text: Risk assessments designed to help identify cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: A management team, including the Chief Financial Officer (CFO), head of information technology (Head of IT), General Counsel/Chief Compliance Officer, and Deputy General Counsel (together, the Cybersecurity Management Team) responsible for managing and communicating priorities related to (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;

companyName: Arteris, Inc.

ticker: AIP

secItem: Item 1C


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; Cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and A third-party risk management process for essential service providers, suppliers, and vendors.


text: Our Cybersecurity Management Team is responsible for assessing and managing our material risks from cybersecurity threats. The Head of IT has a primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel and our retained external cybersecurity consultants. Our Head of IT has served in various roles in information technology and information security for over 17 years. Our Deputy General Counsel has over 20 years of experience as an attorney and holds various certifications related to privacy and data protection.


text: Our Cybersecurity Management Team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which may include among other things, briefings with internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in our IT environment.


text: We have not at this time identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Intellectual Property, Information Technology and Data Security and Privacy—Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm."


text: Cybersecurity Board Governance Our board of directors considers cybersecurity risk as part of its risk oversight function. Management updates the board of directors, as necessary, regarding any significant cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The board of directors receives briefings from management periodically on our cyber risk management program and presentations on cybersecurity topics as part of the board of directors' continuing education on topics that impact public companies.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information and is designed to identify, assess, prioritize and manage cybersecurity threats.


text: As part of our comprehensive risk management program, our cybersecurity risk management program includes methodologies, reporting channels and governance processes that apply across the enterprise to other legal, compliance, strategic, operational, and financial risk areas.


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our cybersecurity risk management program; Cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and A third-party risk management process to oversee and identify cybersecurity risks for our use of service providers, suppliers, and vendors.


text: Our Cybersecurity Management Team is responsible for assessing and managing our material risks from cybersecurity threats. The Head of IT has primary responsibility for our overall cybersecurity risk management program and supervises both our internal IT personnel and our retained external cybersecurity consultants. Our Head of IT has served in various roles in information technology and information security for over 17 years. Our Deputy General Counsel has over 20 years of experience as an attorney and holds various certifications related to privacy and data protection.


text: We have not at this time identified risks from known cybersecurity threats, including as a result of any prior cybersecurity events, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors—Risks Related to Intellectual Property, Information Technology and Data Security and Privacy—Cybersecurity threats continue to increase in frequency and sophistication; a successful cybersecurity attack could interrupt or disrupt our information technology systems, or those of our third-party service providers, or cause the loss of confidential or protected data which could disrupt our business, force us to incur excessive costs or cause reputational harm."


text: Cybersecurity Board Governance Our board of directors considers cybersecurity risk as part of its risk oversight function. The Cybersecurity Management Team updates the board of directors, as necessary, regarding any significant cybersecurity incidents.


text: The board of directors receives briefings from management and the Cybersecurity Management Team periodically on our cyber risk management program and presentations on cybersecurity topics as part of the board of directors' continuing education on topics that impact public companies.


text: The Company has adopted standard operating procedures and processes designed to monitor, detect, evaluate and respond to cybersecurity incidents that impact and jeopardize sensitive data stored on the Company's internal systems or on third party systems utilized by the Company. Because the importance and sensitivity of information utilized by the Company varies, the Company applies different levels of protection according to a defined data classification matrix. The Company has implemented a data classification policy to ensure that all data utilized, or housed by or on behalf of the Company, is identified, classified, labeled, properly handled and protected in accordance with its risk profile and as may be required by applicable law. A Data Classification Steering Committee comprised of the Chief Executive Officer (CEO), the President and General Counsel oversees and approves this classification policy. The Company's Information Security team, a group with expertise in cybersecurity that is within the Information Technology function, operating under direction of the Company's Chief Information Officer (CIO), is responsible for monitoring data classification ratings and implementing control solutions to protect data in accordance with the classification assigned. The Company's Information Security team has appropriate experience in information technology roles. The Information Security team also evaluates third party service providers that store sensitive Company data to ensure reputability and the Company reviews service auditor reports annually as may be available. The Company engages third-party services to conduct evaluations of security controls, whether through penetration testing, automated vulnerability scanning, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls. The Company regularly tests defenses by performing simulations and drills at both a technical level (including through penetration tests) and by reviewing operational policies and procedures with third-party experts. The Company also shares and receives threat intelligence with its defense industrial base peers, government agencies, information sharing and analysis centers and cybersecurity associations. Third parties are expected to communicate cybersecurity incidents to the Company within a timely manner.

companyName: Medpace Holdings, Inc.

ticker: MEDP


text: We have adopted several measures aimed to protect against cybersecurity breaches and to minimize disruption if a data breach were to occur. Such measures include documenting, among other things: (i) incident response plans; (ii) procedures for identifying and reporting an incident; and (iii) procedures for containing and eradicating known threats and restoring service to the impacted systems. Upon identification of a cybersecurity event, our policies guide how to handle the incident based on the incident severity and includes information about the required response times, communication protocols and preparation and dissemination of reporting to management. The severity of an incident is classified as "high", "medium" or "low" based on the sensitivity and type of data compromised, the criticality of the system to the Company's operations and its ability to function for users, and the anticipated recovery time and remediation resources required. Incidents classified as "high" must be communicated immediately along with regular progress updates to the CEO, the President, Chief Financial Officer (CFO), General Counsel, CIO and various members of the Information Technology team. High severity events require a sustained response effort using all available resources, which may include engaging third parties to assist in the resolution process as necessary, until resolved.


text: Once the Company gathers sufficient information about a high severity incident, it is evaluated for materiality, both individually and in the aggregate with any other incidents, by a management sub-committee comprised of the President, CFO, CIO and General Counsel. This sub-committee may engage or consult with third parties. Criteria used to evaluate materiality include both quantitative and qualitative factors, including, but not limited to, financial loss, risk to reputation and competitiveness, harm to customer or vendor relationships and the potential for litigation or regulatory investigations. Incidents determined to be material are then communicated immediately to the CEO and then to the Board of Directors after such determination and disclosed in an 8-K within 4 business days upon such determination.


text: As a part of the Company's overall integrated approach to risk management, the Company assesses, identifies and manages cybersecurity related risks. The full Board of Directors provides an additional level of cybersecurity risk oversight.


text: Medpace assesses and evaluates cybersecurity risk using the framework established by the National Institute of Standards and Technology (NIST). Bi-annually, at meetings of the Board of Directors, utilizing the NIST framework standards as a guide, the Information Technology Team discusses the Company's cybersecurity mitigation and resolution maturity and readiness. The Information Technology team's reports to the Board also include reviews and evaluations of key cybersecurity risk focus areas and initiatives, as well as quantitative incident occurrence information.


text: See Item 1A. "Risk Factors" of Part I of this Annual Report on Form 10-K for discussion of cybersecurity risks that are reasonably likely to materially affect the Company.


text: Once the Company gathers sufficient information about a high severity incident, it is evaluated for materiality, both individually and in the aggregate with any other incidents, by a management sub-committee comprised of the President, CFO, CIO and General Counsel. This sub-committee may engage or consult with third parties. Criteria used to evaluate materiality include both quantitative and qualitative factors, including, but not limited to, financial loss, risk to reputation and competitiveness, harm to customer or vendor relationships and the potential for litigation or regulatory investigations. Incidents determined to be material will then be communicated immediately to the CEO and then to the Board of Directors after such determination and disclosed in a Form 8-K within the required timeframe upon such determination.


text: As a part of the Company's overall integrated approach to risk management, the Company assesses, identifies and manages cybersecurity related risks. The full Board of Directors provides an additional level of cybersecurity risk oversight. Medpace assesses and evaluates cybersecurity risk using the framework established by the National Institute of Standards and Technology (NIST). Bi-annually, at meetings of the Board of Directors, utilizing the NIST framework standards as a guide, the Information Technology Team discusses the Company's cybersecurity mitigation and resolution maturity and readiness. The Information Technology team's reports to the Board also include reviews and evaluations of key cybersecurity risk focus areas and initiatives, as well as quantitative incident occurrence information.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, its business strategy, results of operations or financial condition. See Item 1A. "Risk Factors" of Part I of this Annual Report on Form 10-K for discussion of cybersecurity risks that are reasonably likely to materially affect the Company.


text: Risk management and strategy The Company's risk management process includes assessing, identifying and managing material risks from various sources, including those related to cybersecurity. The Company uses information from incident history, industry publications and analysis centers, public news, government information sharing and recognized information security frameworks to inform its risk management program. Management employs a suite of detective and preventative cybersecurity measures including, but not limited to • Maintaining a vulnerability management program, • implementing and operating controls over logical access provisioning, • maintaining an enterprise-wide security awareness program and • administering periodic trainings.

companyName: Kinsale Capital Group, Inc.

ticker: KNSL


text: The Company engages multiple vendors with subject matter and technological expertise in various aspects of cybersecurity management, including continuous threat detection and response coverage, endpoint detection, anti-malware, penetration testing and suspicious activity alerting, among others. When the Company engages third parties, management retains responsibility for the security and resiliency of its information assets. The Company maintains an incident response plan that includes escalation criteria and preliminary materiality assessments to guide business continuity and disclosure objectives.


text: We describe risks related to cybersecurity threats that could materially impact our business strategy, results of operations or financial condition under the heading "Risk Factors." Material impacts could include loss of access to systems and data, financial costs and reputational harm, among others.


text: Our Chief Executive Officer ("CEO") is responsible for assessing and managing overall material risks to the Company. With respect to cybersecurity risks, our CEO leverages the collective expertise of the Company's information security function which reports to our CEO through the Company's Chief Information Officer. The information security function is staffed with individuals with extensive information security employment experience, including in the financial services sector, educational experience and relevant credentials. The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for receiving periodic updates on cybersecurity and information security risks, reviewing and discussing with management the quality and effectiveness of the Company's efforts to mitigate such risks and reporting such findings to the Board of Directors. Management informs the Audit Committee about prevention, detection, mitigation and remediation of cybersecurity incidents at least annually and monitors such matters continuously.


text: Our Chief Executive Officer ("CEO") is responsible for assessing and managing overall material risks to the Company. With respect to cybersecurity risks, our CEO leverages the collective expertise of the Company's information security function which reports to our CEO through the Company's Chief Information Officer. The information security function is staffed with individuals with extensive information security employment experience, including in the financial services sector, educational experience and relevant credentials. The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for receiving periodic updates on cybersecurity and information security risks, reviewing and discussing with management the quality and effectiveness of the Company's efforts to mitigate such risks and reporting such findings to the Board of Directors. Management informs the Audit Committee about prevention, detection, mitigation and remediation of cybersecurity incidents at least semi-annually and monitors such matters continuously.


text: In 2025, the oversight over the Company's cybersecurity risk will transition from the Audit Committee to the Board of Directors ("the Board") to align with the Board's oversight of operational risks.


text: Cybersecurity Risk Management and Strategy In order to respond to the threat of security breaches and cyberattacks, we have developed and maintain a cybersecurity risk management program that is designed to protect and preserve the confidentiality, integrity and continued availability of our systems and information. Our cybersecurity risk management program also includes a cybersecurity incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incidents. The maturity of our cybersecurity program is assessed annually. We use the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF") as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF.

companyName: Frontier Group Holdings, Inc.

ticker: ULCC


text: Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across our overall enterprise risk assessment to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments and rating platforms that are leveraged to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents through monitoring and identification activities; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • annual cybersecurity awareness training for employees and web and mobile developers, including responsible information security, data security and cybersecurity practices; • a computer incident response team ("CIRT") that leverage our cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents, escalating notifications, and reporting requirements to regulatory bodies; and • a third-party risk management process for service providers, suppliers, and vendors.


text: We did not identify a material security breach during the year ended December 31, 2023, nor have we identified risks from any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors is responsible for risk oversight, including cybersecurity risks, which occurs at the board of directors level and through the audit committee's (the "Audit Committee") oversight of cybersecurity and other information technology risks. Additionally, we have a Cybersecurity Disclosure Committee ("CDC"), which includes representation from our Information Technology, Legal, Internal Audit, and Accounting and Reporting teams. The CDC is responsible for assessing the materiality of cybersecurity incidents based on quantitative and qualitative materiality factors, and for providing recommendations on public disclosures of cybersecurity incidents to the Audit Committee if an incident is identified to be possibly material. The CDC also provides input and consideration into internal controls surrounding cybersecurity along with reviewing cybersecurity risks, mitigation strategies, and ensuring the cybersecurity strategy is in alignment with business objectives.


text: The Audit Committee receives reports as necessary, and no less than quarterly, from our cybersecurity management team on our cybersecurity risks and related information, including, but not limited to, analysis of events that have impacted our peers, updates on program maturity, regulatory compliance status and cybersecurity program status and updates. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Audit Committee regularly briefs our board of directors on the matters communicated to the Audit Committee by our cybersecurity management team and the CDC, and our board of directors also receives periodic briefings from our cybersecurity management team on our cybersecurity risk management program and on cybersecurity threats in order to enhance our directors' literacy on cybersecurity issues.


text: Management's Role Our cybersecurity management team, which is led by our Chief Information Officer ("CIO") and Director of Cybersecurity, consists of members who have extensive experience in cybersecurity and is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for implementing our overall cybersecurity risk management program, including ongoing monitoring, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CIO and Director of Cybersecurity have extensive cybersecurity experience as noted below.


text: • Our Senior Vice President, CIO leads our information technology department and oversees our cybersecurity division. Our CIO holds a Bachelor of Engineering in Computer Science and Engineering from Maharshi Dayanand University and a Master of Science in Computer Science from the University of Texas at Arlington. Our CIO has served in various roles in information technology for over 20 years, including as vice president of the Canadian division of a major home improvement retailer, where he directly oversaw the cybersecurity function, and in various vice president and IT director roles at a large U.S. based retailer and aircraft operator, as well as in the energy and online ticket distribution industries. • Our Director of Cybersecurity heads the division and is responsible for aspects of cybersecurity across our infrastructure, which includes cybersecurity architecture and engineering, cybersecurity operations and IT governance risk and compliance. Our Director of Cybersecurity has served in various cybersecurity roles for over 20 years at numerous organizations and consulting firms. Our Director of Cybersecurity earned a Bachelor of Business Administration in Management Information Systems (MIS) from Florida International University and a Master of Business Administration (MBA) in Management from Nova Southeastern University and also holds active cybersecurity certifications including the GIAC Certified Incident Handler (GCIH), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP).


text: Cybersecurity Risk Management and Strategy In order to respond to the threat of security breaches and cyberattacks, we have developed and maintain a cybersecurity risk management program that is designed to protect and preserve the confidentiality, integrity and continued availability of our systems and information. Our cybersecurity risk management program also includes a cybersecurity incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incidents. The maturity of our cybersecurity program is assessed annually. We have developed an internal cybersecurity risk management framework which utilizes industry frameworks and standards, such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF and other security standards, guidelines and best practices within our own framework to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program shares common methodologies, reporting channels and governance processes that apply across our overall enterprise risk assessment to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments and rating platforms that are leveraged to help identify material cybersecurity risks to our critical systems, information, services and our broader enterprise information technology environment; • a cybersecurity team principally responsible for managing our cybersecurity risk assessment processes and our response to cybersecurity incidents through monitoring and identification activities; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • annual cybersecurity awareness training for employees and web and mobile developers, including responsible information security, data security and cybersecurity practices; • a computer incident response team ("CIRT") that leverage our cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents, escalating notifications and reporting requirements to regulatory bodies; and • a third-party risk management process for service providers, suppliers and vendors.


text: We did not identify a material security breach during the year ended December 31, 2024, nor have we identified risks from any known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.


text: Cybersecurity Governance Our board of directors is responsible for risk oversight, including cybersecurity risks, which occurs at the board of directors level and through the Audit Committee's oversight of cybersecurity and other information technology risks. Additionally, we have a Cybersecurity Disclosure Committee ("CDC"), which includes representation from our Information Technology, Legal, Internal Audit and Accounting and Reporting teams. The CDC is responsible for assessing the materiality of cybersecurity incidents based on quantitative and qualitative materiality factors, and for providing recommendations on public disclosures of cybersecurity incidents to the Audit Committee if an incident is identified to be possibly material. The CDC also provides input and consideration into internal controls surrounding cybersecurity along with reviewing cybersecurity risks, mitigation strategies, and ensuring the cybersecurity strategy is in alignment with business objectives.


text: Management's Role Our cybersecurity management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for implementing our overall cybersecurity risk management program, including ongoing monitoring, and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants and professional services providers. Prior to the resignation of our Chief Information Officer ("CIO") in November 2024, the cybersecurity management team was co-led by our CIO and Director of Cybersecurity. Our Director of Cybersecurity currently leads the team and, once we hire a new CIO, we expect that individual will serve as a co-leader.


text: Our Director of Cybersecurity heads the division and is responsible for aspects of cybersecurity across our infrastructure, which includes cybersecurity architecture and engineering, cybersecurity operations, identity governance and IT governance, risk and compliance. Our Director of Cybersecurity has served in various cybersecurity roles for over 20 years at numerous organizations and consulting firms. Our Director of Cybersecurity earned a Bachelor of Business Administration in Management Information Systems (MIS) from Florida International University and a Master of Business Administration (MBA) in Management from Nova Southeastern University and also holds active cybersecurity certifications including the GIAC Certified Incident Handler (GCIH), Certified Information Security Manager (CISM), and Certified Information Systems Security Professional (CISSP).


text: Adient recognizes the critical importance of cybersecurity risk management, strategy, and governance. Adient's focus is protecting its valuable assets and data, ensuring business continuity, and maintaining trust with customers and stakeholders. Adient's cybersecurity risk strategy involves assessing and prioritizing potential threats, implementing robust security controls, maintaining an incident response plan and building plans to restore business capabilities and services, allowing prompt return to normal operations. Continuous monitoring and regular updates are essential to detect and respond to threats in real-time. While providing users with clear guidelines and regular updates, ensuring leadership is informed about potential risks and mitigation strategies, the Adient IT leadership team keeps executives updated on the overall cybersecurity posture and any significant incidents, while maintaining transparency with customers and shareholders.

companyName: Adient plc

ticker: ADNT


text: Adient's IT compliance team conducts regular risk assessments and related testing for software applications, networks and other asset vulnerabilities, including cybersecurity. Adient's internal audit function performs an independent risk assessment, including cyber risks, to determine its annual audit plan. The IT management team also conducts cyber maturity self-assessments at least every two years, whereby risk owners are responsible to further assess and remediate, as applicable. Assessment risks are gauged on their potential impact and likelihood. Adient documents and monitors the efficacy of its strategic interventions designed to minimize these risks, ensuring robust and proactive risk management. Separately, Adient applies a risk-based approach for suppliers, by conducting risk reviews, directing surveys, and requiring adherence to its Global Supplier Standards Manual. Adient's third-party risk assessment process is intended to equip leadership with an objective analysis of security risk for more informed decision making and enhanced organizational resilience.


text: Risk Identification Potential malicious threats are identified through both internal and external resources and tools including, but not limited to, software information and event management software ("SIEM"), endpoint detection ("EDR"), threat intelligence services, network monitoring, and cloud monitoring. In addition, cybersecurity risks identified through external audits, customer audits, third-party monitoring services and industry benchmarking are reviewed for likelihood and impact and addressed accordingly.


text: Adient's cybersecurity strategy is enhanced by the integration of specialized third-party services. These providers offer critical support in pinpointing, evaluating, and managing cybersecurity risks. Adient's suite of external resources includes threat intelligence, risk reduction, surveillance of the dark web, external assessments, scoring services, monitoring of threats and reputation, forensic analysis, cyber insurance, consultative expertise, and legal advice.


text: For the year ended September 30, 2024, Adient did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect Adient's business strategy, results of operations, or financial condition. For further information about the risks associated with cybersecurity incidents, refer to the cybersecurity risk factor in Item 1A, "Risk Factors" in this Form 10-K.


text: Adient's management strategy includes evaluating and deploying tools and technologies for cyber protection and detection, addressing risks according to likelihood and magnitude, performing cybersecurity related tabletops, phishing exercises, engineering and architectural reviews, and penetration tests to simulate incidents, as well as conducting ongoing awareness trainings.


text: In an ever-evolving cybersecurity landscape, Adient has established a dynamic and comprehensive security posture. Adient implements a variety of technical, physical, and organizational measures to mitigate the risks associated with cyber threats. Adient's strategy encompasses an incident response policy with scenario-based playbooks, a detection and response program, and a vulnerability management program. Additionally, Adient maintains disaster recovery and business continuity plans, and conducts regular risk assessments. Systems monitoring and employee awareness training further fortify Adient's defenses. To underscore Adient's commitment to information security, Adient has secured Trusted Information Security Assessment Exchange ("TISAX") certification at multiple international locations, ensuring Adient meets industry recognized benchmarks for protecting data.


text: Adient employs advanced detection tools to continuously track cybersecurity threats and incidents. Upon identifying potential risks, Adient swiftly implements mitigation and remediation measures. Subsequently, pertinent threats are reported by Adient's information security leadership team.


text: Adient follows its cybersecurity incident response policy which outlines roles, identifies incident categories, severity levels, response activities and communication protocols that leverages the National Institute of Standards and Technology ("NIST") Framework.


text: Adient's Board of Directors has delegated cybersecurity risk oversight to the Audit Committee. The Chief Information Officer and information security leadership regularly update the Audit Committee regarding cybersecurity programs, risks and significant incidents. The Board of Directors receives a summary of cybersecurity matters in connection with regular reports from the Audit Committee. Cybersecurity risks are also considered by the Audit Committee and the full Board of Directors as part of the annual enterprise risk management process and the annual internal audit plan, which is reviewed and approved by the Audit Committee.


text: Management Expertise Adient's global information operations security leader has over 30 years of experience in IT with a focus on cybersecurity for the past 25 years, reporting into Adient's Chief Information Officer, who has over 25 years of IT related experience and who further reports into Adient's Executive Vice President of Global IT & Business Services and Sustainability as well as the senior executive team and the Audit Committee and the Board, as necessary.


text: For the year ended September 30, 2025, Adient did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect Adient's business strategy, results of operations, or financial condition. For further information about the risks associated with cybersecurity incidents, refer to the cybersecurity risk factor in Item 1A, "Risk Factors" in this Form 10-K.


text: Management Expertise Adient's global information operations security leader has over 30 years of experience in IT with a focus on cybersecurity for the past 26 years, reporting into Adient's Chief Information Officer, who has over 25 years of IT related experience and who further reports into Adient's Executive Vice President of Global IT & Business Services and Sustainability as well as the senior executive team and the Audit Committee and the Board, as necessary.


text: Risk Management and Strategy We operate a risk-based cybersecurity program dedicated to protecting the confidentiality, integrity and availability of our information systems and the information residing therein.

companyName: YETI Holdings, Inc.

ticker: YETI


text: YETI's cybersecurity program has been integrated into our enterprise risk framework, which identifies, aggregates, and evaluates risks across the enterprise. The enterprise risk framework is integrated with our annual planning, internal audit scoping, and management process. Our internal audit team annually facilitates an enterprise risk assessment with senior management and, through this process, we identify and assess material risks impacting our company and our operations and strategic objectives, which includes information technology and security risks. Management and the Board rank YETI's risks based on their potential impact to YETI's ability to meet our strategic priorities. Management determines appropriate risk responses for each identified enterprise risk. Outside of this annual process, management is responsible for our day-to-day risk management activities.


text: Our Information Technology team (which includes our Director of Cybersecurity) and our Technology Compliance team (which includes our Director of Technology Compliance) have primary responsibility for the implementation of our cybersecurity program and the management of our responses to information technology and security risks, including risks related to cybersecurity threats. Our cybersecurity program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards Technology.


text: We utilize a layered approach in managing and protecting against cybersecurity threats and in detecting and responding to cybersecurity incidents. Although we have numerous practices and processes to protect against common cybersecurity incidents, some attacks or other breaches may still be effective. Such practices and processes are designed to detect, triage and contain these cybersecurity incidents. These controls include: • Identification: In addition to technology-based detection capabilities, there are numerous ways employees can report suspected or actual events, including through our internal information technology ticketing system, by emailing the cybersecurity or privacy team emails, or by submitting a report through the compliance hotline. External parties can also report a vulnerability through the link in the footer of our website. • Technical Safeguards: We leverage outside partnerships to gain intelligence on threats and continue to adjust our protection mechanisms (including firewalls, anti-malware functionality and access controls) to be effective. We have systems in place that are designed to securely receive and store information and to detect, contain, and respond to data security incidents. • Incident Response: We maintain a comprehensive incident response plan to guide our response to a cybersecurity incident. Events are analyzed and categorized into one of four severity tiers and an incident response team is formed (whose membership depends on the nature of the incident). In addition to taking actions to respond to and remediate the incident, the incident response team also considers external notification and disclosure obligations. The incident response plan provides for prompt escalation of certain cybersecurity incidents to a multi-disciplinary committee so that decisions regarding the public disclosure of such incidents can be made in a timely manner. • Testing: We engage in periodic assessment and testing of our policies, processes, and practices that are designed to address cybersecurity threats and incidents. For example, we hire a third party to perform an annual penetration test on our website, internal network, and cloud environments. Our other efforts vary from year to year, but have in the past included an information security maturity assessment, risk assessment, tabletop exercises, and threat modeling. The results of such efforts are reported to the Audit Committee of the Board (the "Audit Committee") and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessment, exercise or review. • Education and Awareness: We have a cybersecurity and information security training and compliance program in place to support our employees and directors. As part of this program YETI employees are subject to reoccurring phishing exercises. The results of these exercises are used to inform the subject matter and frequency of additional training modules that employees are required to complete. In addition, employees annually receive training on data privacy and information security, including cybersecurity. YETI also maintains a number of policies that apply to employees and contractors, including a Global Internal Data Protection and Privacy Policy, an Acceptable Use Policy, and a Password Policy.


text: • Insurance: YETI also maintains a cybersecurity and information security risk insurance policy. • Third Parties: YETI has processes in place to oversee and identify risks from cybersecurity threats associated with third-party vendors. Such processes vary based on factors such as the type of vendor, whether the relationship will implicate our technology, and the type of data involved, if any.


text: To date, we do not believe that known risks from cybersecurity threats, including as a result of any previous cybersecurity incidents that we are aware of, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can give no assurance that we have detected all cybersecurity incidents or cybersecurity threats. Please refer to the risk factor titled "We rely significantly on information technology, and any compromise or interruption of that technology resulting from cybersecurity incidents, data security breaches, design defects or system failures could have a material negative impact on our business" in Part I, Item 1A of this Report for additional information about the risks associated with cybersecurity threats.


text: As part of its oversight function, the Board plays an active role, both as a whole and at the committee level, in overseeing management of YETI's cybersecurity risks. The Audit Committee has primary oversight responsibility for our overall enterprise risk assessment and risk management policies and systems, which includes risks related to our information technology and security systems, processes, and procedures, including risks related to cybersecurity threats. The Audit Committee receives quarterly presentations regarding our enterprise risk management program, including reports from our Director of Cybersecurity, on information security matters (such as cybersecurity risk and developments), as well as the steps management takes to monitor and control such exposures. These presentations address, among other things, the results of the most recent assessment or testing of our security information systems and our cybersecurity measures; the current threat environment; and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. Such quarterly presentations given to the Audit Committee are summarized and shared with the Board at its next meeting by the Audit Committee Chair. Outside of such quarterly presentations, senior leadership would be expected to update the Audit Committee and the Board in real time of incidents deemed material and requiring disclosure in a Securities and Exchange Commission filing or of other "critical" or "high" severity incidents (the highest severity tiers under our incident response plan) that in senior leadership's discretion require more immediate Audit Committee attention. In addition, the internal audit team provides quarterly cybersecurity updates to either the Audit Committee or the full Board regarding our risk analyses, assessments, risk mitigation strategies, and activities. As described above, management is responsible for our day-to-day risk management activities and identifies and manages areas of material risk, which includes information technology and security. Our Chief Financial Officer oversees our Information Technology team, which includes the Director, Cybersecurity. Our Chief Legal Officer oversees our Compliance team, which includes our Director, Technology Compliance. We believe that such cross-departmental involvement promotes a collaborative approach to protecting the Company's information systems from cybersecurity threats, detecting cybersecurity incidents and responding to cybersecurity incidents in accordance with our incident response plan. Through the practices and policies described above, including our incident response plan, our Director, Cybersecurity and Director, Technology Compliance are informed about cybersecurity threats and incidents affecting our information systems and lead the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time. Incidents deemed "critical" or "high" are immediately escalated to the Chief Financial Officer, Chief Legal Officer, other senior leadership, and the Audit Committee.


text: The Director, Cybersecurity has served in various roles in information technology and information security for over 24 years. Prior to joining YETI, he was a principal information security engineer for a global information technology consulting company. The Director, Cybersecurity holds an undergraduate degree in information technology, a master's degree in information systems and technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Systems Auditor. The Director, Technology Compliance has served in various roles in information technology for 11 years, including as a compliance manager for a large software company and information technology consultant for a major consulting firm. The Director, Technology Compliance holds an undergraduate degree in accounting and a master's degree in management information systems and has attained the professional certifications of Certified Information Systems Auditor. Our Chief Legal Officer has over 13 years of experience managing risks, including risks arising from cybersecurity threats, in an officer capacity. Our Chief Financial Officer has 20 years of experience managing risks at large companies.


text: Our Chief Information Officer ("CIO"), Director, Cyber Security (who reports to the CIO) and our Director, Technology Compliance (who ultimately reports to the Chief Legal Officer) have primary responsibility for the implementation of our cybersecurity program and the management of our responses to information technology and security risks, including risks related to cybersecurity threats. Our cybersecurity program has been developed based on industry standards, including those published by the International Organization for Standardization and the National Institute of Standards Technology.


text: We utilize a layered approach in managing and protecting against cybersecurity threats and in detecting and responding to cybersecurity incidents. Although we have numerous practices and processes to protect against common cybersecurity incidents, some attacks or other breaches may still be effective. Such practices and processes are designed to detect, triage and contain these cybersecurity incidents. These controls include: • Identification: In addition to technology-based detection capabilities, there are numerous ways employees can report suspected or actual events, including through our internal information technology ticketing system, by emailing the cybersecurity or privacy team emails, or by submitting a report through the compliance hotline. External parties can also report a vulnerability through the link in the footer of our website. • Technical Safeguards: We leverage outside partnerships to gain intelligence on threats and continue to adjust our protection mechanisms (including firewalls, anti-malware functionality and access controls) to be effective. We have systems in place that are designed to securely receive and store information and to detect, contain, and respond to data security incidents. • Incident Response: We maintain a comprehensive incident response plan to guide our response to a cybersecurity incident. Events are analyzed and categorized into one of four severity tiers and an incident response team is formed (whose membership depends on the nature of the incident). In addition to taking actions to respond to and remediate the incident, the incident response team also considers external notification and disclosure obligations. The incident response plan provides for prompt escalation of certain cybersecurity incidents to a multi-disciplinary committee so that decisions regarding the public disclosure of such incidents can be made in a timely manner. • Testing: We engage in periodic assessment and testing of our policies, processes, and practices that are designed to address cybersecurity threats and incidents. For example, we hire a third party to perform an annual penetration test on our website, internal network, and cloud environments. Our other efforts vary from year to year, but have in the past included an information security maturity assessment, risk assessment, tabletop exercises, and threat modeling. The results of such efforts are reported to the Audit Committee of the Board (the "Audit Committee") and the Board, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessment, exercise or review. • Education and Awareness: We have a cybersecurity and information security training and compliance program in place to support our employees and directors. As part of this program YETI employees are subject to reoccurring phishing exercises. The results of these exercises are used to inform the subject matter and frequency of additional training modules that employees are required to complete. In addition, employees annually receive either reminders or training on data privacy and information security, including cybersecurity. YETI also maintains a number of policies that apply to employees and contractors, including a Global Internal Data Protection and Privacy Policy, an Acceptable Use Policy, and a Password Policy.


text: As part of its oversight function, the Board plays an active role, both as a whole and at the committee level, in overseeing management of YETI's cybersecurity risks. The Audit Committee has primary oversight responsibility for our overall enterprise risk assessment and risk management policies and systems, which includes risks related to our information technology and security systems, processes, and procedures, including risks related to cybersecurity threats. The Audit Committee receives quarterly presentations regarding our enterprise risk management program, including reports from our CIO and Director, Cyber Security, on information security matters (such as cybersecurity risk and developments), as well as the steps management takes to monitor and control such exposures. These presentations address, among other things, the results of the most recent assessment or testing of our security information systems and our cybersecurity measures; the current threat environment; and cybersecurity trends and best practices. As applicable, these quarterly presentations also include reports of cybersecurity incidents affecting our information systems along with updates on the status of prior cybersecurity incidents and applicable remediation efforts. Such quarterly presentations given to the Audit Committee are summarized and shared with the Board at its next meeting by the Audit Committee Chair. Outside of such quarterly presentations, senior leadership would be expected to update the Audit Committee and the Board in real time of incidents deemed material and requiring disclosure in a Securities and Exchange Commission filing or of other "critical" or "high" severity incidents (the highest severity tiers under our incident response plan) that in senior leadership's discretion require more immediate Audit Committee attention. In addition, the internal audit team provides quarterly cybersecurity updates to either the Audit Committee or the full Board regarding our risk analyses, assessments, risk mitigation strategies, and activities. As described above, management is responsible for our day-to-day risk management activities and identifies and manages areas of material risk, which includes information technology and security. Our CIO, who reports to our Chief Financial Officer, oversees our Information Technology and Cybersecurity teams, including the Director, Cyber Security. Our Chief Legal Officer oversees our Compliance team, which includes our Director, Technology Compliance. We believe that such cross-departmental involvement promotes a collaborative approach to protecting the Company's information systems from cybersecurity threats, detecting cybersecurity incidents and responding to cybersecurity incidents in accordance with our incident response plan. Through the practices and policies described above, including our incident response plan, our CIO, Director, Cyber Security and Director, Technology Compliance are informed about cybersecurity threats and incidents affecting our information systems and lead the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in real time. Incidents deemed "critical" or "high" are immediately escalated to the Chief Financial Officer, Chief Legal Officer, other senior leadership, and the Audit Committee.


text: Our CIO has served in various executive leadership roles for over 10 years and has over 30 years of experience in technology. Prior to joining YETI, he was the Senior Vice President of Consumer Technologies at a large publicly traded cosmetics company. The CIO holds a Masters of Business Administration. Our Director, Cyber Security has served in various roles in information technology and information security for over 25 years. Prior to joining YETI, he was a principal information security engineer for a global information technology consulting company. Our Director, Cyber Security holds an undergraduate degree in information technology, a master's degree in information systems and technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Systems Auditor. Our Director, Technology Compliance has served in various roles in information technology for 12 years, including as a compliance manager for a large software company and information technology consultant for a major consulting firm. Our Director, Technology Compliance holds an undergraduate degree in accounting and a master's degree in management information systems and has attained the professional certifications of Certified Information Systems Auditor. Our Chief Legal Officer has over 14 years of experience managing risks, including risks arising from cybersecurity threats, in an officer capacity. Our Chief Financial Officer has 20 years of experience managing risks at large companies.


text: Risk Management and Strategy Risk is an inherent component of the Company's strategic activities and operating environment. The ability to effectively identify, assess, measure, respond, monitor, and report on risks is critical to the achievement of the Company's mission and strategic objectives. Cybersecurity risk, including the risk of managing cybersecurity threats, is a key risk integrated into our enterprise risk management ("ERM") program and processes. In addition to cybersecurity risk being included in our annual enterprise risk assessment process, other cybersecurity-related risk assessments, such as threat and vulnerability assessments, are performed regularly. Cybersecurity risk is also considered in the Company's annual fraud risk assessment.

companyName: NeueHealth, Inc.

ticker: NEUE


text: Annually, the Company completes a National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") maturity assessment to identify and evaluate the areas of strength and opportunities for improvement. These maturity assessments, which are performed leveraging independent third-party advisors or through self-assessments, evaluate the organization's cyber maturity based on predefined standards and criteria (e.g., NIST Special Publication (SP) 800-66). Results of these assessments commonly set the roadmap for future cybersecurity improvement initiatives.


text: Additionally, for third party vendors providing services to the Company, a security risk assessment is completed during vendor due diligence, before execution of agreements. The assessment evaluates, among other areas, the vendors' data security, access identity, endpoint protection and incident management and response capabilities. Vendors are required to either complete a security questionnaire based on the HIPAA Security Rule requirements or provide evidence of a current Service Organization Control report completed by a third-party, Health Information Trust Alliance certification, or similar security and compliance attestation. These risk assessments are refreshed regularly during the duration of an agreement with the vendor, and the results can be used to influence the vendor to make improvements where weaknesses in their security and compliance measures are identified.


text: Board of Directors The Board of Directors has direct responsibility for the risk profile of the Company, as defined by the requirements of the shareholders. Inherently included in the Company's risk profile is the risk of cybersecurity threats. The Audit Committee of the Board of Directors has been delegated the responsibility to oversee the management of risks for the Company, including those pertaining to cybersecurity. The Audit Committee is responsible for: • Providing oversight of risks, including but not limited to finance, operations, information technology and information security, privacy, legal and regulatory. • Meeting periodically with management to review the Company's significant risks and the steps management has taken to monitor, control or mitigate such risks. • Reviewing required disclosures pertaining to risks.


text: Cybersecurity risk is a standing agenda topic at quarterly Audit Committee meetings. Common topics discussed include, but are not limited to, cybersecurity risks, threats and vulnerabilities, and the related monitoring activities, as well as progress made with the Company's information security roadmap. The Audit Committee is apprised of the results of cybersecurity risk assessment and prevention/detection activities (e.g., vulnerability scanning, penetration testing, security awareness training) as well as any changes to cybersecurity laws and regulations, current leading practices, and the changing threat landscape.


text: Annually, the results of the Company's enterprise risk assessment are presented to the Audit Committee. These results include a discussion on the top enterprise risks (including, when appropriate, cybersecurity risk) identified through the enterprise risk assessment process, controls in place to address the risks, as well as the mitigation plans management will take to address any uncontrolled risks.


text: Following most Audit Committee meetings, the Chair of the Audit Committee provides an update to the full Board of Directors at the Board's next regularly scheduled meeting. It is through this update where the Board of Directors would be apprised of any material risks or threats, including those pertaining to cybersecurity matters.


text: Management of risks, including risks of cybersecurity threats, is delegated to the Company's Head of Information Security, who reports administratively to the Chief Information Officer and has informal reporting relationships with the General Counsel and Chief Audit Executive. The Head of Information Security has over 30 years of information technology and security experience with assessing and managing cybersecurity threats and is responsible for the day-to-day information security program objectives. The Head of Information Security is also responsible for attending quarterly Audit Committee meetings and reporting results of the cybersecurity program to the Audit Committee, including results of preventative activities (e.g. endpoint protection, security training), ongoing monitoring activities (e.g., vulnerability testing), and remediation activities (e.g., issues identified through audits and assessment activities).


text: The Head of Information Security utilizes various tools and resources to manage and monitor cybersecurity threats, vulnerabilities, and incidents, most of which are delivered through third-party solutions. Examples include, but are not limited to: • Endpoint and network device vulnerability identification and scanning • Internal and external penetration testing services with an emphasis on on-premise and cloud security • Security training and awareness, with an emphasis on phishing threats • Third-party security risk assessments • NIST CSF assessment tools • Security information and event management for monitoring infrastructure events.


text: The Company's enterprise threat and vulnerability identification and detection capabilities operate on an ongoing basis, with results reported to Information Security daily. The capabilities utilize endpoint sensors and network scanning to meet and maintain leading bad actor tactics and techniques, including machine learning and artificial intelligence, to protect against potential malicious threats or other potentially unwanted programs or identity abuse, including privilege escalation or abuse of least privilege access enforced by the Company. The information gathered by the Head of Information Security through these activities, through assessment results provided by cybersecurity consultants or advisors, as well as through gathering cyber-risk landscape insights from various other third-party sources, informs the Company's assessment of the risk of cybersecurity threats.


text: Finally, the Company's Disclosure Committee is responsible for assisting the CEO, CFO and Audit Committee to prepare SEC-required disclosures, confirming the Company's disclosure controls and procedures are properly implemented and asserting the accurate, complete, timely and fair presentation of public disclosures. The Disclosure Committee is comprised of the Company's CFO, Chief Accounting Officer, General Counsel, Chief Audit Executive, Head of Information Security, and senior members of our external reporting, financial planning and analysis, and tax departments. The Disclosure Committee meets quarterly prior to the issuance of required quarterly SEC filings, and in these meetings relevant cybersecurity risks would be discussed.


text: Based on the Company's most recent assessments of cybersecurity risk, as of the date of this Form 10-K, we are not aware of any risk from cybersecurity threats that has caused or is reasonably likely to cause a material effect on the Company's business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, see the cybersecurity risk factor under the caption "Risks Related to our Intellectual Property, Information Technology, and Data Privacy" included in Part I, Item 1A. - Risk Factors" in this Form 10-K.


text: Management of risks, including risks of cybersecurity threats, is delegated to the Company's Associate Vice President (AVP) of IT Infrastructure and Security. This leader reports administratively to the Vice President of Technology and has informal reporting relationships with the General Counsel and Chief Audit Executive. The AVP of IT Infrastructure and Security has over 25 years of information technology and security experience and are responsible for the day-to-day information security program objectives. They are also responsible for attending quarterly Audit Committee meetings and reporting results of the cybersecurity program to the Audit Committee, including results of preventative activities (e.g. endpoint protection, security training), ongoing monitoring activities (e.g., vulnerability testing), and remediation activities (e.g., issues identified through audits and assessment activities).


text: The Information Security team utilizes various tools and resources to manage and monitor cybersecurity threats, vulnerabilities, and incidents, most of which are delivered through third-party managed services and/or solutions. Examples include, but are not limited to: • Endpoint and network device vulnerability identification and scanning • Internal and external penetration testing services with an emphasis on on-premise and cloud security • Security training and awareness, with an emphasis on phishing threats • Third-party security risk assessments • NIST CSF assessment tools • Security information and event management for monitoring infrastructure events.


text: The Company's enterprise threat and vulnerability identification and detection capabilities operate on an ongoing basis, with results reported weekly. The capabilities utilize endpoint sensors and network scanning to meet and maintain leading bad actor tactics and techniques, including machine learning and artificial intelligence, to protect against potential malicious threats or other potentially unwanted programs or identity abuse, including privilege escalation or abuse of least privilege access enforced by the Company.


text: Finally, the Company's Disclosure Committee is responsible for assisting the CEO, CFO and Audit Committee to prepare SEC-required disclosures, confirming the Company's disclosure controls and procedures are properly implemented and asserting the complete, accurate, timely and fair presentation of public disclosures. The Disclosure Committee is comprised of the Company's CFO, Chief Accounting Officer, General Counsel, Chief Audit Executive, AVP of IT Infrastructure and Security, and senior members of our external reporting, financial planning and analysis, and tax departments. The Disclosure Committee meets quarterly prior to the issuance of required quarterly SEC filings, and in these meetings relevant cybersecurity risks would be discussed.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and our clinical trial and related data, which we refer to as Information Systems and Data.

companyName: Immunocore Holdings plc

ticker: IMCR


text: Our information security function, which is led by our Chief Information Officer ("CIO"), helps identify, assess and manage our cybersecurity threats and risks, including through the use of our risk register. The information security function identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, for example, manual tools and automated tools, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating certain threats reported to us, internal and external audits, leveraging third party threat assessments, and conducting vulnerabilities assessments.


text: Depending on the environment or system, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an information security policy, access management procedures, data back-up and restoration policy, cyberattack response procedure, network security controls, data segregation for certain data, encryption of certain data, access controls, physical controls, systems monitoring, penetration testing, employee training, and cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of our enterprise risk management program and identified in our risk register.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example cybersecurity consultants, cybersecurity service providers, and penetration testing services.


text: We also use third-party service providers to perform a variety of functions throughout our business, such as contract research organizations, contract manufacturing organizations, and other distributors, including those who process clinical trial data on our behalf. Depending on the nature of the services provided, the sensitivity of the critical systems, information and assets at issue, and the identity of the provider, our third-party risk management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider, including, for example, a review of security assessments and imposition of contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report, including "If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations and actions litigation fines and penalties disruptions to our business operations reputational harm loss of revenue and profits loss of customers and sales and other adverse consequences."


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit and compliance committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain members of our management, including our CIO, who has over 15 years of experience in IT management. Our CIO reports directly to our leadership team and provides regular reports.


text: Our CIO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our CIO is also responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Chief Executive Officer. Our Chief Executive Officer and other leadership personnel work with our incident response team to help mitigate and remediate cybersecurity incidents of which they are notified, in addition to notifying the audit and compliance committee of the board of directors, as appropriate.


text: The board of directors' audit and compliance committee receives periodic reports from our CIO concerning significant cybersecurity threats and risk and the processes we have implemented to address them. The audit and compliance committee also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Risk Management and Strategy Management has implemented a program to protect the confidentiality, integrity and availability of our information systems and to identify, assess, manage and report on material risks from cybersecurity threats. The program is managed by an in-house cybersecurity team, and the program includes risk management and mitigation processes, such as malware protection, access management, technical vulnerability management and security incident response among other processes and technical safeguards; communication with third-party providers of services regarding their information security practices and disclosed cybersecurity incidents; the use of third-party service providers, as appropriate, for monitoring and mitigating cybersecurity threats and conducting penetration tests; education and training across the organization to mitigate cybersecurity threats to employees and our company; the maintenance of cybersecurity breach insurance; and disaster recovery and business continuity arrangements to minimize the potential impact to our operations in the event of a cybersecurity incident.

companyName: Trade Desk, Inc.

ticker: TTD


text: The cybersecurity program is aligned with our enterprise risk framework. Members of our cybersecurity, enterprise risk management, finance and legal teams collaboratively assess the degree of risk to our business and operations from cybersecurity threats and incidents to develop incident response plans and risk mitigation practices. Risk is assessed across the potential technological, operational, financial, legal, regulatory and reputational impacts to our company, including the materiality of cybersecurity incidents pursuant to SEC disclosure rules.


text: Although we follow guidance from various standards related to cybersecurity and engage third-party attestation services to test controls relevant to our business, this does not imply that we meet any particular technical standards, specifications or requirements.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition or results of operations. However, we remain subject to unknown or future cybersecurity threats that could materially affect us, including our business strategy, financial condition or results of operations. See "Item 1A. Risk Factors" for a discussion of various risks related to cybersecurity.


text: Our board of directors has delegated oversight of all risk assessment and risk management activities to the audit committee. The audit committee provides strategic oversight of management's risk management practices, including cybersecurity. Regular and ad hoc reporting from management, such as the executive risk committee (as described below), to the audit committee may include information about the prevention, detection, mitigation and remediation of material cybersecurity incidents, if any.


text: Our executive risk committee, which is comprised of our Chief Financial Officer, Chief Legal Officer and Senior Vice President, Technology, oversees the cybersecurity risk assessment and mitigation activities and receives regular reports from our cybersecurity team regarding the nature, timing and extent of incidents that occur across the Company's internal environments and those disclosed by third-party service providers, if applicable. Our cybersecurity team is comprised of technically skilled professionals with computer science, cybersecurity assurance or other cybersecurity degrees and professional experience in monitoring, detecting, mitigating and preventing cybersecurity incidents and testing cybersecurity processes. The executive risk committee has expertise in the pertinent financial, legal, regulatory, operational and technical areas to assess the impact of cybersecurity risks and incidents across the business and oversee our response to and disclosure of such incidents. In particular, our Senior Vice President, Technology brings decades of technical experience to our executive risk committee along with technical education in computer engineering.


text: The cybersecurity program is aligned with our enterprise risk framework. Members of our cybersecurity, enterprise risk management, engineering, finance and legal teams collaboratively assess the degree of risk to our business and operations from cybersecurity threats and incidents to develop incident response plans and risk mitigation practices. Risk is assessed across the potential technological, operational, financial, legal, regulatory and reputational impacts to our company, including the materiality of cybersecurity incidents pursuant to SEC disclosure rules.


text: We have not identified risks from known cybersecurity threats, including as a result of prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, financial condition or results of operations. However, we remain subject to unknown or future cybersecurity threats that could materially affect us, including our business strategy, financial condition or results of operations. See "Item 1A. Risk Factors" for a discussion of various risks related to cybersecurity.


text: Our executive risk committee, which is comprised of our Chief Financial Officer, Chief Legal Officer and Senior Vice President, Engineering Operations, oversees the cybersecurity risk assessment and mitigation activities and receives regular reports from our cybersecurity team regarding the nature, timing and extent of incidents that occur across the Company's internal environments and those disclosed by third-party service providers, if applicable. Our cybersecurity team is comprised of technically skilled professionals with computer science, cybersecurity assurance or other cybersecurity degrees and professional experience in monitoring, detecting, mitigating and preventing cybersecurity incidents and testing cybersecurity processes. The executive risk committee has expertise in the pertinent financial, legal, regulatory, operational and technical areas to assess the impact of cybersecurity risks and incidents across the business and oversee our response to and disclosure of such incidents. In particular, our Senior Vice President, Engineering Operations brings decades of technical experience to our executive risk committee along with technical education in computer engineering.


text: To more effectively prevent, detect and respond to cyber and information security threats, we maintain a global cyber security risk management program designed to identify, assess, and manage material risks from cybersecurity threats. Our risk management program is supervised by a dedicated Senior Director of Cyber & Information Security (the "SDCIS"), who has more than 30 years of experience in cybersecurity and information technology in both private industry and the United States Air Force. The SDCIS is responsible for leading an enterprise-wide cyber security strategy, policy, standards, architecture and processes. The SDCIS reports directly to our Executive Vice President and Chief Technology and Digital Officer (the "CTDO"). For information regarding the relevant expertise and qualifications of our CTDO, see "Information About Our Executive Officers" included in Part I of this report. The cyber risk management program is based on a leading cyber risk controls framework and includes periodic maturity and risk assessments.

companyName: Acushnet Holdings Corp.

ticker: GOLF


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. The Audit Committee has responsibility for overseeing our cyber and information security program, which institutes and maintains controls for our systems, applications, and databases and for our third-party providers. The Audit Committee receives quarterly updates on the status of the cyber risk management program from the CTDO which include, among other things, a review of a dynamic and emerging cyber threat landscape, security events of note, updates on cyber risks and threats and the status of projects to strengthen and mature our cyber and information security program. Additionally, the SDCIS chairs the Cybersecurity Risk Committee, which seeks to drive awareness, ownership and alignment across broad governance and risk stakeholder groups for enhanced effectiveness of cybersecurity risk management and reporting. Members of senior management also discuss cybersecurity developments with the CTDO and SDCIS between meetings. Top identified cyber risks, metrics and measures of the effectiveness of the cyber risk management program are reviewed quarterly at the Cybersecurity Risk Committee and Company Risk Management Committee. Our Board also receives periodic updates from the CTDO and the SDCIS relating to cyber and information security risks.


text: We annually engage third parties (as well as our own internal audit department) to audit our cyber and information security programs, processes and controls, and the findings of these parties are reported to the Audit Committee and the full Board. These audits also include annual penetration testing and web application assessments by third parties to test control effectiveness against threat actor attack techniques.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers. We oversee third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring. Vendors are assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, penetration test and policy reviews, and scans or other technical evaluations. We also partner and actively engage with key vendors and industry participants to share intelligence, best practices and benchmarking data with other member organizations of the Retail and Hospitality Information Sharing and Analysis Center, which aims to help its members improve their security posture and resilience against cyber-attacks.


text: We maintain a Cyber and Data Security Incident Response Plan to more effectively respond to cyber and information security events. Periodically, we conduct a cybersecurity incident response tabletop exercise to test response actions of the Security Incident Response Team, to facilitate group discussions regarding the effectiveness of our cybersecurity incident response strategies and tactics and to update the plan with any lessons learned from the exercise.


text: Our Security Awareness Program includes training that reinforces cybersecurity risk management policies, standards and practices, as well as the expectation that employees comply with these policies. The Security Awareness Program also trains personnel on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all relevant employees globally on a periodic basis, and it is supplemented by firmwide testing initiatives, including quarterly phishing tests. We provide specialized security training for certain employees such as application developers, human resources and finance teams. Finally, our Global Privacy Program requires all relevant employees to take periodic awareness training on data privacy. This privacy-focused training includes information about the relevant laws, confidentiality and security, as well as how to effectively report and respond to unauthorized access to or use of personal information.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. For more information about the cybersecurity risks we face, see the risk factor in Item 1A entitled "We rely on complex information systems for management of our manufacturing, distribution, sales and other functions. If our information systems fail to perform these functions adequately or if we experience an interruption in our operations, including a breach in cybersecurity, our business, financial condition and results of operations could be materially adversely affected."


text: To more effectively prevent, detect and respond to cyber and information security threats, we maintain a global cyber security risk management program designed to identify, assess, and manage material risks from cybersecurity threats and to protect the security, confidentiality, integrity and availability of our critical information technology systems and information. Our cybersecurity risk management program is supervised by a dedicated Senior Director of Cyber & Information Security (the "SDCIS"), who has more than 30 years of experience in cybersecurity and information technology in both private industry and the United States Air Force. The SDCIS is responsible for leading an enterprise-wide cyber security strategy, policy, standards, architecture and processes. The SDCIS reports directly to our Executive Vice President and Chief Technology and Digital Officer (the "CTDO"). For information regarding the relevant expertise and qualifications of our CTDO, see "Information About Our Executive Officers" included in Part I of this report. The cyber risk management program is based on a leading cyber risk controls framework and includes periodic maturity and risk assessments.


text: Our b oard of directors has established oversight mechanisms to manage risks from cybersecurity threats. The Audit Committee has responsibility for overseeing our cyber and information security program, which institutes and maintains controls for our systems, applications, and databases and for our third-party providers. The Audit Committee receives quarterly updates on the status of the cyber risk management program from the CTDO which include, among other things, a review of a dynamic and emerging cyber threat landscape, security events of note, updates on cyber risks and threats and the status of projects to strengthen and mature our cyber and information security program. Additionally, the SDCIS chairs the Cybersecurity Risk Committee, which seeks to drive awareness, ownership and alignment across broad governance and risk stakeholder groups for enhanced effectiveness of cybersecurity risk management and reporting. Members of senior management also discuss cybersecurity developments with the CTDO and SDCIS between meetings. Top identified cyber risks, metrics and measures of the effectiveness of the cyber risk management program are reviewed quarterly at the Cybersecurity Risk Committee and Company Risk Management Committee. Our Board also receives periodic updates from the CTDO and the SDCIS relating to cyber and information security risks.


text: As of the date of this report, we have not experienced any current or past cybersecurity incidents that resulted in a material effect on our business strategy, results of operations or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. For more information about the cybersecurity risks we face, see the risk factor in Item 1A entitled "We rely on complex information systems to manage our manufacturing, distribution, sales and other functions. If our information systems fail to perform these functions adequately or if we experience an interruption in our operations, including a breach in cybersecurity, our business, financial condition and results of operations could be materially adversely affected."


text: Risk Management and Strategy We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management system and processes. Our cybersecurity risk management processes include the following: a. We leverage the National Institute of Standards and Technology ("NIST") framework to help ensure the Company's risk posture remains in alignment with the Company's overall risk appetite.

companyName: JELD-WEN Holding, Inc.

ticker: JELD


text: b. The Company utilizes policies, software, training programs, hardware solutions and managed services to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity and access management systems and 24x7 security operations center.


text: c. The Company's approach to managing cybersecurity and digital risk is led by our CIO and CISO. Our CIO is supported by the Company at the highest levels and regularly engages with cross-functional teams at the Company, including Legal, Audit, Finance, Human Resources and Enterprise Risk Management.


text: d. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident. Such insurance may be insufficient to cover all losses or all types of claims that may arise.


text: e. Our cybersecurity team conducts semi-annual cyber awareness training for professional associates using an independent third-party security training provider to educate best practices, policies and responsibilities pertaining to cybersecurity. We also conduct quarterly simulated phishing tests to generate awareness and run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our practices, procedures and technologies.


text: f. Our cybersecurity incident response plan coordinates the activities we take to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, communicate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: g. Our cybersecurity team regularly conduct tests of our information security environment and controls through vulnerability scanning, penetration testing and attack simulation testing.


text: Additionally, our cybersecurity risk management processes include review and assessment by external, independent third parties, who assess the maturity of our cybersecurity program and identify areas for continued focus and improvement. Furthermore, our Legal Department advises the Board about best practices for cybersecurity oversight by the Board, and the evolution of that oversight over time.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. Our cybersecurity team conducts third-party software security reviews for new software products being implemented into our production environments. The Company also has a third-party risk management process that regularly assesses and monitors risks, including cybersecurity, from vendors and suppliers.


text: See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for information on cybersecurity risks that may materially affect our business strategy, results of operations and financial condition.


text: The cybersecurity risk management processes described above are led by our CIO and CISO, each having more than 25 years of information security experience. Our Board, Audit Committee, senior management and the Enterprise Risk Management Committee (a management committee of senior representatives from corporate functions and business lines) devote resources to cybersecurity and risk management processes. The Audit Committee is primarily responsible for the oversight of enterprise risk management and cybersecurity risks, including cybersecurity threats. To fulfill this responsibility, the Audit Committee receives periodic reports from the CIO. These reports include information regarding updates on cybersecurity initiatives, cybersecurity metrics, such as phishing results and attack volume metrics, results of any assessments performed by internal stakeholders or external third-party advisors and updates on cybersecurity trends and insights. The CIO provides a cybersecurity update to the full Board at least annually.


text: Risk Management and Strategy We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management system and processes. To that end, we regularly monitor the need and implementation of enhancements to security infrastructure, legacy system replacement, emerging technology risk assessment and security integration.


text: Our cybersecurity risk management processes include the following: a. We leverage the NIST framework to help ensure the Company's risk posture remains in alignment with the Company's overall risk appetite.


text: b. The Company utilizes policies, software, training programs, hardware solutions and managed services to protect and monitor our environment, including multifactor authentication on all critical systems, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity and access management systems, cloud security controls and monitoring, data backup and recovery systems and 24x7 security operations center.


text: e. Our cybersecurity team conducts routine cyber awareness training for professional associates using an independent third-party security training provider to educate best practices, policies and responsibilities pertaining to cybersecurity. We also conduct periodic simulated phishing tests to generate awareness and run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our practices, procedures and technologies.


text: g. Our cybersecurity team regularly conducts tests of our information security environment and controls through vulnerability scanning, penetration testing and attack simulation testing.


text: Our cybersecurity risk management processes extend to the oversight and identification of threats associated with our use of third-party service providers. Our cybersecurity team conducts third-party software security reviews for new software products being implemented into our production environments. We also have a third-party risk management process that regularly assesses and monitors risks, including cybersecurity, from vendors and suppliers.


text: As of the date of this Form 10-K, we do not believe any risk from any cybersecurity threats or incidents have had, or are reasonably likely to have, a material impact on us; however, there is no guarantee that a future cybersecurity threat or incident will be detected and remediated to not have a material adverse impact on our business, results of operations and financial condition. Refer to Item 1A - Risk Factors of this Form 10-K for information on cybersecurity risks that may materially affect our business, results of operations and financial condition.