this Report.


text: T he full Board, at least annually, and the Audit Committee of the Board, generally quarterly, receive reports on our cybersecurity program and developments. These reports include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity. It is anticipated that Audit Committee oversight will include review of periodic tabletop exercises to test cybersecurity infrastructure and incident response measures.


text: Our Global IT and Global Security departments are led by our Chief Information Security Officer (CISO), who also serves as the Senior Vice President and General Manager of our Rimini Protect and Rimini Watch solutions. In this role, he is responsible for providing strategic leadership and management of Rimini Street's internal information security and compliance team and programs, the Rimini Protect client-facing security services and solutions, and the Rimini Watch observability solution. Our CISO has over 25 years of experience in IT and security for private and public-sector organizations and expertise in strategic consulting services, risk analysis/risk mitigation, and compliance. Previously, he held roles developing and managing technology and security teams, operations, business development, client-facing programs, budgets, and compliance in highly diverse organizations including the Global 100, defense, healthcare, energy, financial, retail, and education industries. He holds a Bachelor of Science degree in Information Systems with a concentration in Internetworking from Strayer University in Maryland.


text: The Company maintains a comprehensive information security program that is designed to identify, protect against, detect and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program. We consult the National Institute of Standards and Technology Cyber Security Framework for guidance and leverage internal and external resources to design and execute our cybersecurity program.

companyName: Wingstop Inc.

ticker: WING


text: The Company also trains employees to understand their role in attempting to protect the Company from cybersecurity attacks. Our information security training program for employees includes computer-based training at hire, annual follow-up training and acknowledgement of our information security policies, regular internal communications, and testing to measure the effectiveness of our information security program. For example, we conduct regular phishing awareness campaigns designed to emulate current threats and provide immediate feedback and, as necessary, additional training or remedial action.


text: In addition, the Company engages third parties to assist in assessing, identifying, and remediating material risks from cybersecurity threats. Our key cybersecurity controls are regularly tested and audited by third-party service providers, which we retain to help identify vulnerabilities in our systems and to help maintain compliance to standards and regulatory requirements. Other third-party service providers are enlisted by the Company for security operations center services to augment our teams' monitoring capabilities and to assist with our investigation and response to alerts on emerging and ongoing threats.


text: We also maintain a third-party risk management program that includes policies and procedures designed to oversee and manage the cybersecurity risks associated with our third-party service providers. The Company conducts risk assessments at the initial onboarding of vendors or service providers who have access to Company systems or data and, subsequently, at regular intervals in an effort to help determine the severity and scope of risks to Company systems, data and operations. In addition to implementing safeguards that attempt to minimize risks associated with a cybersecurity incident, the Company maintains disaster recovery and business continuity plans that include data backup capabilities. We also have incident response procedures designed to address cybersecurity events that may occur despite the safeguards we have put in place. Further, our incident response procedures and business continuity plans are also designed to assist in responding to breaches of any of our third-party service providers.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In 2023, the Company reinforced its business continuity plan in an effort to provide increased oversight of our third-party service providers and suppliers. Risks from cybersecurity threats that are reasonably likely to materially affect the Company, its business strategy and results of operations or financial condition, include (but are not limited to): data loss; a disruption to our operations; a compromise or corruption of confidential or proprietary information; damage to our employee and business relationships and reputation; increased burden of regulatory compliance; and/or litigation and liability. See our related risk factors in "Item 1A. Risk Factors" for more information about the Company's risks from cybersecurity threats and how such threats may impact the Company's business, operations, and financial results.


text: Our Board classifies cybersecurity and information technology infrastructure among the most significant potential risks to our business in the Company's enterprise risk management program. The Technology Committee, which consists of five independent directors, is responsible for the oversight of the Company's cybersecurity and technology-related risks and management's efforts to monitor and oversee those risks. The Technology Committee oversees these risks in conjunction with the Audit Committee, which also consists entirely of independent directors, and regularly participates in joint meetings with the Audit Committee to discuss these matters.


text: Our Senior Director of Information Security and Data Privacy, who has more than 20 years of experience in information technology-related roles, including engineering, governance, and security, oversees our information security program and matters of risk relating to cybersecurity. Members of our Information Technology team periodically provide risk reports to the Board and its committees, including assessments of the Company's cybersecurity risks, their potential impact on our business operations, and management's strategies to monitor and mitigate those risks. The committee chairs, in turn, report to the full Board as part of our general risk management process.


text: As part of the Company's enterprise risk management program, the Company maintains a comprehensive information security program that is designed to identify, protect against, detect and respond to, and manage cybersecurity threats. The program contains security measures that include, but are not limited to, the following: security policies and procedures; physical and environmental protections; monitoring processes and systems; asset management; risk assessments; a vulnerability management and remediation program; and maintenance of a third-party risk management program. We consult the National Institute of Standards and Technology Cyber Security Framework for guidance and leverage internal and external resources to design and execute our cybersecurity program.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. In 2024, the Company has continued to make strategic investments in both its technical and organizational measures to further enhance its security capabilities and planning for detecting, preventing, and responding to cybersecurity attacks. Risks from cybersecurity threats that are reasonably likely to materially affect the Company, its business strategy and results of operations or financial condition, include (but are not limited to): data loss; a disruption to our operations; a compromise or corruption of confidential or proprietary information; damage to our employee and business relationships and reputation; increased burden of regulatory compliance; and/or litigation and liability. See our related risk factors in "Item 1A. Risk Factors" for more information about the Company's risks from cybersecurity threats and how such threats may impact the Company's business, operations, and financial results.


text: Our Board classifies cybersecurity and information technology infrastructure among the most significant potential risks to our business in the Company's enterprise risk management program. The Technology Committee, which consists of five independent directors, is responsible for the oversight of the Company's cybersecurity and technology-related risks and management's efforts to monitor and oversee those risks. The Technology Committee oversees these risks in conjunction with the Audit Committee, which also consists entirely of independent directors, and, as necessary, participates in joint meetings with the Audit Committee to discuss these matters.


text: Our Vice President of Information Security and Enterprise Information Technology ("CISO"), who reports to our Senior Vice President, Chief Information Officer ("CIO"), oversees our information security program and matters of risk relating to cybersecurity. Our CISO possesses more than 20 years of experience in information technology-related roles, including engineering, governance, and security, undergraduate and post-graduate degrees in information technology and security, and industry-recognized cybersecurity certifications. Our CISO and members of our Information Technology team, including our CIO, periodically provide risk reports to the Board and its committees, including assessments of the Company's cybersecurity risks, their potential impact on our business operations, and management's strategies to monitor and mitigate those risks. The committee chairs, in turn, report to the full Board as part of our general risk management process.


text: In the ordinary course of our business, we collect, use, store, and transmit digitally confidential, sensitive, proprietary, personal, and health-related information. The secure maintenance of this information and our information technology systems is important to our operations and business strategy. To this end, we have implemented processes using the cybersecurity risk framework published by the National Institute of Standards and Technology ("NIST") designed to assess, identify, and manage risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. These processes are managed and monitored by a dedicated information technology team, which is led by our Senior Vice President, Operations and our Vice President, Information Technology ("IT"), and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. Specific measures include regular penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments. We conduct due diligence on and audits of key technology vendors, contract research organizations (CROs), and other third-party contractors and suppliers. Additionally, we conduct periodic employee training that covers cyber and information security, among other topics. We also regularly consult with outside advisors and experts. Their assistance helps us assess, identify, and manage cybersecurity risks, anticipate future threats and trends, and understand their potential impact on our risk environment.

companyName: Spyre Therapeutics, Inc.

ticker: SYRE


text: Our Vice President, Information Technology, who reports directly to our Senior Vice President, Operations, has over 25 years of experience managing information technology and cybersecurity matters and is certified as Certified Information Systems Security Professional. Together with our Senior Vice President, Operations and the other members of our senior leadership team, our Vice President, Information Technology is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives regular updates on cybersecurity and information technology matters and related risk exposures from our Vice President, Information Technology, as well as other members of the senior leadership team. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Our Vice President, Information Technology, who reports directly to our Senior Vice President, Operations, has over 25 years of experience managing information technology and cybersecurity matters and is certified as Certified Information Systems Security Professional. Together with our Senior Vice President, Operations and the other members of our senior leadership team, our Vice President, Information Technology is responsible for assessing and managing cybersecurity risks. We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. In the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Our internal information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants, third-party service providers, or potential future collaborators, may fail or suffer security or data privacy breaches or other unauthorized or improper access to, use of, or destruction of our proprietary or confidential data, employee data or personal data, which could result in additional costs, loss of revenue, significant liabilities, harm to our brand and material disruption of our operations."


text: Cybersecurity Risk Management and Strategy We believe cybersecurity is critical to advancing our company's mission to be the catalyst for massive, measurable, data-informed healthcare improvement. We face a multitude of cybersecurity threats that range from attacks common to most industries, such as ransomware and denial-of-service, to attacks from more advanced and persistent, highly organized groups and challenges specific to the healthcare industry. Our clients and suppliers face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance, and results of operations.

companyName: Health Catalyst, Inc.

ticker: HCAT


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan, which outlines the steps to be followed from incident detection to mitigation, recovery, and notification, including notifying functional areas (e.g., legal and compliance), as well as senior leadership and the board of directors, as appropriate.


text: Our cybersecurity program incorporates industry-standard frameworks (including third-party certification), policies, and practices designed to protect the privacy and security of our sensitive information. Our third-party certifications for certain Solutions include a HITRUST Common Security Framework certification (which includes standards from frameworks such as HIPAA, ISO, EU, GDPR, NIST, and PCI to provide risk-based certification for companies in the healthcare supply chain) and a Statement on Standards for Attestation Engagements 18 (SSAE 18) System and Organization Control (SOC) 2 report that evaluates our security program.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management process. Cybersecurity related risks are included in the risk universe that the enterprise risk management function evaluates to assess top risks to the enterprise on an annual basis. To the extent the enterprise risk management process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The enterprise risk management's annual risk assessment is presented to the board of directors.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • an information security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to Data and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Cybersecurity Governance Our board of directors oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our cybersecurity program is led by our Chief Information Security Officer and includes a team of cybersecurity and security compliance professionals. The cybersecurity program is further strengthened through support of our General Counsel and Chief Compliance and Data Privacy Officer. Our legal and cybersecurity teams work closely together to support and bolster our cybersecurity program. Our cybersecurity team reports to our Audit Committee quarterly on information security and cybersecurity matters, or as needed. Our Audit Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity, as appropriate. The full Board also receives briefings from management on our cyber risk management program. From time to time, Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal cybersecurity team or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Information Security Officer and Chief Compliance and Data Privacy Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes more than 75 years of combined IT experience, 35 of which are focused specifically on Information Security. The broader Information Security team's accredited industry certifications include Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), Certificate of Cloud Security Knowledge (CCSK), Certified Cloud Security Professional (CCSP), and Blue Team Level II. The company's current CISO has more than two decades of IT leadership experience and holds several relevant IT and healthcare specific certifications including CISSP, CISM, CCSK and CCSP, and has a Bachelor of Science in Computer Information Systems and a Master of Science in Medical Informatics.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • an information security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors based upon our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Risk Factors—Risks Related to Data and Intellectual Property" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Cybersecurity Governance Our board of directors (Board) oversees management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Our cybersecurity program is led by our Chief Information Security Officer (CISO) and includes a team of cybersecurity and security compliance professionals. The cybersecurity program is further strengthened through support of our General Counsel and Chief Compliance and Data Privacy Officer. Our legal and cybersecurity teams work closely together to support and bolster our cybersecurity program. Our cybersecurity team reports to our Audit Committee quarterly on information security and cybersecurity matters, or as needed. Our Audit Committee has oversight responsibility for our data security practices and we believe the Audit Committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity, as appropriate. The full Board also receives briefings from management on our cyber risk management program. From time to time, Board members receive presentations on cybersecurity topics from our CISO, internal cybersecurity team or external experts as part of the Board's continuing education on topics that impact public companies.


text: The company's current CISO has more than two decades of IT leadership experience and holds several relevant IT and healthcare specific certifications including CISSP, CISM, CRISC, CCSK and CCSP, and has a Bachelor of Science in Computer Information Systems and a Master of Science in Medical Informatics. Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Information Security team's experience includes more than 75 years of combined IT experience, 35 of which are focused specifically on Information Security. The broader Information Security team's accredited industry certifications include Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Certified in Risk and Information Systems Control (CRISC), Certified Information Systems Auditor (CISA), Certificate of Cloud Security Knowledge (CCSK), Certified Cloud Security Professional (CCSP), and Blue Team Level II.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk management and strategy Planet Fitness recognizes the importance of developing, implementing, and maintaining cybersecurity measures designed to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Planet Fitness, Inc.

ticker: PLNT


text: Managing Material Risks & Integrated Risk Management Planet Fitness has strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. Our risk management team works closely with our information technology ("IT") department to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. These risks are captured and prioritized in a risk register.


text: Engaging Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Planet Fitness engages with a range of external experts, including cybersecurity assessors, consultants, legal advisors and auditors in evaluating and testing our risk management systems. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Oversee Third-party Risk Because we are aware of the risks associated with third-party service providers, Planet Fitness implements processes to oversee and manage these risks. We conduct security assessments of third-party providers before engagement and maintain ongoing monitoring to oversee compliance with our cybersecurity standards.