text: The company's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally and report cybersecurity incidents to appropriate levels of management based on potential impact. The company conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, IT management exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The company takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.


text: As of the date of this report, the company has not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, the company including its business strategy, results of operations, or financial condition.

companyName: IMPERIAL OIL LTD

ticker: IMO

secItem: Item 1C


text: While the company believes its cybersecurity program to be appropriate for managing constantly evolving cybersecurity risks, no program can fully protect against all possible adverse events. For additional information on these risks and potential consequences if the measures the company is taking prove to be insufficient or if the company's proprietary data is otherwise not protected, see "Item 1A. Risk factors: Operational and other factors - Cybersecurity" in this report.


text: Imperial recognizes the importance of cybersecurity in achieving its business objectives, safeguarding its assets, and managing its daily operations. Accordingly, the company integrates cybersecurity risks into its overall enterprise risk management system. The board of directors oversees the company's risk management approach and structure, which includes an annual review of the company's cybersecurity program.


text: The company's cybersecurity program is managed by the Canada Information Technology (IT) Manager, with support from cross-functional teams led by IT and operational technology cybersecurity operations managers in the company and in Exxon Mobil Corporation and its affiliates (collectively, Cybersecurity Operations Managers). The Cybersecurity Operations Managers are responsible for the day-to-day management and effective functioning of the cybersecurity program, including the prevention, detection, investigation, and response to cybersecurity threats and incidents. The Cybersecurity Operations Managers collectively have many years of experience in cybersecurity operations.


text: IT management provides updates to the company's senior management throughout the year, covering, as appropriate, the company's cybersecurity strategy, initiatives, key security metrics, penetration testing and benchmarking learnings, and business response plans, as well as the evolving cybersecurity threat landscape.


text: The company's cybersecurity program includes multi-layered technological capabilities designed to prevent and detect cybersecurity disruptions and leverages industry standard frameworks, including the National Institute of Standards and Technology Cybersecurity Framework. The cybersecurity program incorporates an incident response plan to engage cross-functionally and report cybersecurity incidents to appropriate levels of management based on potential impact. The company conducts annual cybersecurity awareness training and routinely tests cybersecurity awareness and business preparedness for response and recovery, which are developed based on real-world threats. In addition, IT management exchanges threat information with governmental and industry groups and proactively engages independent, third-party cybersecurity experts to test, evaluate, and recommend improvements on the effectiveness and resiliency of its cybersecurity program through penetration testing, breach assessments, regular cybersecurity incident drill testing, threat information sharing, and industry benchmarking. The company takes a risk-based approach with respect to its third-party service providers, tailoring processes according to the nature and sensitivity of the data or systems accessed by such third-party service providers and performing additional risk screenings and procedures, as appropriate.


text: The Company has processes in place to identify, assess and manage risks from information security vulnerabilities and cybersecurity threats. The Company maintains and updates tools, controls, technologies, methods, systems and other processes that are designed to prevent, detect, escalate, investigate, mitigate and remediate data loss, theft, misuse, unauthorized access or other security incidents or vulnerabilities that may affect the Company's information systems and data. The Company uses an enterprise vulnerability management platform to scan IT assets and report any known vulnerabilities associated with such IT assets. This platform enables the Company's Information Security Team to identify and prioritize solutions necessary to remediate any identified vulnerabilities. The Company's policies require that remediation be performed in a timely manner, including the completion of follow-up scanning to confirm the remediation of any identified vulnerabilities. Further, the Company's incident response program enables the identification and management of information security threats, risks and incidents. The incident response program is powered by technology that enables threat and event correlation across enterprise systems, user behavior analytics, anomalous behavior identification, network detection and response, end point detection and response, and an incident tracking system. The Company promptly engages the Computer Security Incident Response Team ("CSIRT") if a security incident is observed. The CSIRT is composed of lead personnel from the Company's IT department and employees who have been trained on the handling of information security incidents. The CSIRT may also engage third party incident response investigators that are on retainer to assist in incident response.

companyName: INGLES MARKETS INC

ticker: IMKTA


text: The Company uses the National Institute of Standards and Technology's Cybersecurity Framework (NIST CSF) as a guide for cyber risk management. The Center for Internet Security (CIS) Benchmarks and the Payment Card Industry (PCI) Security Standards are also followed to ensure compliance with the Payment Card Industry Data Security Standard (PCI-DSS) and to assist with managing risk.


text: The Company has information technology security practices designed to protect its information technology systems and data and to monitor for potential cybersecurity threats. These practices are integrated into the Company's risk management framework and include: Cybersecurity controls embedded in the Company's information technology systems; Regular implementation of changes to the Company's information technology systems to address potential threats and vulnerabilities; Incident response program, including proactive simulations to identify and manage cybersecurity threats, risks and incidents; Participation in industry forums and collaboration with peers; and Security awareness and data protection training for applicable employees.


text: Additionally, the Company assesses and manages cybersecurity threats associated with its third party service providers' information technology systems that could compromise the Company's information security or data. Identified cybersecurity threats are communicated to management for review, response and mitigation as appropriate.


text: The Company evaluates risk associated with the engagement of any third-party through a lifecycle-based approach, conducting risk-based due diligence before an engagement, using contractual provisions to address risk, and, for certain third-parties, engaging in architectural review and validation prior to an engagement.


text: The Company has an Information Security Team composed of employees and a managed detection and response partner providing 24/7 coverage. Additionally, the Company utilizes third parties to assist with penetration testing, attack simulation, threat intelligence reporting, detection and incident response, as well as review and enhancement of associated response plans and processes.


text: The Company's Vice President of Information Technology, Director of Information Security, Director of Systems Engineering, and Director of Retail Platforms manage the Company's information security policies and have oversight of our cybersecurity systems and methodologies risks, as well as assessing and managing cybersecurity risk. The Director of Information Security holds cybersecurity certifications as a Certified Information Systems Security Professional and GIAC Penetration Tester. Risk is evaluated on an ongoing basis to determine the likelihood and magnitude of a potential impact. In addition, the Director of Internal Audit is a Certified Internal Auditor and is actively involved in the annual internal general IT controls audit and partners with a third party to assist. The results of all internal audits, including information technology issues, are shared with the Company's Audit Committee of the Board of Directors which reports to the full Board of Directors.


text: The Company is constantly evolving its information security strategy and responses for new and emerging threats. As of the date of this Annual Report on Form 10-K, the Company has not encountered risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company's business strategy, results of operations or financial position.


text: The Company's Vice President of Information Technology, Director of Information Security, Director of Systems Engineering, and Director of Retail Platforms manage the Company's information security policies and have oversight of our cybersecurity systems and methodologies risks, as well as assessing and managing cybersecurity risk. The Director of Information Security holds cybersecurity certifications as a Certified Information Systems Security Professional and GIAC Penetration Tester. Risk is evaluated on an ongoing basis to determine the likelihood and magnitude of a potential impact. In addition, the Director of Internal Audit is a Certified Internal Auditor and is actively involved in the annual internal general IT controls audit and partners with a third party to assist. The results of all internal audits, including information technology issues, and updates on the Company's incident response program and results are shared with the Company's Audit Committee of the Board of Directors which reports to the full Board of Directors.


text: Risk Management and Strategy Griffon relies on electronic information systems, networks and technologies to conduct and support its operations and other functions and activities within the Company and with third parties. We rely on commercially available systems, software, tools, third-party service providers and monitoring to provide security for processing, transmission and storage of confidential information and data. We have an enterprise-grade cybersecurity management program designed to assess, identify, protect, detect and respond to, and manage material risks from cybersecurity threats. To protect our information systems from cybersecurity threats, we use various information technology and cybersecurity tools to safeguard our systems and data, which help prevent, identify, escalate, investigate, remediate, respond and recover from identified vulnerabilities and cybersecurity incidents.

companyName: GRIFFON CORP

ticker: GFF


text: As part of the Company's cybersecurity risk management program, we follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") to assess, identify and manage material risks that arise from cybersecurity threats. Griffon's cybersecurity risk management program is closely tied to and integrated with the Company's overall enterprise risk management processes.


text: Griffon has a third-party risk management program regarding the cybersecurity practices of its vendors and partners that is designed to oversee, identify, and minimize material risks from cybersecurity threats associated with the use of such third parties. This program involves vetting of third parties before engagement. Regular monitoring and reviews are conducted to ensure third party vendors and partners comply with Griffon's security standards.


text: From time to time, Griffon engages external experts, including cybersecurity assessors, consultants, and/or auditors to evaluate cybersecurity measures and risk management processes.


text: We also maintain a cyber incident response plan ("IRP") with the objective of (1) providing a structured and systematic incident response process for cybersecurity threats that affect us, (2) timely and effectively identifying, resolving and communicating cybersecurity incidents, and (3) managing internal and external communications and reporting.


text: If a cybersecurity incident occurs, our incident response team ("IRT") is immediately notified, and Griffon management is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents impacting the Company. The IRT also coordinates further notifications, as applicable, to senior executives and organizational leadership, our Audit Committee and Board of Directors, business partners or service providers, and authorities.


text: Like most organizations, we and our third-party service providers have experienced and expect to continue to experience actual or attempted cyber-attacks of our information systems and networks. During the reporting period, Griffon has not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that we believe have materially affected, or are reasonably likely to materially affect, us, including our business strategy, operating results, and financial condition. However, if any such event, whether actual or perceived, were to occur, it could have a material adverse effect on our business strategy, operating results and financial condition. We continuously use threat models and cyber threat intelligence to identify relevant risks to our businesses and take active measures to mitigate these risks. For more information regarding the risks we face from cybersecurity threats, see Item 1A., "Risk Factors" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Cybersecurity is an important part of our enterprise risk management processes and an area of focus for our Board of Directors and management.


text: The Audit Committee assists the Board of Directors in its oversight of risks related to cybersecurity and directly oversees risk management relating to cybersecurity. The Audit Committee is also responsible for assessing the steps management has taken to monitor and control these risks and exposures, and evaluating guidelines and policies with respect to our cybersecurity risk assessment and risk management. The Audit Committee reviews our cybersecurity program with management and reports to the Board of Directors with respect to, and its review of, the program. Cybersecurity reviews by the Audit Committee generally occur at least annually, or more frequently as determined to be necessary or advisable. From time to time, third-party subject matter experts present to the Audit Committee on contemporary cybersecurity topics of interest.


text: Griffon also has a Cybersecurity Management Committee, consisting of executives from Griffon and technology leaders from Griffon's business segments, that monitors and assesses progress and performance by Griffon's business segments in the area of cybersecurity; the results of such assessments are reported to the Audit Committee from time to time. The Chief Information Officers of each of HBP and CPP regularly provide updates on material cybersecurity risks to our senior management and to our Audit Committee, and along with their technology teams, are responsible for assessing and managing cybersecurity risks. Each of our business segment Chief Information Officers has over 20 years of experience in cybersecurity, information security, policy, architecture, engineering and incident response.


text: Risk Management and Strategy Cybersecurity is a critical part of risk management at IBM and is integrated with the company's overall enterprise risk management framework. The Board of Directors and the Audit Committee of the Board are responsible for overseeing management's execution of cybersecurity risk management and for assessing IBM's approach to risk management. Senior management is responsible for assessing and managing IBM's exposure to cybersecurity risks on an ongoing basis.

companyName: INTERNATIONAL BUSINESS MACHINES CORP

ticker: IBM


text: From an enterprise perspective, we implement a multi-faceted risk management approach based on the National Institute of Standards and Technology Cybersecurity Framework. We have established policies and procedures that provide the foundation upon which IBM's infrastructure and data are managed. We regularly assess and adjust our technical controls and methods to identify and mitigate emerging cybersecurity risks. We use a layered approach with overlapping controls to defend against cybersecurity attacks and threats on IBM networks, end-user devices, servers, applications, data, and cloud solutions.


text: We draw heavily on our own commercial security solutions and services to manage and mitigate cybersecurity risks. IBM maintains a Security Operations Center ("SOC") that monitors for threats to IBM's networks and systems, utilizing threat intelligence provided by a range of sources, including the IBM Security X-Force Exchange platform, which maintains one of the largest compilations of threat intelligence in the world. We also rely on tools licensed from third party security vendors to monitor and manage cybersecurity risks. We periodically engage third parties to supplement and review our cybersecurity practices and provide relevant certifications.


text: We have a global incident response process, managed by IBM's Computer Security Incident Response Team ("CSIRT"), that relies primarily on internal expertise to respond to cybersecurity threats and attacks. We utilize a combination of online training, educational tools, videos and other awareness initiatives to foster a culture of security awareness and responsibility among our workforce, including responsibility for reporting suspicious activity.


text: IBM has a third party supplier risk management program to oversee and identify risks from cybersecurity threats associated with its use of third party service providers and vendors. Risks are assessed and prioritized based, among other things, on the type of offering/engagement, supplier assessments, threat intelligence, and industry practices.


text: As discussed in greater detail in Item 1A., "Risk Factors," the company faces numerous and evolving cybersecurity threats, including risks originating from intentional acts of criminal hackers, hacktivists, nation states and competitors; from intentional and unintentional acts or omissions of customers, contractors, business partners, vendors, employees and other third parties; and from errors in processes or technologies, as well as the risks associated with an increase in the number of customers, contractors, business partners, vendors, employees and other third parties working remotely. While the company continues to monitor for, identify, investigate, respond to and remediate cybersecurity risks, including incidents and vulnerabilities, there have not been any that have had a material adverse effect on the company, though there is no assurance that there will not be cybersecurity risks that will have a material adverse effect in the future.


text: IBM's Enterprise & Technology Security ("E&TS") organization has oversight responsibility for the security of both IBM's internal systems and external offerings and works across all of the organizations within the company to protect IBM, its brand, and its clients against cybersecurity risks. E&TS also addresses cybersecurity risks associated with third party suppliers. For these purposes, E&TS includes a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes for IBM's internal systems. The CISO manages the CSIRT. The CISO also manages the Product Security Incident Response Team ("PSIRT"), which focuses on product vulnerabilities potentially affecting the security of offerings sold to customers. IBM also has Business Information Security Officers ("BISO") who coordinate with the Office of the CISO on security issues specific to particular business segments.


text: The CSIRT team, together with the Office of the Chief Information Officer ("CIO"), Cyber Legal, Corporate Security, and BISOs, engages in on-going reviews of incidents, threat intelligence, detections, and vulnerabilities, including to assess client and regulatory impact. Events of interest are promptly reported to the Senior Vice President ("SVP") for Legal & Regulatory Affairs and General Counsel ("GC") and the SVP overseeing cybersecurity ("SVP Sponsor").


text: Incidents are delegated to an appropriate incident response team for assessment, investigation, and remediation. Depending on the nature of the matter, the incident response team may include individuals from E&TS, the Office of the CISO, the Office of the CIO, Cyber Legal, Business Units, the Chief Privacy Office, Human Resources, Procurement, Finance and Operations, and Corporate Security. The incident response teams advise and consult with the GC and the SVP Sponsor, as appropriate.


text: The Cybersecurity Advisory Committee ("CAC") meets regularly and is responsible for overseeing management of the Company's cybersecurity risk. The CAC is composed of, among others, SVPs from the major business units, the SVP Sponsor, and the GC. The CAC is responsible for, among other things, setting the Company's governance structure for managing cybersecurity risk and reviewing noteworthy cybersecurity incidents and strategies to prevent recurrence. IBM management responsible for managing cybersecurity risk reflects a cross-section of functions from across the organization with significant experience in managing such risk as well as the technologies underlying these risks. They also hold leadership positions outside of IBM in the field of cybersecurity, serving on governing and advisory boards of public and private institutions at the forefront of issues related to cybersecurity, including technology development, cybersecurity policy, and national security.


text: The Board of Directors and the Audit Committee oversees the cyber governance process. Leadership from E&TS, including the CISO, make regular presentations to the Audit Committee and the full Board on identification, management, and remediation of cybersecurity risks, both internal and external, as well as threat intelligence, emerging global policies and regulations, cybersecurity technologies, and best practices. In addition, senior management provides briefings as needed to the Audit Committee Chair, the Audit Committee, and, as appropriate, the full Board, on cybersecurity issues and incidents of potential interest.


text: As discussed in greater detail in Item 1A., "Risk Factors," the company faces numerous and evolving cybersecurity threats, including risks originating from the increased use of AI, intentional acts of individual and groups of criminal hackers, hacktivists, state-sponsored organizations, nation states and competitors; from intentional and unintentional acts or omissions of customers, contractors, business partners, vendors, employees and other third parties; and from errors in processes or technologies, as well as the risks associated with the number of customers, contractors, business partners, vendors, employees and other third parties working remotely. While the company continues to monitor for, identify, investigate, respond to and remediate cybersecurity risks, including incidents and vulnerabilities, there have not been any that have had a material adverse effect on the company, though there is no assurance that there will not be cybersecurity risks that will have a material adverse effect in the future.


text: IBM's Enterprise & Technology Security ("E&TS") organization has oversight responsibility for the security of both IBM's internal systems and external offerings and works across all of the organizations within the company to protect IBM, its brand, and its clients against cybersecurity risks. E&TS also addresses cybersecurity risks associated with third party suppliers. For these purposes, E&TS includes a dedicated Chief Information Security Officer ("CISO") whose team is responsible for leading enterprise-wide information security strategy, policy, standards, architecture, and processes for IBM's internal systems. The CISO manages the CSIRT. The CISO also manages the Product Security Incident Response Team ("PSIRT"), which focuses on product vulnerabilities potentially affecting the security of offerings sold to customers. IBM also has Business Information Security Officers ("BISO") who are coordinated by the Office of the CISO on security issues specific to particular business segments.


text: The CSIRT team, together with the Office of the Chief Information Officer ("CIO"), Cyber Legal, Corporate Security, and BISOs, engages in on-going reviews of incidents, threat intelligence, detections, and vulnerabilities, including to assess client and regulatory impact. Events of interest are promptly reported to the Senior Vice President ("SVP") and Chief Legal Officer ("CLO"), and the SVP overseeing cybersecurity ("SVP Sponsor").


text: Incidents are delegated to an appropriate incident response team for assessment, investigation, and remediation. Depending on the nature of the matter, the incident response team may include individuals from E&TS, the Office of the CISO, the Office of the CIO, Cyber Legal, Business Units, the Office of Privacy and Responsible Technology, Human Resources, Procurement, Finance and Operations, and Corporate Security. The incident response teams advise and consult with the CLO and the SVP Sponsor, as appropriate.


text: The Cybersecurity Advisory Committee ("CAC") meets regularly and is responsible for overseeing management of the Company's cybersecurity risk. The CAC is composed of, among others, SVPs from the major business units, the SVP Sponsor, and the CLO. The CAC is responsible for, among other things, setting the Company's governance structure for managing cybersecurity risk and reviewing noteworthy cybersecurity incidents and strategies to prevent recurrence. IBM management responsible for managing cybersecurity risk reflects a cross-section of functions from across the organization with significant experience in managing such risk as well as the technologies underlying these risks. They also hold leadership positions outside of IBM in the field of cybersecurity, serving on governing and advisory boards of public and private institutions at the forefront of issues related to cybersecurity, including technology development, cybersecurity policy, and national security.


text: The Board of Directors and the Audit Committee oversee the cyber governance process. Leadership from E&TS, including the CISO, make regular presentations to the Audit Committee and the full Board on identification, management, and remediation of cybersecurity risks, both internal and external, as well as threat intelligence, emerging global policies and regulations, cybersecurity technologies, and best practices. In addition, senior management provides briefings as needed to the Audit Committee Chair, the Audit Committee, and, as appropriate, the full Board, on cybersecurity issues and incidents of potential interest.


text: Risk Management and Strategy Our comprehensive Incident Response Plan outlines processes to identify, detect, assess, respond to and recover from threats, including cybersecurity threats. We follow those processes to manage material risks from cybersecurity threats, including risks relating to disruption of business operations or financial reporting systems, intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy laws and other litigation/legal risk; and reputational risk, as part of our overall risk management system and processes.

companyName: INTERNATIONAL FLAVORS & FRAGRANCES INC

ticker: IFF


text: In addition, our Enterprise Risk Management ("ERM") program considers cybersecurity risks alongside other company risks. Our enterprise risk professionals consult with cross-organizational leaders to gather information necessary to identify cybersecurity risks, evaluate their likelihood and severity, identify necessary mitigations and assess the potential impact of those mitigations on residual risk. Our ERM Committee, chaired by the Chief Financial Officer ("CFO") and General Counsel ("GC"), and comprised of senior leaders representing each risk domain, integrates global risks, including cybersecurity and compliance, to ensure appropriate prioritization of resources and alignment across the Company. The ERM Committee meets with our Executive Leadership Team and presents at least annually to our Board of Directors on the ERM process and on our risk mitigation actions, including providing reporting focused on compliance and cybersecurity risks.


text: Our Chief Information Officer ("CIO") is responsible for delivering on the Company's global Information Technology ("IT") strategy, including infrastructure, data and analytics, application delivery, end user services, cybersecurity risk management and the digital technology transformation program. The IT leadership team leads the implementation of the IT strategy and the day-to-day operations. Under the guidance of the CIO, our Chief Information Security Officer ("CISO") leads Information Security ("InfoSec"), which includes the Cyber Fusion Center, Infrastructure Security, including network segmentation, firewalls and intrusion detection and prevention systems, Identity and Access Management, Application Security, Data Security and InfoSec Governance, Risk and Compliance. InfoSec is overseen by the InfoSec Steering Committee, comprised of senior leaders representing all corporate functions and business units, and the InfoSec Governance Review Board, comprised of the IT leadership team and the InfoSec leadership team. InfoSec is governed in coordination with IFF's ERM Committee and is aligned to the U.S. National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition to our dedicated leadership team overseeing InfoSec, we view InfoSec as a shared responsibility, and to best protect our network, computers and data from threats, we empower our employees to be our first line of defense. To that end, all employees globally complete annual mandatory InfoSec training on email security, password security and our Acceptable Use Policy. We use email security, endpoint security, logging and monitoring, remote access, application security and other tools to deter threat actors, block malicious/phishing emails and avoid IT system interruptions.


text: Our comprehensive InfoSec Incident Response Plan is updated at least annually, and provides guidance for detecting, containing, eradicating and recovering from potential incidents. It outlines escalation procedures, reporting requirements, incident severity levels, a materiality assessment and roles and responsibilities for key partners, including IT, Legal/Employee Relations, Corporate Communications, Human Resources and other senior leaders. Our escalation procedures include escalation to our Executive Leadership Team, Audit Committee, Disclosure Committee, and Board of Directors, and reporting to regulators, customers, investors, and others. We also maintain cybersecurity insurance, regularly evaluate the effectiveness of our systems, and test our contingency plans by conducting vulnerability analysis and tabletop exercises with both technical incident responders and senior leaders.


text: Based on industry baselines and discussions throughout our membership in various global InfoSec communities, we believe that these preventative actions provide adequate measures of protection against information security breaches/incidents and reduce our cybersecurity risks. Given the evolving nature of InfoSec incidents, we regularly engage with our peers on threat intelligence and collaborate with organizations both in our industry and across industries to share best practices.


text: In connection with our InfoSec risk management processes, we engage third-party assessors and outside counsel. Our program includes review and assessment by external, independent third parties, who assess and report on our overall InfoSec program and identify areas for continued focus and improvement. Our CIO, CISO and GC oversee our technology risk management and privacy teams, which work in partnership with our Internal Audit team to review IT-related controls as part of the overall internal controls process and regulatory requirements. We consult with outside counsel to advise our team and our Board of Directors on best practices for InfoSec oversight, and the evolution of that oversight over time. InfoSec employees regularly speak at and attend industry events to ensure awareness of evolving threats and innovative prevention and remediation techniques. Further, our InfoSec risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers through relationship due diligence, InfoSec assessments and contractual provisions.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. For more detailed information about risks related to our cybersecurity, refer to Item 1A, "Risk Factors" – "A significant data breach or other disruption to our information technology systems could disrupt our operations, result in the loss of confidential information or personal data, and adversely impact our reputation, business or results of operations."


text: The Board of Directors is responsible for overseeing and reviewing with management the Company's InfoSec risks and the policies and practices established to manage such risks. In that effort, the Board of Directors delegates certain responsibilities to our Audit Committee. This committee-level focus on InfoSec allows the Board to further enhance its understanding of these issues as it continues to have overall oversight responsibility for risk.


text: The Audit Committee assists the Board of Directors in its oversight by staying apprised of our InfoSec programs, strategy, policies, standards, architecture, processes and material risks, and by overseeing response to InfoSec incidents. Our Audit Committee receives from management updates, at least quarterly, on material security risks, including any material incidents, relevant industry developments, threat vectors and material risks identified in periodic penetration tests or vulnerability scans. These updates also include material legal and legislative developments concerning InfoSec, our approach to complying with applicable law and material engagement with regulators concerning IT and InfoSec.


text: The Board of Directors receives regular reports from the Audit Committee which detail (a) InfoSec initiatives, (b) reviews of the policies and practices established to manage these processes, and (c) reviews of the Company's procedures for monitoring compliance with applicable laws. Additionally, the Board of Directors also receives updates on the Company's risks through ERM program reports, which include management's approach to mitigating and managing InfoSec risks.


text: Members of the Board of Directors stay apprised of the rapidly evolving cyber threat landscape and provide guidance to management, as appropriate, to address the effectiveness of our overall data privacy and cybersecurity program. Recently, members of the Board of Directors and Executive Leadership Team participated in a Cybersecurity Exercise led by our CIO and CISO as training, and, to prepare for incident response. The Board of Directors and Audit Committee also receive regular cybersecurity posture reports from an external third-party, and outside counsel advises the Board of Directors on best practices for the Board's oversight of InfoSec and the evolution of that oversight over time. Additionally, two members of our Board of Directors and Audit Committee have experience in InfoSec matters.


text: Our Board of Directors and Audit Committee's principal role is one of oversight, recognizing that management, led by our CIO and CISO, is responsible for the design, implementation and maintenance of an effective program for identifying, detecting, protecting against, responding to, recovering from and mitigating data privacy and InfoSec risks. Our CIO has more than 30 years of technology experience, including leadership across a variety of enterprise technologies, including InfoSec, and across multiple industries. Our CISO has more than 20 years of experience in InfoSec, across multiple industries, and is a Certified Information Systems Security Professional (CISSP). The CIO and CISO provide, at least, annual updates on IT and InfoSec initiatives to the Board of Directors and quarterly updates to the Audit Committee.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. For more detailed information about risks related to our cybersecurity, refer to Item 1A, "Risk Factors" —"A significant data breach or other disruption to our information technology systems could disrupt our operations, result in the loss of confidential information or personal data, and adversely impact our reputation, productivity, business or results of operations."


text: RISK MANAGEMENT AND STRATEGY The Company's cybersecurity risk management processes are integrated into the Company's overall risk management system. The Company has a formalized enterprise risk management program overseen by the Board of Directors and committees of the Board of Directors that addresses strategic, operational, financial, compliance, legal and information technologies and cybersecurity risks. In addition, the Enterprise Risk Management Council ("ERM Council") is a management-level team comprised of senior vice presidents and other business leaders responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on the Company's business and financial results. The ERM Council regularly reports to the Board of Directors on areas of risk and risk management. The Chief Financial Officer serves as the ERM Council Lead. The Chief Audit Executive serves as the ERM Council Process Owner.

companyName: INTERNATIONAL PAPER CO /NEW/

ticker: IP


text: The Company has an Information Technology ("IT") Risk Governance Program that aligns with the enterprise risk management framework and assists with fulfilling oversight responsibilities for major IT risks, including cybersecurity risks. The IT Risk Governance Program identifies, defines, manages, measures and governs cybersecurity risks across the Company at an enterprise level. The IT Risk Governance Program is carried out by an IT Risk Identification and Mitigation Team ("IT RIM"), which is comprised of business leaders from information security, information technology, human resources, internal audit, legal, and risk. The IT RIM meets monthly, reviews all cybersecurity incidents meeting certain criteria, provides oversight with respect to cybersecurity matters at a management level, and reports to the ERM Council.


text: Our Risk Assessment Program The Company has a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks the Company faces include targeted attacks, ransomware, data theft, virus and intrusion software, as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. For a full discussion of cybersecurity risks facing the Company, please see Part I, Item 1A. Risk Factors - WE ARE SUBJECT TO CYBERSECURITY AND INFORMATION TECHNOLOGY RISKS RELATED TO BREACHES OF SECURITY PERTAINING TO SENSITIVE COMPANY, CUSTOMER, EMPLOYEE AND VENDOR INFORMATION AS WELL AS BREACHES IN TECHNOLOGY USED TO MANAGE OPERATIONS AND OTHER BUSINESS PROCESSES. Key aspects of the Company's cybersecurity program include the following: • layered technical protective capabilities and detective surveillance controls; • utilizing independent third parties to assess the Company's practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • courses and awareness training on information security for employees with Company email or access to Company devices, including phishing, social engineering and other cybersecurity training as well as targeted training for specific roles based on responsibilities and risk level; • global security and privacy policies; and • business continuity, incident response and disaster recovery procedures, including table top exercises involving senior leaders. The Company carries cyber insurance which provides coverage in connection with cybersecurity breaches.


text: Engagement of Third Parties The Company engages third parties in connection with assessing, identifying and managing its cybersecurity risks, including the following: • Engagement of an independent third party with incident response expertise to provide intelligence-based cybersecurity solutions and services to assist the Company with preparing for, preventing, investigating, responding to and remediating cybersecurity incidents, including attacks that target on-premise, cloud, and critical infrastructure environments. • Engagement of an independent third party to conduct an annual security program assessment of the controls, maturity and performance of the Company's information security program and the information security risk associated with the Company's business systems. The assessment uses the National Institute of Standards and Technology Cybersecurity Framework as its benchmark. • Engagement of a leading third-party service provider to annually perform an external and an internal penetration assessment using industry standard tools and techniques. Additionally, our Internal Audit team conducts annual assessments of our cyber programs and controls.


text: Oversight of Third Parties The Company has processes to oversee and identify material risks from cybersecurity threats associated with the Company's use of third-party service providers. In this regard, the Company's cybersecurity risk management program takes into account third-party systems whereby the Company could be impacted by the compromise of the security of vendors or other business relations of the Company, and the Company has a comprehensive third-party access management system. In addition, the Company conducts risk-based due diligence on the profiles of third-party service providers with respect to cybersecurity risks prior to engagement, and providers of critical services are continuously monitored with respect to security risks. The Company also requires service providers to provide prompt notification of any actual or suspected breach impacting Company data or operations.


text: The Company does not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition.


text: Role of the Board of Directors and its Committees International Paper has an integrated board and executive-level governance structure that oversees risks from cybersecurity threats. The Company's Board of Directors has primary oversight of our enterprise risk management program, which includes cybersecurity risk. Moreover, the Board of Directors is supported in its oversight by the Audit and Finance Committee and PPE Committee, which share oversight responsibilities related to the Company's information security programs. The Audit and Finance Committee reviews management's cybersecurity and information security risk management programs and controls, including processes for management's identification and reporting of material cybersecurity incidents. The PPE Committee reviews technology issues pertinent to the Company including those associated with information and operational technology, cybersecurity and data security and assesses related Company strategies.


text: Our Board of Directors, Audit and Finance Committee and PPE Committee each receives periodic updates on cybersecurity issues from management (including our Chief Information Security Officer ("CISO")). For example, the CISO provides reports to the Audit and Finance Committee and PPE Committee regarding cybersecurity risks, as well as plans and strategies to mitigate those risks, at least annually. Furthermore, our ERM Council annually reports its activities either directly to the Board of Directors or through the Audit and Finance Committee.


text: Role of Management At a management level, our cybersecurity risk management program is led by our CISO. Our current CISO has been with the Company for over 30 years, worked in Information Technology for over 25 years, and has led the Company's security efforts since 2011. He was appointed as the Company's first CISO in 2019. Our CISO stays current on cybersecurity issues and trends through continuing education activities such as participation at conferences and in webinars. Our CISO reports to the Chief Information Officer who oversees the Company's information technology department.


text: The Company has also adopted a cyber-incident response plan which provides for controls and procedures in connection with cybersecurity events, including escalation procedures summarized below. The cyber-incident response plan is designed to address non-operational and operational cybersecurity events. Evaluation and response to cybersecurity events is led by our Cybersecurity Incident Response Team ("CIRT"), under the direction of our CISO. The CIRT is comprised of subject matter experts representing Information Security, Information Technology, Operational Technology, and Legal. The CIRT performs an impact assessment with respect to cybersecurity incidents, gathers facts and provides a chronology of events in connection therewith, and leads remediation and recovery activities. Our General Counsel, Senior Vice President of Human Resources, Chief Ethics and Compliance Officer (or their respective designees), and CISO review and assess significant non-operational data breaches. Cybersecurity events that meet specified criteria for operational impact are escalated for further review to our Business Continuity Incident Command Team ("Incident Command Team"). The Incident Command Team performs an initial assessment that includes evaluation of the cybersecurity event's severity, response required, and estimated business cost, and leads the execution of business continuity plans to maintain Company operations. Cybersecurity events meeting certain criteria are escalated to our Disclosure Committee, General Counsel and Chief Financial Officer for further review. The Disclosure Committee, General Counsel and Chief Financial Officer assess and determine materiality using the facts and chronology of events provided by the Incident Command Team.


text: RISK MANAGEMENT AND STRATEGY The Company's cybersecurity risk management processes are integrated into our overall risk management system. The Company has a formalized enterprise risk management program overseen by the Board of Directors and committees of the Board of Directors that addresses strategic, operational, financial, compliance, legal and information technologies and cybersecurity risks. In addition, the Enterprise Risk Management Council ("ERM Council") is a management-level team comprised of senior vice presidents and other business leaders responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on the Company's business and financial results. The ERM Council regularly reports to the Board of Directors on areas of risk and risk management. The Chief Financial Officer serves as the ERM Council Lead. The Chief Audit Executive serves as the ERM Council Process Owner.


text: As part of our 80/20 strategic approach and our integration of DS Smith, the Company is evaluating how the ERM Council might operate in 2025 to ensure that our structure supports our strategic goals.


text: The Company has an Information Technology ("IT") Risk Governance Program that aligns with our enterprise risk management framework and assists with fulfilling oversight responsibilities for major IT risks, including cybersecurity risks. An enterprise Cyber Governance, Risk, and Compliance function manages overall Company cyber risk, coordinating risk management functions with each business. Business and IT leaders conduct cyber risk reviews monthly within each business. These monthly reviews include the evaluation of new and evolving risks, management of risk mitigation plans, and a review of all cybersecurity incidents meeting certain criteria.


text: Our Risk Assessment Program The Company has a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks the Company faces include targeted attacks, ransomware, malware, phishing attacks, data theft, other data or security breaches, virus and intrusion software, as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Key aspects of the Company's cybersecurity program include the following: • layered technical protective capabilities and detective surveillance controls; • utilizing independent third parties to assess the Company's practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • courses and awareness training on information security for employees with Company email or access to Company devices, including phishing, social engineering and other cybersecurity training as well as targeted training for specific roles based on responsibilities and risk level; • global security and privacy policies; and • business continuity, incident response and disaster recovery procedures, including table top exercises involving senior leaders.


text: The Company does not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected the Company, including its business strategy, results of operations or financial condition. For a full discussion of cybersecurity risks facing the Company, please see Part I, Item 1A. Risk Factors - We are subject to cybersecurity and information technology risks related to breaches of security pertaining to sensitive company, customer, employee and vendor information as well as breaches in technology used to manage operations and other business processes. The Company carries cyber insurance which provides coverage in connection with cybersecurity breaches.


text: Our Board of Directors, Audit and Finance Committee and PPE Committee each receives periodic updates on cybersecurity issues from management (including our Chief Information Security Officer ("CISO")). For example, the CISO provides reports to the Audit and Finance Committee and PPE Committee at least annually regarding cybersecurity risks, as well as plans and strategies to mitigate those risks.


text: Furthermore, our ERM Council annually reports its activities either directly to the Board of Directors or through the Audit and Finance Committee.


text: Role of Management At a management level, our cybersecurity risk management program is led by our CISO. Our current CISO has been with the Company for over 30 years, worked in Information Technology for over 25 years, and has led the Company's security efforts since 2011. He was appointed as the Company's first CISO in 2019. Our CISO stays current on cybersecurity issues and trends through continuing education activities such as participation at conferences and in webinars. Our CISO reports to our Chief Financial Officer. Additionally, our CISO and members of the cybersecurity team hold a number of industry recognized certifications, such as Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Ethical Hacker, among others.


text: The Company has also adopted a cyber-incident response plan which provides for controls and procedures in connection with cybersecurity events, including escalation procedures summarized below. The cyber-incident response plan is designed to address non-operational and operational cybersecurity events. Evaluation and response to cybersecurity events is led by our Cybersecurity Incident Response Team ("CIRT"), under the direction of our CISO. The CIRT is comprised of subject matter experts representing information security, information technology, operational technology and legal. The CIRT performs an impact assessment with respect to cybersecurity incidents, gathers facts and provides a chronology of events in connection therewith, and leads remediation and recovery activities. Our General Counsel, Senior Vice President, Chief People and Strategy Officer, Chief Ethics and Compliance Officer (or their respective designees), and CISO review and assess significant non-operational data breaches. Cybersecurity events that meet specified criteria for operational impact are escalated for further review to our Business Continuity Incident Command Team ("Incident Command Team"). The Incident Command Team performs an initial assessment that includes evaluation of the cybersecurity event's severity, response required, and estimated business cost, and leads the execution of business continuity plans to maintain Company operations. Cybersecurity events meeting certain criteria are escalated to our Disclosure Committee, General Counsel and Chief Financial Officer for further review, and, if appropriate, may be further elevated for the review of the Board of Directors. The Disclosure Committee, General Counsel and Chief Financial Officer assess and determine materiality using the facts gathered and chronology of events provided by the Incident Command Team.


text: Risk Management and Strategy We rely extensively and increasingly on information technologies and infrastructure to manage our business (including the digital storage of marketing strategies and client information), develop new business opportunities and digital products, and process business transactions. Digital services and products, advertising and marketing technology, e commerce services, data management and analytics and digital brand experience constitute a key part of our client offerings. Our business operations therefore depend on the availability, integrity and secure processing, storage, and transmission of confidential and sensitive information, including personal information, digitally and through interconnected systems, including those of our vendors, service providers and other third parties.

companyName: INTERPUBLIC GROUP OF COMPANIES, INC.

ticker: IPG


text: Consequently, we maintain comprehensive policies and procedures designed to prevent and mitigate the risks posed by cybersecurity threats and incidents and to identify, analyze, address, mitigate and remediate those incidents that do occur. As part of our program: • we regularly review and update at least annually our standard policies and procedures related to information technology and analyze those policies against the standards and controls that we believe are most relevant to our Company set by organizations such as the National Institute of Standards and Technology (NIST) cybersecurity framework and the International Organization for Standardization (ISO); • we maintain a dedicated cybersecurity team under the direction of our Chief Information Officer (CIO), including our Chief Information Security Officer (CISO), each of whom has expertise related to data and network security, data governance and risk management; • we regularly test our internal IT controls; • we regularly conduct internal as well as third-party attack and penetration tests; • we maintain, and we require our third-party service providers to maintain, security controls designed to ensure the confidentiality, integrity, and availability of our systems and the confidential and sensitive information we maintain and process, or which is processed on our behalf; • all employees are required to complete periodic trainings that cover security and privacy best practices and company policies; and • we have prepared and regularly review our business continuity, disaster recovery and other back-up plans, including as they relate to cybersecurity incidents.


text: We also work with third-party cybersecurity and data privacy professionals as part of the design and implementation of our program, including our accountants, independent assessors (for example, for penetration testing) of our cybersecurity program, external legal counsel and other consultants.


text: We have an incident reporting and escalation process designed to detect and analyze cyber incidents as they occur to determine appropriate response action and reporting, including the materiality of any such incidents to our financial condition and operations. This process includes: • continual monitoring of our systems and logs by both internal and outsourced staff; • immediate escalation to an incident reporting call and review by our CIO of certain signals, including evidence of external threat actors, ransomware attacks, data exfiltration, identity compromise or unusual requests from management or certain departments; • if deemed appropriate, reporting by our CIO to the Executive Risk Committee, comprised of multi-disciplinary senior leaders across the organization, including representatives of our accounting, human resources, finance, information technology and legal functions, and consultation with internal and external legal counsel, for further review and determination of the scope and materiality of the incident or incidents, including whether public disclosure is appropriate or required; and • informing our Board of Directors (the "Board") and the Audit Committee of the Board of significant or material cybersecurity incidents, as appropriate. All incidents are documented and recorded and cataloged for further review by the CISO team.


text: While we, our clients and our vendors are regularly exposed to malicious technology-related events and threats, none of these threats or incidents, either individually or in the aggregate of related occurrences, have materially affected the Company in the period covered by this report. In determining materiality, cybersecurity incidents are reviewed not only for potential financial impacts, which could include potential legal and regulatory penalties, stolen assets or funds, system damage, forensic and remediation costs, lost client revenue or litigation costs, but also the breadth and sensitivity of data exposure, data exfiltration, impacts on the ability to operate our business or provide our services, client dissatisfaction, and loss of investor confidence. See Item 1A, Risk Factors, for more information on the cybersecurity threats facing our Company.


text: Our Board actively oversees Interpublic's risk management activities both directly and through its committees and considers various risk topics throughout the year, including cybersecurity and information security risk management and controls. As part of its oversight function, the Board oversees the Company's risk assessment and risk management policies and performs an annual review and assessment of the primary operational and regulatory risks facing Interpublic, their relative magnitude and management's plan for mitigating these risks. At least annually, our CIO and CISO report to the full Board with a comprehensive report addressing a broad range of topics, including updates on strategy and investments, significant cybersecurity incidents that have occurred since the last update, the status of projects and initiatives to update our cybersecurity policies and practices, industry trends, and ongoing efforts to prevent, detect, and respond to internal and external critical threats.


text: The Audit Committee oversees the design and operation of the Company's enterprise risk management program, including, in conjunction with the Board, oversight of its cybersecurity framework and the strategy, policies and practices implemented by the organization to appropriately mitigate such risks. Such oversight includes discussions with management and the Company's internal auditors on the magnitude and steps taken to address and mitigate any such risks. As a regular part of its meetings, risks related to cybersecurity are reviewed by the committee as part of the internal and external audit reports to the committee.


text: Interpublic's senior management is responsible for assessing and managing the Company's various exposures to risk, including those related to cybersecurity, on a day-to-day basis, including the identification of risks through a robust enterprise risk management framework and the creation of appropriate risk management programs and policies to address such risks. Our CIO and CISO have primary responsibility for managing our cybersecurity program and efforts. They work closely with key stakeholders, including internal committees such as the information security steering committee, peer institutions, and industry groups, in order to manage cybersecurity and information security risk. Our internal audit team is responsible for the testing and audit of our information-technology internal controls. In addition, leaders from our communications, finance, legal and risk teams participate in incident response training, including tabletop exercises, designed to enhance our ability to respond to cybersecurity incidents quickly, efficiently and with the appropriate degree of urgency. More generally, our Executive Risk Committee has primary responsibility for overseeing the Company's risk framework and the material risks facing our Company.


text: We believe our information technology team to be well-qualified in this area. These qualifications include collective decades of professional experience in the field, in both private enterprise and government, and training and certification such as Digital Directors Network, Qualified Technical Expert training and certification, National Association of Corporate Directors (NACD) certification, Certified Information Systems Security Professional (CISSP) certification, ISO 27001 certification, and BCS certification, as well as recent participation in IT and cybersecurity programs organized by leading educational institutions with expertise in the field.


text: RISK MANAGEMENT AND STRATEGY We are subject to various cybersecurity risks in connection with our business. For additional information, see Item 1A — Risk Factors. As part of our overall enterprise risk management system and processes, we assess, identify and manage material risks from threats to our information systems. Once risks are identified, our Enterprise Risk Management Committee ("ERM Committee"), which consists of executives appointed by the Board, oversees and reviews these risks and provides an annual report regarding such risks to the Audit Committee for further review and evaluation. We also maintain processes to oversee and identify risks from cyber threats associated with our use of third-party service providers, including annual reviews of third-party SOC1 reports.

companyName: Rayonier, L.P.


text: Safeguarding our operations against cyber threats is a high priority. Recognizing the importance of a strong posture towards cyber threats, our strategy to combat the evolving threat landscape and support the protection of sensitive information includes engaging in: • Incident Response Planning and Data Backups. We maintain and regularly review a detailed incident response plan to help minimize downtime and disruption in the event of a cybersecurity incident and to assess materiality and any related disclosure obligations. We also actively maintain data backup procedures for business continuity in the event of a cybersecurity incident. Examples of our backup procedures and systems include daily server snapshots, database log files, Salesforce backups, and Google Vault. Generally, these backups of critical systems would allow us to restore operation within hours. • Third-Party Managed Monitoring, Detection, and Response Services. We partner with a reputable third-party firm for 24/7 threat monitoring, detection and response. • External Cybersecurity Process Assessments. We also engage third-party experts to conduct periodic process assessments against the U.S. National Institute of Standards and Technology ("NIST") framework to help us evaluate and enhance our cybersecurity practices. • Penetration Testing and Phishing Simulations. We periodically engage experts for penetration testing to identify system vulnerabilities and to simulate real-world cyberattacks. We also conduct quarterly phishing simulations to test our staff's response and to deliver targeted cyber awareness training. • Continuous Improvement and Adaptation. We regularly review and update our strategies to keep pace with the dynamic cyber threat landscape, and to build a resilient and responsive cybersecurity system. Our employees receive monthly training on data protection, threat detection, and incident response. We also provide a forum for employees to report cyber "near misses" to elevate cyber threat awareness across our organization.


text: In the past, we have experienced targeted and non-targeted cybersecurity attacks and incidents, and we could in the future experience similar attacks. To date, no cybersecurity attack or incident, or any risk from cybersecurity threats, has materially affected or has been determined to be reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition.


text: Our Director of Information Technology and our Manager of IT Security, having a combined 45 years of information technology experience1 take the lead in protecting the organization's digital assets and sensitive information from cyber threats and manage our partnerships with the external firm that specializes in around-the-clock threat monitoring, detection, and response services and other third-party providers.


text: In the event of a breach or incident, our Director of Information Technology leads our response to mitigate impact and initiate the recovery processes. Following the identification of a breach or incident, the Director of Information Technology reports incidents of a medium or high severity level2 to our senior leadership team. Incidents of a high severity level are also reviewed by our Disclosure Committee to assess materiality and any disclosure obligations. All incidents are reported to the Audit Committee at the next scheduled Board meeting, and incidents of high severity level are immediately reported to the Audit Committee.


text: The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity risk management. For each Audit Committee meeting, the Director of Information Technology prepares an updated cybersecurity dashboard, featuring key metrics such as threat detection rates and response times. Additionally, the Director of Information Technology provides an annual cybersecurity briefing to the Audit Committee. External penetration tests and process audits, conducted at regular intervals, are reported directly to the Audit Committee by our third-party firm. These comprehensive measures help to ensure that the Committee remains well-informed and proactive in their oversight of cybersecurity risks.


text: (1)Our Director of Information Technology has more than 25 years of IT experience. He joined the company in 2000 as an application developer and has held multiple positions of authority including project management and IT operations management. He holds a bachelor's degree and MBA from the University of South Carolina.


text: Our Manager of IT security has more than 20 years of IT experience. He joined the company in 2015 as a Systems Engineer and was promoted to his current position in 2020. Prior to joining Rayonier, he worked as an Infrastructure Engineer at Enterprise Integration (EI), a managed services provider. Prior to joining EI, he held various IT roles in support and engineering.


text: (2) A medium severity incident level is defined as incidents that have a moderate impact on business operations or data integrity and might affect internal systems and could potentially lead to limited unauthorized access to sensitive information. A high severity incident level is defined as incidents that pose a significant threat to business operations, data integrity, or confidential information. This level of incident may have legal, regulatory and public relations implications.


text: Our Director of Information Technology and our Manager of IT Security, having over 45 years of combined information technology experience1 take the lead in protecting the organization's digital assets and sensitive information from cyber threats and manage our partnerships with the external firm that specializes in around-the-clock threat monitoring, detection, and response services and other third-party providers. Our Director of Information Technology and Manager of IT Security also report material risks from threats to our information systems to the ERM Committee.


text: The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity risk management. For each Audit Committee meeting, the Director of Information Technology prepares an updated cybersecurity report, featuring key metrics and threats. Additionally, the Director of Information Technology provides an annual cybersecurity briefing to the Audit Committee. External penetration tests and process audits, conducted at regular intervals, are reported directly to the Audit Committee by our third-party firm. These comprehensive measures help the Committee remain well-informed and proactive in their oversight of cybersecurity risks.


text: Our Manager of IT Security has more than 20 years of IT experience. He joined the company in 2015 as a Systems Engineer and was promoted to his current position in 2020. Prior to joining Rayonier, he worked as an Infrastructure Engineer at Enterprise Integration (EI), a managed services provider. Prior to joining EI, he held various IT roles in support and engineering.


text: We maintain a cybersecurity program, designed to proactively identify, assess, manage, mitigate, and respond to cybersecurity threats. Our Cybersecurity Organization develops, implements, and maintains this program, which is documented in our global cybersecurity policy. The underlying controls of the cybersecurity program are based on recognized best practices and standards for cybersecurity and information technology and is aligned to the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and the International Organization Standardization ("ISO") 27001 Information Security Management System Requirements. Cybersecurity is an important and integrated part of our enterprise risk management program that identifies, monitors and mitigates business, operational and legal risks. Our cybersecurity risk management process is integrated into our overall risk management process, and shares common methodologies, reporting channels and governance processes that apply across the risk management process to other legal, compliance, strategic, operational and financial risk areas.

companyName: JACOBS SOLUTIONS INC.

ticker: J


text: We regularly assess the threat landscape and take a holistic view of cybersecurity risks, with a layered cybersecurity strategy based on prevention, detection and mitigation. Our cybersecurity program maintains assessment protocols for proactively evaluating potential cybersecurity impacts and risks, supported by incident response procedures. We employ systematic processes to manage cybersecurity risks, including through cybersecurity audits, interconnectivity with business networks, system access controls and monitoring, and data back-up and recovery. Our cloud environments undergo continuous assessment, with firewall and backup systems designed to support operational resilience. We employ a Zero Trust Security framework that requires identity verification for network access, complemented by regular system assessments and monitoring. Our security controls include identity management programs, data loss prevention protocols, and threat detection capabilities. Our controls undergo regular review and updates based on threat intelligence, ensuring adaptability to merging threats. Similarly, our incident response program is regularly tested and updated to address emerging threat landscapes. To ensure organization-wide security awareness, cybersecurity training is mandatory and issued to all employees annually. Cybersecurity awareness is also included across other training programs, including our annual Code of Conduct and privacy training programs.


text: Third-party risk management is a critical component of our security strategy. We maintain oversight of service providers through a proactive monitoring approach, leveraging a cybersecurity questionnaire and security and privacy addenda to our contracts where applicable. We evaluate third party providers for maintenance of effective security management programs, compliance with information handling and asset management protocols, and require prompt notification of known or suspected cyber incidents.


text: To validate our security posture, we engage independent external parties to conduct regular penetration testing and security audits, and to provide cybersecurity consulting services. We maintain ISO 27001 certification for our global enterprise. Additionally, our IT General Controls (ITGC) undergo annual testing through Sarbanes-Oxley audits, which examine security controls relating to system changes, access management, system configurations, and data backup processes.


text: Our Board of Directors has ultimate oversight of cybersecurity and information security risk, which it manages as part of our enterprise risk management program. Specifically, the Board is assisted by the Audit Committee and the ESG and Risk Committee, which oversees our cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks, and reports to the Board. Throughout the year, our senior executives, including our Chief Information Security Officer ("CISO"), provide regular briefings to the full Board, the Audit Committee and the ESG and Risk Committee. These presentations cover technology trends, regulatory developments, disclosure requirements, legal issues, policies and practices, threat environment assessments, and ongoing security measures to prevent, detect, and respond to critical threats. The Board, the Audit Committee and the ESG and Risk Committee regularly discuss cybersecurity and information security risks with our senior executives. As part of our cybersecurity governance, we also utilize a Cybersecurity Steering Committee comprised of executive management, operational leaders, and cross-functional teams. Generally, this committee meets quarterly, or more frequently as appropriate, to review, assess and direct decisions related to cybersecurity and information systems matters.


text: Our cybersecurity program is led by our CISO, who reports to our Chief Information Officer (CIO). Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security team, many of whom have decades of experience and hold certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager, and through the use of technological tools and software and engagement with external consultants. Our CISO has extensive experience assessing and managing cybersecurity programs and cybersecurity risk and holds the following certifications: Certified Information Systems Security Professional (CISSP), a Certified Ethical Hacker (CEH), am FINRA Licensed (with a Series 99), and an Oracle Cloud Certified Professional (OCP). Our CISO and CIO regularly report directly to the Board, the Audit Committee and the ESG and Risk Committee on our cybersecurity program and efforts to prevent, detect, mitigate, and remediate incidents. In addition, in the event of an incident, we intend to follow our incident response procedures that include notification processes to inform senior management and the Board of Directors and provide ongoing updates regarding any such incident until it has been remediated as appropriate.


text: Our operations are subject to cybersecurity risks, including unauthorized access, system failures, and breaches that could originate from both internal networks and through third-party suppliers and service providers. While we have not experienced a material impact on our business strategy, results of operations and/or financial condition resulting from cybersecurity threats or previous cybersecurity incidents, such events have the potential to have a material adverse effect on our business strategy, results of operations and financial condition, including by damaging or interrupting access to our information systems or networks, compromising confidential or otherwise protected information, destroying or corrupting data, or otherwise disrupting our operations. We continuously monitor our networks for unauthorized access attempts and maintain defensive measures; however, the dynamic nature of cyber threats means we cannot guarantee prevention of all potential future incidents that could materially impact our business operations, financial condition, or strategic objectives. Even if we successfully defend our own digital technologies and services, we also rely on providers of third-party products, services, and networks, with whom we may share data and services, and who may be unable to effectively defend their digital technologies and services against attack.


text: The Company maintains a commitment to cybersecurity using a combination of policy, technology, and training across the corporation. Emerging threats and regulatory compliance require regular monitoring and maintenance of the information technology environment, which the Company accomplishes by using internal resources, contracted partners, and industry-standard practices to meet security goals. These include implementation of technical controls such as National Institute of Standards and Technology ("NIST") SP 800-53 and NIST SP 800-171, and adherence to guidelines including Sarbanes-Oxley and the U.S. Department of Defense Federal Acquisition Regulation Supplement ("DFARS"). To address the risks to our information technology systems and data and as part of our Corporate Enterprise Risk Management program, we manage an information security program, which is designed to comply with the Department of Justice's CMMC requirements, maintain strong incident reporting capabilities and perform daily off-site backups. Additionally, we have implemented business continuity plans and security precautions for our critical systems, including establishing a back-up data center.

companyName: KAMAN Corp


text: The Company's cybersecurity protections are based on layered technologies supporting trained employees. Periodic testing of networks, systems, and personnel is performed to validate implementation and effectiveness of controls. Penetration testing, internal and external audit and annual review of policies and response plans are designed to provide a cybersecurity governance framework and independent verification that the Company maintains effective cybersecurity controls. Our information security team regularly monitors our network for anomalous activity and indications that track threat advisories from government security services, such as the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Administration as well as commercial cybersecurity companies and information technology vendors. Automated tools and our third-party Security Operations Center provide alerts to our information security staff regarding potential threats.


text: We perform annual assessments of information technology risk, including threats associated with our third-party service providers. We conduct diligence on all third-party providers we work with to evaluate their security practices consistent with our security principles, including compliance with regulatory and industry controls such as NIST 800-53 and System and Organization Controls reports. Cybersecurity risks, both internally and from third-party providers, are tracked quarterly as part of the Corporate Enterprise Risk Management program.


text: As of the date of filing, there are no material risks from cybersecurity threats, including those resulting from previous incidents, that have or are reasonably likely to have a material impact on our business strategy, results of operations or financial conditions. Refer to Item 1A, Risk Factors, for further information and a discussion of a previous cybersecurity incident identified at the Company.


text: The Audit Committee of the Board of Directors oversees the Company's business risk assessment framework and identifies principal business risks confronting the Company, including cybersecurity issues. The Audit Committee also reviews and discusses with management the Company's cybersecurity, data protection and information technology risks, controls and procedures and the Company's plans to mitigate those risks. The Audit Committee discusses cybersecurity risks and exposures periodically with management as well as internal and external auditors. The VP, Information Technology and our internal audit team provide the Audit Committee with quarterly or as needed updates on the performance of our program and information security matters and risk.


text: The VP, Information Technology, along with the information technology organization, is primarily responsible for the assessment and management of material risks from cybersecurity threats. This individual is responsible for briefing our executive officers and their direct reports about information technology threats to the organization and recommended courses of action. The Company's cybersecurity incident response plan includes measures for communicating with executive leadership about prevention, detection and remediation of identified information technology incidents.


text: Members of the information technology organization, including the VP, Information Technology, directors and managers, maintain cybersecurity credentials, such as Certified Information Security Manager ("CISM"), Certified Information Systems Security Specialist ("CISSP"), Certified Information Systems Auditor ("CISA") and Certified Data Privacy Solutions Engineer ("CDPSE"), as well as technology-specific qualifications for infrastructure and security used in the IT environment.


text: Cybersecurity Risk Management and Strategy Management of material risks from cybersecurity threats for Kelly, Kelly subsidiaries, third-party suppliers and vendors occurs as part of the Company's Enterprise Risk Management (ERM) program. The Company's ERM program provides ongoing risk identification, oversight, guidance, and mitigation on various risks, including cybersecurity. The Company has a Chief Information Security Officer (CISO) responsible for the evaluation and mitigation of cybersecurity risks in coordination with the Company's information technology, law, risk and insurance, and enterprise risk and compliance groups. These groups work in tandem on cybersecurity and privacy governance, and oversee the Company's approach to information security, privacy, data governance, and IT infrastructure, which includes internal monitoring to proactively identify potential security threats, maintenance of access controls, asset management, response and recovery activities, and training and awareness programs.

companyName: KELLY SERVICES INC

ticker: KELYA


text: The Company maintains technical and organizational safeguards, including employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms to protect the Company's assets and operations. In addition to our internal information security team, we rely on services from various third parties, including a Managed Security Service Provider (MSSP) and services from an IT solutions organization. To evaluate the effectiveness of these internal and external efforts, Kelly adopted the National Institute of Standards and Technology Cybersecurity framework (NIST CFS) and is assessed against NIST CFS by a third-party firm at least annually. We use the assessment, reviews and exercises to ensure that the Company's information security program and processes for managing material cybersecurity risks are responsive to changes in the threat environment.


text: We rely upon multiple information technology systems and networks, some of which are web-based or managed by third parties, to process, transmit, and store electronic information and to manage or support a variety of critical business processes and activities. We actively review the risks associated with all third-party service providers at the inception of our relationship with them and on an ongoing basis as part of our information security program and enterprise risk management third-party risk assessment process. These processes include architecture reviews and contractual clauses related to data protection and compliance, SSAE audits and reviews of vendor SOC 1 and SOC 2 Type II reports for critical vendors and ongoing monitoring and reporting of vendor security by independent third parties.


text: Cybersecurity Threats Although we have not experienced a cybersecurity incident that materially affected our results of operations or financial condition, we periodically experience cyberattacks, which may include the use or attempted use of malware, ransomware, computer viruses, phishing, social engineering schemes and other means of attempted disruption or unauthorized access. Additionally, the rapid pace of change in information security and cybersecurity threats could result in cyberattacks with little or no notice. Our relationships with third parties, including suppliers we manage, customers, and vendors to whom we outsource or rely on for business processes or software, creates potential avenues for malicious actors to initiate a supply chain attack. Even in instances where we are not the direct target of a malicious actor, we could be exposed to risk due to our relationships and business processes with these third parties.


text: Despite security measures, unforeseen exploits create an inherent risk of cyberattacks that could materially affect our operations without notice. An event involving the destruction, modification, accidental or unauthorized release, or theft of sensitive information from systems related to our business, or an attack that results in damage to or unavailability of our key technology systems or those of critical vendors (e.g., ransomware), could result in damage to our reputation, fines, regulatory sanctions or interventions, contractual or financial liabilities, additional compliance and remediation costs, loss of employees or customers, loss of payment card network privileges, operational disruptions and other forms of costs, losses or reimbursements, any of which could materially adversely affect our operations or financial condition. Our cyber security and business continuity plans, and those of our third parties with whom we do business, may not be effective in anticipating, preventing, or effectively responding to all potential cyber risk exposures. Our insurance coverage may not be sufficient to cover all such costs or consequences, and there can be no assurance that any insurance that we now maintain will remain available under acceptable terms.


text: Our Board of Directors oversees consideration of strategic risks to the Company as well as managements actions to address and mitigate those risks and delegate oversight of specific risk topics to relevant board committees. The Company's CISO, Chief Enterprise Risk and Privacy Officer, and Audit Committee Chair of the Company's Board of Directors review the Company's cybersecurity metrics on access controls, asset management, response and recovery activities, training and awareness programs, cybersecurity threats and certain incident information quarterly, and on an ad hoc basis when necessary, with each committee chair and other directors (including the CEO) of the Company's Board of Directors, the Company's chief people officer, chief financial officer and general counsel. The Chief Enterprise Risk and Privacy Officer holds similar quarterly reviews with the Company's CEO and executive officers. During these reviews, topics include: • implementation and third-party evaluation of the Company's cybersecurity program, including applicable policies, procedures, governance, and adopted risk management framework; • the impact of cybersecurity and privacy risks on the Company's services, employees, customers, suppliers, vendors and the staffing industry; and • information on global regulatory changes and best practices. In addition to the reports submitted quarterly by the Company's Chief Risk Officer and CISO, the Vice President of Internal Audit independently assesses the Company's risk management process and separately reports on the effectiveness of the Company's risk identification, prioritization, and mitigation processes to the Audit Committee. All board members are kept apprised of its committees' risk oversight activities through reports from the committee chairs presented at regular Board meetings. The Company utilizes a multi-layered approach to prevent and detect cyber threats and has standard operating procedures relating to the identification, incident response and notification and management escalations for security incidents. In line with those procedures, the Company activates an emergency management team (EMT), empowered to make decisions, and respond to critical events including cyber incident mitigation and remediation activities. EMT members for information security incidents would include the CISO, the CIO, and Chief Enterprise Risk and Privacy Officer, additional member from the information technology and ERM teams as well as representation from the General Counsel Office, Finance, Communications and Business Operations as appropriate. While active, the EMT provides regular reports to the CEO, General Counsel and other members of the senior leadership team.


text: The Company's Chief Information Security Officer is responsible for the assessment and management of material risks related to cybersecurity. The CISO reports directly to the Chief Information Officer (CIO) and has served in the CISO role since its creation in 2021 and in similar roles with the Company since 2011. The CISO has more than 30 years of experience in the information technology field, including more than 20 years of experience helping secure organizations in the professional services, manufacturing and US Intelligence/Department of Defense sectors. He holds a BS in Business/Information Systems. In addition, the Company's Management Team and Cybersecurity and Privacy Governance Team is composed of individuals with collective decades of experience in information technology, data protection, threat response, emergency management, business continuity, and disaster recovery.


text: Cybersecurity Risk Management and Strategy Management of material risks from cybersecurity threats for Kelly, Kelly subsidiaries, third-party suppliers and vendors occurs as part of the Company's Enterprise Risk Management ("ERM") program. The Company's ERM program provides ongoing risk identification, oversight, guidance, and mitigation on various risks, including cybersecurity. The Company has a Chief Information Security Officer ("CISO") responsible for the evaluation and mitigation of cybersecurity risks in coordination with the Company's information technology, law, risk and insurance, and enterprise risk and compliance groups. These groups work in tandem on cybersecurity and privacy governance, and oversee the Company's approach to information security, privacy, data governance, and IT infrastructure, which includes internal monitoring to proactively identify potential security threats, maintenance of access controls, asset management, response and recovery activities, and training and awareness programs.


text: The Company maintains technical and organizational safeguards, including vulnerability assessments, endpoint monitoring, penetration testing, employee training, incident response capability reviews and exercises, cybersecurity insurance and business continuity mechanisms to protect the Company's assets and operations. In addition to our internal information security team, we rely on services from various third parties, including a Managed Security Service Provider ("MSSP") and services from an IT solutions organization. To evaluate the effectiveness of these internal and external efforts, Kelly adopted the National Institute of Standards and Technology Cybersecurity framework ("NIST CSF") and is assessed against the NIST CSF by a third-party firm at least annually. We use the assessment, reviews and exercises to ensure that the Company's information security program and processes for managing material cybersecurity risks are responsive to changes in the threat environment.


text: We rely upon multiple information technology systems and networks, some of which are web-based or managed by third parties, to process, transmit, and store electronic information and to manage or support a variety of critical business processes and activities. We actively review the risks associated with all third-party service providers at the inception of our relationship with them and on an ongoing basis as part of our information security program and enterprise risk management third-party risk assessment process. These processes include architecture reviews and contractual clauses related to data protection and compliance, SSAE audits and reviews of vendor System and Organization Controls ("SOC") 1 and SOC 2 Type II reports for critical vendors and ongoing monitoring and reporting of vendor security by independent third parties.


text: Cybersecurity Threats Although we have not experienced a cybersecurity incident that materially affected our results of operations or financial condition, we periodically experience cyberattacks, which may include the use or attempted use of malware, ransomware, computer viruses, phishing, social engineering schemes, and other means of attempted disruption or unauthorized access. Additionally, the rapid pace of change in information security and cybersecurity threats could result in cyberattacks with little or no notice. Our relationships with third parties, including suppliers we manage, customers, and vendors to whom we outsource or rely on for business processes or software, creates potential avenues for malicious actors to initiate a supply chain attack. Even in instances where we are not the direct target of a malicious actor, we could be exposed to risk due to our relationships and business processes with these third parties.