text: The Board of Directors is responsible for overseeing the Company's cybersecurity program. The Board of Directors has established oversight mechanisms that are intended to promote effective governance in managing risks associated with cybersecurity threats because it recognizes the significance of these threats to the Company's operational integrity and the information stored on the Company's information systems or those of third-party service providers. See "—Governance— Board of Directors Oversight."


text: Engage Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts from time to time, including cybersecurity assessors, risk management professionals, and other consultants, in evaluating and testing our risk management systems. We also engage third-party services on an ongoing basis to conduct independent audits of our risk management systems. These engagements enable us to leverage specialized knowledge and insights and assist the Company with its goal of maintaining cybersecurity strategies and processes that are consistent with industry best practices. Our collaboration with these third-parties includes table top exercises, penetration testing and other cyber-support services.

companyName: Metropolitan Bank Holding Corp.

ticker: MCB

secItem: Item 1C


text: Oversee Third-party Risk Because the Company is aware of the risks associated with third-party service providers, the Company has implemented policies and processes to oversee and assist with managing these risks. The Company's Third-Party Risk Management Officer (the "TPRM") conducts security and risk assessments of all third-party providers before engagement and monitors these third-party providers on an ongoing basis to assess each provider's compliance with the Company's cybersecurity standards, which are intended to be commensurate with the level of risk and complexity of the relationship with, and the activities performed by, a given provider engaged by the Company. In addition, the TPRM conducts an annual risk assessment of any third-party provider that provides critical services to the Company or has access to customers' protected data. This approach is designed to help identify and mitigate risks related to data breaches or other cybersecurity incidents originating from third-parties in order to better protect our customers' personally identifiable information and the Company's assets and data.


text: Risks from Cybersecurity Threats We have not encountered cybersecurity threats or incidents that have materially and adversely affected, or are reasonably likely to materially and adversely affect, the Company's business strategy, results of operations or financial condition. Notwithstanding the defensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats, incidents or disruptions may not be fully insured. For more information regarding the risks we face from cybersecurity threats, see Part I, Item 1A., "Risk Factors— Risks Related to the Company's Operations—A failure in the Company's operation and/or information systems or infrastructure, or those of third parties, including cyber-attacks, could impair the Company's liquidity, disrupt its businesses, result in the unauthorized disclosure of confidential information, damage its reputation, and cause financial losses."


text: Board of Directors Oversight Our information security program is designed to ensure adequate governance, and oversight is in place while evolving to meet changes in applicable laws and regulations, and industry best practices. Cybersecurity is a significant risk to the enterprise and matters related to information security are regularly featured as part of management's enterprise risk profile updates to the Risk Committee of the Board of Directors (the " Risk Committee "), which occur at least on a quarterly basis. The Chair of the Risk Committee reports to the Board of Directors on the committee's proceedings and activities, including in connection with the committee's deliberation on information security matters, on a regular basis. In addition to regular touchpoints on cyber matters at the Risk Committee, the Board of Directors receives briefings from the Bank's Chief Information Security Officer (the "CISO") semi-annually.


text: The Board of Directors directly, and through its standing committees (particularly the Risk Committee and the Audit Committee of the Board of Directors) also engage in broader discussions regarding existing and emerging operational and technology risks with members of management across all lines of defense. To supplement the Board of Directors' regular engagement regarding the Company's information security program, the director education program includes cybersecurity-related training opportunities, which assists the directors in staying current on developments and maintaining appropriate knowledge regarding the evolving cybersecurity and threat landscape.


text: Reporting to Board of Directors The CISO provides management, the Risk Committee and the Board of Directors with information regarding the Company's cybersecurity program and potential cybersecurity threats or incidents. In addition, the CISO is empowered to escalate material cybersecurity threats or incidents and strategic risk management decisions to the Board of Directors so that they can provide appropriate oversight and guidance on these critical cybersecurity issues within the context of the Company's overall strategic objectives and business operations. Management, the Company's Chief Digital Officer (the "CDO"), the CRO, and the Incident Management Team (the "IMT") are also required to report cybersecurity threats and incidents to the Risk Committee and/or the Board of Directors, as applicable.


text: Management's Role Managing Risk The Company's Enterprise Risk Management Committee (the "ERMC"), an interdepartmental, management-level committee, meets at least quarterly and is responsible for ensuring that the Company has appropriate policies and procedures in place to help identify, measure, monitor and control potentially significant business risks. In connection with these responsibilities, the ERMC receives quarterly risk and control self-assessments and action plans for risk remediation, if required, to reduce residual risks. This includes information security action plans from the CISO, the CDO, and/or other key stakeholders. The incorporation of these reports into the ERMC's meetings is intended to promote the inclusion of cybersecurity considerations in the risk management decision-making processes throughout the Company.


text: The Information Technology/Information Security Steering Committee (the "IT Steering Committee") reports directly into the ERMC and meets at least quarterly. The IT Steering Committee is composed of senior members of management, including the CDO, the CRO and the CISO. The IT Steering Committee oversees information technology matters at the Company, including the implementation of all cybersecurity policies, standards, guidelines and procedures. The responsibilities of the IT Steering Committee include, among other things, updating the Company's information technology policies, reviewing the architecture of the Company's information system infrastructure and monitoring the progress of any significant hardware or software updates or installation. In addition, the IT Steering Committee provides quarterly reports to the ERMC and the Risk Committee regarding any information-technology-related matters that, in the opinion of the IT Steering Committee, should be escalated.


text: The CISO plays an important role in the prevention, detection, mitigation, and remediation of cybersecurity incidents and in informing management, the Risk Committee and the Board of Directors on cybersecurity risks and issues. The CISO provides quarterly briefings to the Risk Committee on any significant information security issues, relevant cybersecurity metrics and the status of the Company's security-related strategic initiatives. As discussed above, the CISO also provides mid-year and annual reports to the full Board of Directors regarding the state of the Company's information security program. The annual reports encompass a broad range of topics, including: Confidentiality of nonpublic information and the integrity and security of the Company's information systems; Cybersecurity policies and procedures; Material cybersecurity risks;


text: Any material cybersecurity incidents. In addition to these scheduled meetings, the Risk Committee, the CISO, the CDO, the CRO, and other members of management maintain ongoing dialogues with respect to emerging or potential cybersecurity threats. The Risk Committee also receives reports and updates from management regarding significant cybersecurity developments so that the Board of Directors can be promptly notified, as and when appropriate, of any threats or incidents as well as management's proposed responses.


text: Risk Management Personnel The Company's CISO has extensive experience in the field of cybersecurity and is responsible for managing the Company's cybersecurity risks and ensuring that the Company's security posture is aligned with its business objectives. Our CISO's technical and business experience is helpful for developing and executing our cybersecurity strategies. The CISO helps to oversee the Company's information security policies and programs, perform risk and vulnerability assessments of the Company's information systems, and coordinate responses to cybersecurity incidents in conjunction with the CDO, the Company's Incident Response Team (the "IRT"), the IMT and management.


text: The Company's CDO has extensive experience in establishing and maintaining scalable and secure technology systems and is responsible for maintaining the Company's various digital platforms. Our CDO worked in various systems, information technology and digital managerial roles at a global financial and investment firm prior to joining the Company. Our CDO's technical and managerial experience is helpful for developing and executing our cybersecurity strategies. The CDO helps to oversee the Company's efforts to improve its system's capabilities, reliability, scalability and security.


text: The Company's CRO is responsible for identifying, controlling and mitigating risks that could impact the Company's operations. Our CRO's decades of experience managing the various risks faced by financial institutions is helpful for developing and executing our cybersecurity strategies in a manner that is aligned with the overall risk management framework of the Company.


text: If the Company is notified of a cybersecurity incident affecting the Company's information systems, either by an employee, our defensive infrastructure, a regular system audit or another mechanism, the IRT, led by the CDO, will perform the technical functions required to analyze and contain such an incident, including, but not limited to, technical triage, in-depth analysis, technical mitigation and any necessary recovery actions. The IMT will be activated by the CISO, the CRO or another member of the team to assist in the response and evaluate the cybersecurity threat and coordinate the business decisions necessary to limit the impact of the cybersecurity incident during and after the response. The IMT will also perform similar functions if we detect or are alerted to a cybersecurity threat or incident involving a third-party service provider.


text: The Company's Network and Cloud Administration is led by the CDO and is also responsible for managing security infrastructure and deploying, configuring, and managing various security solutions, tools and products to assist in safeguarding the Company's information system infrastructure and operations.


text: Monitor Cybersecurity Incidents The IT Steering Committee, which is a subcommittee of the ERMC, established the Information Technology and Information Security Working Group (the "IT/IS Working Group"), which is comprised of the CDO, the Head of Information Technology Infrastructure, the CISO, the Information Security Officer, the Information Security Assurance Program Manager and certain other members of the Company's information technology engineering staff. The mission of the IT/IS Working Group is to foster the sharing of information among departments regarding existing and emerging threats and risks related to cybersecurity and related compliance issues in order to better integrate cybersecurity risk management and increase awareness of cybersecurity threats throughout the Company. This group meets on a weekly basis to discuss, among other things, vulnerability management, threat and risk analysis and the status of our continued enhancements to the Company's information security infrastructure that are intended to further manage and mitigate future risks.


text: The CISO implements and oversees policies and processes for the regular monitoring of our information systems. This includes the deployment of additional security measures, including defensive infrastructure, and regular system audits to identify potential vulnerabilities. If the CISO, the IRT and/or management believe a cybersecurity incident is potentially material, the CISO, the CRO or another member of the team can convene the IMT to further assist in the Company's remediation and response efforts. Following the remediation of the cybersecurity incident, the IRT and/or IMT will review the effectiveness and appropriateness of the Company's response in order to identify and implement potential enhancements to the Company's security infrastructure and the broader risk management framework.


text: We manage risks from cybersecurity threats through our overall companywide risk management process, which is overseen by our Board of Directors and specific Board Committees. Management has created a global information security program, which encompasses a dedicated global information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. Our policies, procedures, and processes follow recognized frameworks established by the National Institute of Standards and Technology ("NIST"), as well as other relevant standards. Our program is designed to maintain the confidentiality, integrity, security, and availability of the data that is created, collected, stored, and used to operate our business.

companyName: STEEL DYNAMICS INC

ticker: STLD


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, utilizing, from time to time, tabletop exercises, business unit assessments, threat modeling, impact analyses, internal audits, external audits, third party vulnerability scans, third party penetration tests, and engagement of third parties to conduct analysis of our information security programs, including an overall assessment utilizing the NIST standards. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to team members or customers, and violations of data privacy or security laws.


text: Our Director of Information Security is responsible for leading the Information Security Team which has established a cybersecurity risk management program of policies and processes for assessing, identifying, and managing risk from cybersecurity threats. We have integrated these processes into our overall risk management systems and processes, and routinely assess risks from cybersecurity threats, including any potential unauthorized access to or activity conducted through our information systems that may result in material adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. This program includes established reasonable safeguards to minimize the identified risks; processes to reasonably address any identified gaps in existing safeguards; updates to existing safeguards as necessary; and monitoring the effectiveness of those safeguards.


text: Our safeguards include continuous network monitoring, complex passwords, team member training that reinforces our policies, standards, and practices, incident response capability reviews and exercises, and cybersecurity insurance and disaster recovery plans for the protection of our assets. The information security training and awareness program engages personnel through training modules on how to identify potential cybersecurity risks and protect the Company's resources and information. This training is mandatory for all team members monthly, and is supplemented by companywide testing initiatives, including periodic phishing tests.


text: Our cybersecurity risk management program also assesses third party providers, such as vendors, suppliers, and other business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third party providers and potential risks when handling or processing our employee, business, or customer data.


text: Further, we have designated a member of our senior leadership team, our Chief Financial Officer, to oversee the management of the safeguards, cybersecurity risk assessment, and mitigation process. From time to time, the Company's program is reviewed and validated by internal and external experts.


text: In general, our incident response process follows the NIST framework and focuses on four phases: (i) preparation; (ii) detection and analysis; (iii) containment, eradication, and recovery; and (iv) post-incident remediation. As cybersecurity incidents occur, including at third party providers, the Director of Information Security leads the Information Security Team through a standardized incident response process that focuses on responding to and containing the threat, minimizing any business impact, and evaluating its severity level. The severity level assessment determines how widespread the incident is and to what degree it could impact our overall business and manufacturing environment. In the event an incident is determined by the Information Security Team to be a high severity level, our cross functional team, with expertise in various disciplines, will assess the incident to determine if it has had a material affect or is reasonably likely of having a material effect on the Company's business strategy, results of operations, or financial condition.


text: We do not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition over the long term. In the last three years, the Company has not been aware of any material cybersecurity incidents occurring and we have not incurred material expenses from cybersecurity incidents (including penalties and settlements, of which there were none). For additional discussion of whether and how risks from cybersecurity threats could materially affect or are reasonably likely to materially affect the Company, see Item 1A. Risk Factors – "We are subject to cybersecurity threats and may face risks to the security of our sensitive data and information technology which may adversely affect our business, results of operations, financial condition and cash flows. "


text: One of the key functions of our Board of Directors is informed oversight of our risk management process, including risks from cybersecurity threats. Our Board of Directors is responsible for monitoring and assessing strategic risk exposure, and our senior leadership team is responsible for the day-to-day management of the material risks we face. Our Board of Directors administers its cybersecurity risk oversight function directly as a whole, as well as directly through the Audit Committee. Management and members of the Information Security Group ("ISG") regularly present to the Board of Directors regarding information security and an in-depth review of our processes for assessing, identifying, and managing material risks from cybersecurity threats. On a quarterly basis, the Audit Committee is informed by management concerning the status of existing and new cybersecurity risks, status of how management is addressing and mitigating those risks, cybersecurity and data privacy incidents (if any), and status of key information security initiatives. Additionally, on a biennial basis, we engage third parties to assess our information security program using the NIST framework, as well as perform penetration testing.


text: We have allocated substantial cross functional internal resources with expertise in information security, information technology, operations, risk management, human resources, finance, and legal to form a governance counsel known as the ISG. The ISG is an internal working group that collaborates with the Director of Information Security to ensure our cybersecurity program is adequately responsive to the evolving threat landscape. Our Director of Information Security has over twenty years of cybersecurity experience, has completed a Masters in Homeland Security, with an emphasis on cybersecurity, and holds several cybersecurity certifications.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These material risks are managed across Riot, our subsidiaries, and third-party contractors, and monitoring such risks and threats is integrated into our overall risk management program. Our risk management program is comprised of, among other things, policies that are designed to identify, assess, manage, and mitigate cybersecurity risk, and is based on applicable laws and regulations, informed by industry standards and best practices.

companyName: Riot Platforms, Inc.

ticker: RIOT


text: We conduct risk assessments to evaluate the effectiveness of our systems and processes in addressing threats and to identify opportunities for enhancements. Additionally, we conduct privacy and cybersecurity reviews, as well as annual employee training, and monitor emerging laws and regulations related to information security and data protection. We utilize third party tools and techniques to test and enhance our security controls, perform annual cybersecurity framework assessments, conduct ongoing penetration testing of our systems, and benchmark against industry practices. Our internal audit function provides independent assessment on the overall operations of our cybersecurity program and the supporting frameworks.


text: In support of our risk management program, we have adopted an Information Security Policy (the "Info-Sec Policy") and an Incident Response Plan (the "Response Plan") that establish administrative, physical, and technical controls and procedures to protect the integrity, confidentiality, and accessibility of sensitive data that may exist throughout the Company as well as processes to assess, identify, manage, and report cybersecurity risks and incidents. Our Info-Sec Policy applies to all persons working for the Company, as well as any third parties working with us in any capacity. Violation of our Info-Sec Policy may result in revocation of access privileges, and disciplinary action up to and including termination of employment or service relations for third parties.


text: Our cybersecurity team analyzes all third-party vendors for compliance with our internal Info-Sec Policy in order to help us assess potential risks associated with their security controls. We also generally require third parties to, among other things, maintain security controls to protect our confidential information or data, and to notify us promptly, but in any case, no later than twenty-four (24) hours after the occurrence of any data breach or cybersecurity incident that may impact our data. After coordinating a response to any third-party cybersecurity incident, the incident response team reviews service providers' compliance with the privacy and data security requirements of our Info-Sec Policy, obtains written assurance of corrective actions, as appropriate, and considers whether additional measures need to be taken to protect the Company.


text: Our cybersecurity team engages and utilizes third-party services as it monitors and actively responds to cybersecurity threats. We utilize an Endpoint Detection and Response (EDR) platform, an anti-virus application, through which incoming electronic communications are filtered, and an email security platform which seeks out identifiers in communications that disguise, impersonate, or otherwise misrepresent the source of the communication. Any such communications are then subject to quarantine or removal depending on the severity of issue. Additionally, we use a Security Information and Event Management (SIEM) system, which allows us to store logs off the system of record to prevent log tampering and provides the cybersecurity team functionality to build alerts on specific use cases that are important and unique to our business. We also implement robust network security protections and enterprise hardware for firewalls to safeguard our infrastructure against unauthorized access and cyber threats. Our strategy for 2025 includes leveraging AI and machine learning for enhanced threat detection and response, adopting a Zero Trust architecture, and using quantum-resistant encryption methods for data protection. We also focus on ransomware defense, regular backup and recovery processes, and continuous employee training and awareness programs. Additionally, we ensure compliance with the latest regulations, participate in threat intelligence sharing, and explore emerging technologies like post-quantum cryptography and blockchain security. If our applications fail or our software does not successfully block malicious electronic communications, employees are required to notify an immediate supervisor or the cybersecurity team promptly, but in no circumstances later than twenty-four (24) hours after such occurrence.


text: Our Board has ultimate oversight of our strategic and business risk management and, as such, has oversight responsibilities for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements, cooperation with law enforcement, and related effects on financial and other risks. The Board has delegated to the Audit Committee oversight risks of cybersecurity risk policies, practices and procedures. Management is responsible for identifying, assessing, and managing material cybersecurity risks on an ongoing basis, establishing and updating processes to ensure such potential risks are monitored, putting in place appropriate mitigation measures, and providing regular reports on cybersecurity trends and risks, and should they arise, any material incidents with our Board.


text: Our Chief Financial Officer is responsible for our cybersecurity program, and our Director of Cyber Security is our incident response team leader. In this position, our Director of Cyber Security oversees our cybersecurity team, and guides our incident response team, which is comprised of members from across our organization, including cybersecurity, IT support, mining operations, software engineering, compliance and legal, as well as contractors and other partners, as they support our cybersecurity functions. Our Director of Cyber Security has nearly two decades of experience in cybersecurity management and policy, achieved through job training, college education, and work in security and alignment of information technology solutions.


text: The Response Plan, developed by management and our cybersecurity team, and IT support team, serves as a Company-wide guide to facilitate coordinated, prompt, and systematic responses to any cybersecurity incidents and utilizes four interconnecting phases: (1) Preparation; (2) Detection and Analysis; (3) Containment, Eradication, and Recovery; and (4) Post-Incident Activity.


text: Upon detection of a cybersecurity incident and initial intake and validation by our cybersecurity team, our incident response team triages and evaluates the cybersecurity incident, and, depending on the severity, escalates the incident to management and a cross-functional working group. Any incident assessed as potentially being or potentially becoming material is immediately escalated for further assessment and reported to executive management. Determination of what resources are needed to address the incident, prioritizing of response activities, forming of action plans, and notification of external parties as needed are then undertaken by executive management and the cross-functional working group, led by our Chief Financial Officer and Director of Cyber Security. We consult with outside counsel as appropriate, including on materiality analysis and disclosure matters, and our executive management makes the final materiality and disclosure determinations, among other compliance decisions.


text: During 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we may not be successful in eliminating all risks from cybersecurity threats and can provide no assurances that undetected cybersecurity incidents have not occurred. See Part I, Item 1A. "Risk Factors" of this Annual Report for more information regarding the cybersecurity risks we face.


text: Risk Management and Strategy In the course of our operations, the Company receives and maintains sensitive information from our guests, employees, partners, and business operations. To address cybersecurity threats to this information, the Company uses a risk-based approach to create and implement a detailed set of information security policies and procedures based on frameworks established by the National Institute of Standards and Technology. The Company's Head of Information Security manages the Company's cybersecurity efforts and leads the cybersecurity team under the direct oversight of our Chief Technology Officer. These individuals, including all members of the cybersecurity team, have an average of over 16 years of experience involving information technology, including security, auditing, compliance, systems, and programming. Additionally, the Company engages in the use of external cybersecurity experts for training, contingency planning, consultation, and process documentation.

companyName: Texas Roadhouse, Inc.

ticker: TXRH


text: The Company has implemented detective and preventative controls designed to ensure the appropriate level of protection for the confidentiality, integrity, and availability of data stored on or transferred through our information technology resources. The Company has a risk assessment process to identify risks associated with our use of third-party service providers and has implemented specific processes and controls designed to mitigate those identified risks. Both internal and third-party audits are performed routinely to verify that these controls are effective. Additionally, the Company has implemented companywide security awareness training programs designed to provide best practices for protecting our network and systems, and routinely leads exercises for employees to reinforce the risk and proper handling of targeted emails. The Company's Head of Information Security is responsible for developing and implementing these controls and training exercises with support from our information technology department.


text: The Company's enterprise risk management program has established an internal risk committee to evaluate information governance risks including risks associated with the Company's use of artificial intelligence. This committee comprises members of management of the Company's information technology, human resources, marketing, accounting, risk, procurement, training, finance, and legal functions, and is focused on performing risk assessments to identify areas of concern and implement appropriate changes to enhance its cybersecurity and privacy policies and procedures. The internal risk committee is informed of the Company's risk prevention and mitigation efforts on a regular basis. The committee is also briefed on detection and remediation of cybersecurity incidents in a timely manner following the detection of any potential events.


text: The Company has a crisis response team comprising senior members of various corporate functions to oversee the response to various crises including potential crises arising from cybersecurity incidents that may impact the Company and/or its vendor partners. This team conducts regular tabletop exercises to simulate responses to cybersecurity incidents. To the extent there is a cybersecurity incident impacting the Company and/or a vendor partner, the crisis response team's process would be to ensure that our Head of Information Security and Chief Technology Officer are informed immediately and that the potential impact of the incident and remedial measures arising from the incident are communicated to the executive officers of the Company.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face and how a cybersecurity incident may affect our business strategy, results of operations, or financial condition, we believe that risks from prior cybersecurity threats, including as a result of any prior cybersecurity incident, have not materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition to date. We can provide no assurances that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition.


text: The Board has authorized the audit committee to oversee the Company's risk assessment and risk management practices and strategies. This delegation includes maintaining responsibility for overseeing the Company's enterprise risk management program. As a part of this oversight role, the audit committee receives regular updates from management on cybersecurity threats and privacy risks impacting the Company, which includes benchmarking these risks versus our industry. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events, receive training specific to cybersecurity risks and threats and regularly discuss any updates to our cybersecurity risk management and strategy programs.


text: Risk Management and Strategy Marine Products approaches cybersecurity as an enterprise-wide risk and has created a Cybersecurity Risk and Compliance Program that outlines governance programs in place and outlines efforts undertaken to mitigate cyber risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, the Company uses the Center for Internet Security ("CIS") Controls framework to provide best practices for securing IT systems and data. We have implemented a majority of version 8.0 of the CIS Controls which supports a Zero Trust architecture.

companyName: MARINE PRODUCTS CORP

ticker: MPX


text: The Company has several security policies that are published and accessible to all employees. All these policies are reviewed annually and updated as needed to address emerging risks or gaps in compliance. Marine Products has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed to determine if further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors, outside legal counsel and our independent registered public accounting firm, as appropriate, including on materiality analyses and disclosure matters, to make the final materiality determination regarding disclosure and other compliance decisions. The Company has a periodic touchpoint with all third-party information technology service providers to identify materials risks from cybersecurity threats.


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with data breach or other similar incidents. Cyber liability insurance also provides coverage in the event of a ransomware attack. Our cyber risk coverage includes assistance in the timely remediation of material cyberattacks and incidents.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Role of the Board On an annual basis, the Board reviews and approves the overall enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk. The Board has delegated its responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with experience in risk management including cybersecurity.


text: Role of Management Company management has established a Cybersecurity Governance Committee that is comprised of the Information Technology Manager and senior members of management. The Committee meets periodically to discuss cybersecurity program updates and challenges, watch for potential threats from both external and internal sources, monitor compliance in existing or emerging business practices, and respond to stakeholder inquiries. The Information Technology department is comprised of professionals with extensive expertise and led by its manager with over 20 years of experience in network security, cybersecurity and enterprise risk management. The manager is continuously monitoring trends and stays current with the various cybersecurity threats and related mitigation opportunities. The Company periodically engages a third-party service provider to perform an external vulnerability scan of the Company network to identify known threats and to date no critical vulnerabilities have been identified during these assessments.


text: Risk Management and Strategy RPC approaches cybersecurity as an enterprise-wide risk and has created an accountability framework that includes oversight of cybersecurity risks. We have implemented policies and processes designed to detect, prevent, and respond to cybersecurity incidents. To help guide its overall program, RPC has adopted the Center for Internet Security (CIS) framework, which provides prioritized guidance to help defend systems and networks against the most prevalent cyber-attacks as well as support for a Zero Trust. RPC has created a cross-departmental team to screen Company vendors (also known as partners and managed service providers) for vulnerabilities on their own systems and compliance with RPC's policies and procedures, to mitigate risks potentially caused by third party breaches.

companyName: RPC INC

ticker: RES


text: As part of its Standard Operating Procedures, RPC has adopted Incident Response Policy (IRP), Data Classification and Handling Policy, and other policies regarding key areas of information security. These policies are reviewed periodically and updated as needed to address emerging risks or gaps in compliance. The IRP also includes guidance on internal and external escalation in the event of an incident or breach. RPC has not experienced a material cybersecurity incident to date. If a material cybersecurity breach occurs, the incident will be reviewed by the cybersecurity team to determine whether further escalation is appropriate. Any incident assessed as potentially being or becoming material will immediately be escalated for further assessment and reported to designated members of our executive leadership team and if deemed necessary, the Board of Directors. The IRP provides for consultation with outside legal counsel and our independent registered public accounting firm as appropriate, including on materiality analysis and disclosure matters, to make the final materiality determination regarding disclosure and other compliance decisions.


text: The Company maintains a cyber liability insurance policy that is designed to cover certain expenses, business losses, business interruption, and fines and penalties associated with a data breach or other similar incident. Cyber liability insurance also provides coverage in the event of a ransomware attack including assistance in the timely remediation of material cyberattacks and incidents.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A Risk Factors of this Annual Report on Form 10-K.


text: Role of the Board On an annual basis, the Board reviews and approves the overall enterprise risk management approach and processes implemented by management to identify, assess, manage, and mitigate risk. The Board has delegated its responsibility for oversight of the Company's cybersecurity and information security framework and risk management to the Audit Committee. The Audit Committee receives information and updates at least quarterly and actively engages with senior leaders with respect to the effectiveness of the Company's cybersecurity and information security framework, data privacy, and risk management. In addition, the Audit Committee receives reports summarizing threat detection and mitigation plans, audits of internal controls, training and certification, and other cyber related priorities and initiatives, as well as timely updates from senior leaders on material incidents relating to information systems security, including cybersecurity incidents. The Audit Committee includes members with experience in risk management including risks related to cybersecurity.


text: Role of Management RPC's cybersecurity program is overseen by the Chief Information Officer (CIO) as well as several key members of RPC's Enterprise Technology team. These key leaders collectively have over 50 years of experience in network security, cybersecurity and enterprise risk management. The Chief Executive Officer and CIO receive regular updates on cybersecurity matters, results of mitigation efforts related to existing risks and cybersecurity incident response and remediation. These leaders communicate closely with members of RPC's Information Security Committee (ISC) which oversees the adopted CIS Control Framework, governs the Company's information security programs and monitors the effectiveness of the Company's cybersecurity and technology risk management practices. In addition, ISC provides oversight to align security strategies with business objectives. The Company also maintains business continuity and disaster recovery plans.


text: Risk Management and Strategy In the ordinary course of our business, we collect and store data, including sensitive data such as our proprietary business information and that of our customers, suppliers and business partners, information related to potential ventures and transactions, and personal information related to our employees, customers and business partners. Our business is dependent upon our computer systems, devices, software and networks (operational and information technology) to process the data necessary to conduct our business. In addition, the breadth and complexity of the technologies we use continue to grow, including as a result of the use of mobile devices, cloud services, artificial intelligence, open-source software, social media and the increased reliance on devices connected to the internet. We are committed to protecting the confidentiality and integrity of, and access to, our operational and information technology as well as the other systems used to conduct our business.

companyName: GLOBAL PARTNERS LP

ticker: GLP


text: To protect our data and systems against cybersecurity threats, our cybersecurity risk management program is designed to assess, identify, manage and mitigate cybersecurity threats that could adversely and materially affect our business. Our cybersecurity risk management program is aligned with our business strategy and integrated throughout our operations. Our cybersecurity risk management program is comprised of technical and administrative controls, processes, policies and procedures based on applicable laws and industry standards and guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework.


text: As part of our cybersecurity risk management program, we undertake ongoing cybersecurity risk assessments to help us detect, evaluate and respond to potential cybersecurity threats, including regular testing by our internal cyber operations team. Our vulnerability management program is designed to identify, assess, and remediate cybersecurity threats in our systems, such as through penetration testing. We have implemented measures designed to address the risks associated with the use of industrial control systems to help maintain the reliability and safety of our operations. Our information technology and operational technology disaster recovery program is designed to help maintain the continuity of critical business operations in the event of a disruptive cybersecurity incident through procedures for data recovery, system restoration, and business resumption. We engage third-party cybersecurity consultants to provide cybersecurity audits, targeted attack testing, cybersecurity threat intelligence and cybersecurity incident response services. We also operate a threat hunting program to help us identify potential cybersecurity threats in our systems. We require all employees and contractors to participate in cybersecurity training designed to enhance their understanding of cybersecurity threats and their ability to identify and escalate potential incidents.


text: Our internal data privacy and data security team evaluates vendors that have access (directly or indirectly) to our data and/or systems to help us document and mitigate potential cybersecurity threats associated with our use of those vendors and the products and services they provide. These evaluations also include how these vendors may incorporate generative artificial intelligence and other similar artificial intelligence tools into their offerings.


text: Our cybersecurity risk management program includes an incident response ("IR") plan that is designed to facilitate our response to cybersecurity incidents, including an escalation process for cybersecurity incidents that may have a moderate or higher business impact to notify our executive officers, other members of our senior management team and other internal stakeholders. The IR plan provides our executive officers and other members of our senior management team with the information needed to assess whether a cybersecurity incident materially affected or is reasonably likely to materially affect our business strategy, results of operations, or financial condition, and the need for public disclosure. We aim to test the IR plan at least annually to assess its operational effectiveness. We strive to conduct an annual "tabletop" exercise during which we simulate cybersecurity incidents to help us prepare for and respond to a cybersecurity incident and to identify areas for potential improvement. These exercises are conducted in close coordination with members of our internal cybersecurity risk management team, our retained cybersecurity incident response consultants, outside cybersecurity counsel and internal technical, operations and insurance risk management, internal audit and legal personnel, as well as certain executive officers and members of the senior management team.


text: We have an internal cybersecurity risk management team consisting of our cybersecurity operations team, cybersecurity engineering team and data privacy and data security compliance team that reports to our Chief Information Security Officer ("CISO"). This team is responsible for identifying and managing cybersecurity threats and assessing and managing material risks from cybersecurity threats.


text: With more than two decades of cybersecurity and information security experience, our CISO leads our cybersecurity risk management team and holds certifications including CISSP, CISA, CISM, and CRISC. Leveraging their cybersecurity experience, knowledge of our company and leadership, our CISO plays an important role in both the strategic development and tactical execution of our cybersecurity risk management program. Our CISO reports to the Chief Information Officer ("CIO") and regularly consults with our Chief Legal Officer ("CLO") and other members of the legal team, as well as outside cybersecurity counsel, for strategic and operational input on risk management and compliance with applicable cybersecurity laws and regulations.


text: We have a management-level cybersecurity committee that has primary responsibility for our overall cybersecurity risk management program and oversees our internal cybersecurity personnel and retained external cybersecurity consultants and applicable third-party service providers. The cybersecurity committee includes our Chief Financial Officer, CIO, CLO and our Director of Internal Audit. Our CISO and members of the internal cybersecurity risk management team regularly meet with the cybersecurity committee to provide updates on cybersecurity threats, risk management activities and other issues related to preventing, detecting and mitigating cybersecurity incidents. Our cybersecurity committee also consults with internal and external cybersecurity and threat intelligence consultants and communicates with senior management about cybersecurity threats and resource needs for managing them.


text: Our Board of Directors (the "Board") oversees all cybersecurity risk management activities. At least annually, the CISO, CIO and other members of the cybersecurity committee report to the Board on the state of our cybersecurity risk management program and current and emerging cybersecurity risks. The Board's Audit Committee has been delegated strategic oversight of the cybersecurity committee and our cybersecurity risk management program, and is responsible for providing feedback, as needed. Any cybersecurity incident deemed to have a moderate or higher business risk also is reported to the Board.


text: Impacts from Cybersecurity Threats As of the date of this report, though we and our service providers have experienced certain cybersecurity incidents, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity risk management program and governance structure, we cannot guarantee that a significant cyberattack will not occur. A successful attack on our operational and information technology or other business systems could have significant consequences to the business. See "Part I, Item 1A, Risk Factors," for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Information technology is important to our business operations, and we are committed to protecting the privacy, security and integrity of our data, as well as our employee and customer data. The Company has a cybersecurity program in place for assessing, identifying and managing cybersecurity risks that is designed to protect its systems and data from unauthorized access, use or other security impact. Our cybersecurity risk program is designed to identify, assess, prioritize and mitigate risks across the organization; and to ensure that cyber risks are not viewed in isolation, but are assessed, prioritized and managed in alignment with the Company's other operational, financial and strategic risk mitigation strategies.

companyName: TOOTSIE ROLL INDUSTRIES INC

ticker: TR


text: We continuously monitor and update our information technology networks and infrastructure in an effort to prevent, detect, address and mitigate risks associated with unauthorized access, misuse, computer viruses and other events that could have a security impact. We invest in industry standard security technology to protect the Company's data and business processes against risk of cybersecurity incidents. Our data security program includes identity, trust, vulnerability and threat management business processes, as well as adoption of standard data protection policies. We maintain and periodically test backup systems and disaster recovery. We also have processes in place that are designed to prevent disruptions resulting from our implementation of new software, including software updates, and new systems.


text: The Company has a comprehensive incident response plan to address cybersecurity incidents. The Company's incident response plan includes procedures for identifying, containing and responding to cybersecurity incidents and is subject to periodic review and assessment. The Company also engages external parties, including consultants and a computer security firm to facilitate its cybersecurity oversight and assist in our response in the event of a cyber-attack or breach. Further, the Company has procured cyber-insurance that would provide coverage and consulting services in the event of a significant security breach. To date, the Company believes that its cybersecurity program has been effective in protecting the confidentiality and integrity of its information and systems; however, the Company cannot guarantee that its cybersecurity program will be successful in preventing all cybersecurity incidents. In addition, the Company's cyber insurance may not be sufficient in type or amount to cover claims related to security breaches and cyber-attacks.


text: The Company has not experienced any material cybersecurity incidents or a series of related unauthorized occurrences for the year ended December 31, 2024, and the Company is not currently aware of any cyber security attacks or breaches that are reasonably likely to materially affect the Company's business, business strategy, operating results or financial condition. However, as discussed under Item 1A "Risk Factors," specifically the risks titled "Risk of operational interruptions relating to computer software or hardware failures, including cyber-attacks," a cybersecurity incident could negatively impact sales and profits. The sophistication of cyber, ransomware and other security threats continues to increase, and the preventative actions we take to reduce the risk of these incidents and protect our systems and information may be insufficient. Accordingly, no matter how well controls are designed and implemented, we will not be able to anticipate all cybersecurity attacks, ransomware and other security breaches and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: The Company's cybersecurity risk program is supervised by members of our executive team. The program is led and managed by the Director of Information Technology, whose experience includes over ten years in information security leadership roles, with the assistance of third-party experts, including consultants and a computer security firm. The Audit Committee and the Board of Directors receive periodic reports on the Company's actions to respond to the cyber security incidents and the overall cyber risk environment. In accordance with our Security Incident Response Plan ("SIRP"), the Audit Committee is to be promptly informed by management of cybersecurity incidents with the potential to have a material impact on the Company, its financial results, or its information systems.


text: To ensure our employees are educated on potential cybersecurity threats or actions, we train our executive officers and management in the event of a potential cyber threat or cybersecurity incident. Our Company-wide information security training program includes security awareness training, including regular phishing simulations, cyber wellness training and other targeted training and simulations. These programs provide employees the opportunity to gain an understanding and awareness of the various forms of cybersecurity incidents, including how to identify and report any suspicious activity or threat.


text: Cybersecurity Risk Management and Strategy Assessing, identifying and managing material risks from cybersecurity threats is critical for maintaining the security of the Company's data and information systems, and is integrated into our enterprise risk management systems and processes. The Bank's approach to cybersecurity risk management and strategy is based on the Federal Financial Institutions Examination Council ("FFIEC") Cybersecurity Assessment Tool ("CAT"), which provides a repeatable and measurable process for evaluating cybersecurity preparedness and assessing, identifying, and managing material risks from cybersecurity threats. The CAT incorporates cybersecurity-related principles from the FFIEC Information Technology Examination Handbook and regulatory guidance, and concepts from other industry standards, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: Bank First Corp

ticker: BFC


text: The CAT consists of two parts: Cybersecurity Inherent Risk Profile and Cybersecurity Maturity. Completion of both parts of the CAT allow management and the Board to evaluate whether the Company's cybersecurity risk and preparedness are aligned. The Cybersecurity Inherent Risk Profile is the level of risk posed to the Company by technologies and connection types, delivery channels, online/mobile products and technology services, organizational characteristics and external threats. Cybersecurity Maturity is designed to help management measure the Company's level of risk and corresponding controls under the following five domains: (i) Cyber Risk Management and Oversight; (ii) Threat Intelligence and Collaboration; (iii) Cybersecurity Controls; (iv) External Dependency Management; and (v) Cyber Incident Management and Resilience.


text: The Information Security Officer ("ISO") and the Company's Information Technology Committee conduct and review the CAT annually to identify changes to the Company's inherent risk profile; when new threats arise or when considering changes to the business strategy, such as expanding operations, offering new products and services, or entering into new third-party relationships that support critical activities. Consequently, management can determine whether additional risk management practices or controls are needed to maintain or augment the Company's cybersecurity maturity.


text: In an effort to continually share threat intelligence and increase awareness of cybersecurity trends, the Company has also implemented a Cybersecurity Education and Awareness Program. This program includes the following components: Mandatory annual cybersecurity employee training for all employees; Training specifically targeted to Senior Management and Information Technology staff; Bimonthly review of emerging security trends by the Information Technology Committee; Mandatory annual cybersecurity Board training;


text: Periodic communication to employees highlighting internal control requirements and information about common threats or fraud schemes; and Periodic communication to the Bank's customers highlighting emerging threats and good cybersecurity hygiene.


text: To date, we have not experienced a cybersecurity incident that has materially impacted our business strategy, results of operations, or financial condition. Despite our efforts, there can be no assurance that our cybersecurity risk management processes and measures described will be fully implemented, complied with, or effective in protecting our systems and information. We face risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect our business strategy, result of operations or financial condition. Please see Part I, Item 1A. Risk Factors for further discussion of the risks associated with an interruption or breach in our information systems or infrastructure.


text: Board and Management Governance The Company's Board of Directors recognizes the importance of maintaining the trust and confidence of our customers, employees, and shareholders, including the risks associated with cybersecurity threats. The Board of Directors' responsibilities for cybersecurity risk management and strategy include the following: Engaging management in establishing the Bank's vision, risk appetite, and overall strategic direction; Approving plans to ensure the use of the CAT;


text: Reviewing management's analysis of the CAT results, inclusive of any reviews or opinions on the results issued by independent risk management or internal audit functions regarding those results; Reviewing management's determination of whether the Bank's cybersecurity preparedness is aligned with its risks;


text: Reviewing and approving plans to address any risk management or control weaknesses; and Reviewing the results of management's ongoing monitoring of the Bank's exposure to and preparedness for cyber threats.


text: The Company has also appointed an ISO, who reports directly to the Audit Committee and to the Chief Executive Officer and shares a co-sourced relationship with a third party consultant. The ISO has been with Bank First for over 10 years in various operational and administrative roles. For the past five years, he has served as the Bank's Enterprise Risk Manager, and as ISO for the past three years. In 2022, he earned the Certified Banking Security Manager certification from SBS Cybersecurity. The ISO works closely with the Director of Technology to ensure that the Bank's cybersecurity controls are in line with established internal culture, Board expectations and risk appetite, and all regulatory requirements. The ISO's responsibilities include the following: Developing a plan to conduct and complete the CAT on an annual basis; Working with the VP-Director of Technology to evaluate the results of the CAT; Leading employee efforts during the CAT to facilitate timely responses from across the Bank; Setting the target state of cybersecurity preparedness that best aligns to the Board of Directors' approved risk appetite; Reviewing, approving, and supporting plans to address risk management and control weaknesses; Analyzing and presenting the results of the CAT to the full Board of Directors; Providing periodic cybersecurity updates to the full Board of Directors;


text: Overseeing the performance of ongoing monitoring to remain nimble and agile in addressing evolving areas of cybersecurity risk; and Overseeing the Bank's cybersecurity preparedness.


text: Finally, the Company has established an Information Technology Committee to support the ISO in implementing the CAT, document formal action plans to be presented to the Board of Directors, enforce and implement the controls established by the CAT, and ensure employee compliance with internal controls


text: Information about cybersecurity risks and our risk management processes is collected, analyzed and considered as part of our overall enterprise risk management. The Company recognizes the critical importance of maintaining the trust and confidence of our tenants and business partners. The Board plays an active role in overseeing management of our risks, and cybersecurity represents an important component of the Company's overall approach to risk management and oversight. We believe we have built a strong and collaborative risk management culture focused on awareness which supports appropriate understanding and management of our key risks. Each employee is accountable for identifying, monitoring and managing risk within their area of responsibility.

companyName: Chiron Real Estate Inc.

ticker: XRN


text: The Company maintains cybersecurity prevention and response plans and procedures (the "Cybersecurity Policies") that set forth the Company's plan to prevent, manage, report and resolve cybersecurity events. The Cybersecurity Policies set forth the Company's policies and procedures for cybersecurity event prevention, including the Company's (i) network and computer systems acceptable use policy, (ii) data backup procedures, (iii) business continuity plan, (iv) data retention policy, (v) disaster recovery plan, (vi) email use and security policy, (vii) network change management procedures, and (viii) password and authentication requirements policy. The Cybersecurity Policies also (i) provide indicators that Company employees should be aware of to recognize a cybersecurity event, (ii) outline the roles and responsibilities for Company employees and other third parties with respect to the Company's cybersecurity incident response team ("CSIR Team"), (iii) set forth the steps to take in response to a cybersecurity incident, including reporting the incident, investigating the incident, preserving non-affected systems and data, informing, as appropriate, Senior Management (as defined below), insurance carriers, law enforcement and other parties that may be affected by the incident and (iv) include the processes for maintaining business continuity.


text: The Company's President and Chief Executive Officer, Chief Financial Officer and Treasurer, Chief Operating Officer and General Counsel and Secretary (" Senior Management ") are responsible for assessing and managing cybersecurity risks with the support of the entire CSIR Team, led by the Director of Operations/Risk Management. The Director of Operations/Risk Management is the primary lead for monitoring the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and ensuring that the Cybersecurity Policies are followed. Senior Management works collaboratively with the Director of Operations/Risk Management and the entire CSIR Team to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Cybersecurity Policies. The CSIR Team also includes a third-party, on-demand IT support team, a Primary IT Support Contact, who is the technical response lead, a Primary Communications Contact responsible for handling external communications during and after an incident, as well as other delineated primary contacts in areas including, but not limited to, HR, Legal, Accounting, Asset Management and Acquisitions. Pursuant to the Cybersecurity Policies, information security incidents must be reported, without delay, to the IT support team or the Director of Operations/Risk Management, who will then advise Senior Management of the incident. Senior Management will then report such threats and incidents to the Audit Committee, when appropriate.


text: The members of Senior Management each hold degrees in their respective fields and combined have approximately 30 years or more of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Governance: As discussed in more detail under "Item 1C. Cybersecurity—Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with the Company's management team.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that address the response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact the Company's business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip personnel with effective tools to address cybersecurity threats, and to communicate evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of its policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of the Company's cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on its cybersecurity measures, including information security materiality assessments and independent reviews of the Company's information security control environment and operating effectiveness. The results of such assessments and reviews are reported to the Audit Committee and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's cybersecurity risk management process. The Audit Committee has adopted a charter that provides that the Audit Committee has duties and responsibilities with respect to the oversight of the Company's cybersecurity risk protocol (which includes oversight of risk assessment, risk management plan and process to control/monitor, business continuity plan, incident response, and disaster recovery).


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. We face certain ongoing cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We, our tenants, and our property managers face risks associated with security breaches through cyber-attacks, cyber-intrusions, or otherwise, as well as other significant disruptions of information technology networks and related systems."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Camping World Holdings, Inc.

ticker: CWH


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, (3) our cybersecurity operations center and third party service providers responsible for monitoring and measuring threats, and (4) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; regular testing of our critical systems to identify and address potential vulnerabilities; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third party risk management process for certain service providers, suppliers, and vendors.


text: We regularly experience cyberattacks and other incidents and will continue to experience varying degrees of attacks and incidents in the future. To date, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents (including the Cybersecurity Incident), that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition, however we cannot guarantee that material incidents will not occur in the future.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee ("Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee receives briefings from our information security team ("Information Security") on our cybersecurity risks no less than annually. In addition, management updates the Committee in addition to the full Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Information Security is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Information Security reports to the Chief Administrative and Legal Officer, who, together with other members of our management team, including the Chief Financial Officer and President, is responsible for assessing and managing our material risks from cybersecurity threats based on regular reports from Information Security and information technology ("IT") teams. Management receives periodic reporting on the status of projects to strengthen the security of our IT systems and efforts regarding the prevention, detection, mitigation, and remediation of cybersecurity events. Reports may include briefings that have been informed by internal security personnel, threat intelligence and other information obtained from governmental, public, or private sources in addition to alerts and reports produced by security tools deployed in the IT environment.


text: Information Security has significant experience in incident response, forensics, vulnerability management, network security administration, fraud prevention, and other governance, risk, and compliance areas. Information Security maintains subject matter expert level knowledge in cybersecurity frameworks and governance organizations such as NIST, ISO 27001, and PCI-DSS, along with industry certifications commensurate with their roles.


text: Our Cybersecurity program is managed by our Chief Information Security Officer (CISO). The CISO is responsible for developing and managing the overall strategy, leading the response to cybersecurity incidents and reporting to the Board. The Audit Committee of the Board monitors our information security programs, including our cybersecurity risk management program, and receives updates quarterly, or more frequently as determined appropriate, from management on our cybersecurity program and systems protection.

companyName: ACCENDRA HEALTH INC/VA/

ticker: ACH


text: Our CISO has over twenty-five years of experience in cybersecurity and holds active Certified Information Systems Security Professional and Certified Information Security Manager certifications. Our policies require teammates, contractors, service providers and suppliers who become aware of a cybersecurity incident or the individual's supervisor to immediately report the cybersecurity incident to the appropriate reporting channels, which include the CISO. In the event of a cybersecurity incident, in addition to the standing members, teammates would be selected to serve on the Cybersecurity Incident Response Team (CIRT) based on the facts and circumstances of the particular cybersecurity incident. Additionally, our outside legal counsel is held on retainer to assist with our response to cybersecurity incidents.


text: We model our cybersecurity program to align with the practices and standards referenced within the National Institute of Standards and Technology cybersecurity framework. Our information security program is integrated within our larger enterprise risk management program and includes, but is not limited to: Following the methodology of Identify, Protect, Detect, Respond, and Recover; Mandatory annual cybersecurity awareness training for all teammates accessing our network; Monthly Company-wide phishing prevention and awareness exercises;


text: Identification and remediation of information security risks and vulnerabilities in our information technology systems, including regular scanning of both internal and externally facing systems and annual third-party penetration testing; Implementation of security technologies intended to identify and assist in containing and remediating malware risks; Active monitoring of logs and events for our network perimeter and internal systems; Due diligence of information security maintained by third-party vendors that handle our data;


text: Partnering with the Cybersecurity and Infrastructure Security Agency (CISA), DHS, and the Federal Bureau of Investigation, to leverage their provided sensitive or confidential threat intel and with CISA for weekly vulnerability scans of our key public-facing servers;


text: Maintaining a cyber insurance policy that provides coverage for security breach recovery and response; and Engagement of third party consultants to assess the health of our cybersecurity program.


text: We maintain a Cybersecurity Incident Response Plan (CIRP) to assist in promptly responding to, resolving, and recovering from cybersecurity incidents. The CIRP includes guidelines for assessing, identifying, managing, reporting, including disclosure of material breaches with the SEC, and remediating cybersecurity incidents. Following a cybersecurity incident, external subject matter experts, including legal counsel are consulted to reduce the risk of further compromise to our information and to ensure proper reporting and documentation. The Audit Committee would be informed promptly of material cybersecurity incidents in the event that they arise. If a material cybersecurity incident were to occur, it could have a material effect on our business strategy, results of operations and financial condition. For more information see Item 1A. "Risk Factors" for the Risk Factor entitled "Our operations depend on the proper functioning of information systems, and our business or results of operations could be adversely affected if we experience a cyberattack or other systems breach or failure."


text: Privacy and Cybersecurity Merchants Bank is subject to many U.S. federal and state laws and regulations governing requirements for maintaining policies and procedures to protect non-public confidential information of their customers. These laws require banks to periodically disclose their privacy policies and practices relating to sharing such information and permitting customers to opt out of their ability to share information with unaffiliated third parties under certain circumstances. They also impact a bank's ability to share certain information with affiliates and non-affiliates for marketing and/or non-marketing purposes, or to contact customers with marketing offers. In addition, banks are required to implement a comprehensive information security program that includes administrative, technical, and physical safeguards to ensure the security and confidentiality of customer records and information.

companyName: Merchants Bancorp

ticker: MBIN


text: Risk Management and Strategy To combat the ever-present cyber risks, the Company maintains a comprehensive ISP, which includes continuous risk assessments, an Incident Response Plan, and a multilayered control environment meant to protect, detect, respond to, and limit unauthorized or harmful actions across our information environment. The control environment is based off industry leading recommendations, including the Center for Internet Security (CIS) Critical Security Controls and the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our Information Security Officer (ISO) is primarily responsible for coordinating the various aspects of the ISP with cross-functional support teams across various teams within the Company.


text: Standards over information security are Board-approved and various types of control testing is conducted throughout the year, by internal and external parties. Recommendations are implemented and reported to various committees. These security and privacy policies and procedures, aimed at protecting personal and confidential information, are in effect across all businesses and geographic locations. Board-approved policies are in place to effectively mitigate risks linked to third-party service providers, encompassing factors such as availability, confidentiality, and governance and compliance. As part of this risk mitigation, the Company actively monitors vendors' cybersecurity practices through periodic assessments and contractual security requirements. This ensures that vendors adhere to our security standards and promptly address emerging threats or vulnerabilities.


text: The Company employes a defense in depth posture, designed to safeguard information, prevent unauthorized access, detect, and respond to threats, and maintain the confidentiality, integrity, and availability of data. The ISP establishes controls across many domains including but not limited to: Information Security Governance, Inventory and Control of Enterprise Assets and Software, Data Protection, Secure Configuration of Enterprise Assets and Software, Account and Access Control Management, Continuous Vulnerability Management, Audit Log Management, Email and Web Browser Protections, Malware Defenses, Data Recovery, Network Infrastructure Management, Network Monitoring and Defense, Security Awareness and Skills Training, Service Provider Management, Application Software Security, Incident Response Management, and Penetration Testing.


text: Recognizing people as a key component of an effective information security program, the Merchants Information Security Program strives to enhance education and awareness at all levels of the Company. One critical component of education and awareness is an internal cybersecurity committee, comprised of employees from all levels and departments, who act as embedded security representatives for their business units.


text: However, it is difficult or impossible to defend against every risk being posed by evolving technologies as well as criminal intent on committing cyber-crime. Increasing sophistication of criminal organizations and advanced persistent threats makes staying ahead of new dangers difficult and could result in a security breach. Controls employed by our information technology department and cloud vendors could prove inadequate. A breach of our security that results in unauthorized access to our data could expose us to a disruption or challenges relating to our daily operations, as well as to data loss, litigation, damages, fines and penalties, significant increases in compliance costs and reputational damage, any of which could have an adverse effect on our business, financial condition, and results of operations. The Company has established conditions to quickly respond to a cyber incident, ensuring a resilient, information environment.


text: The Board established an IT Committee to assist executive management and the Board of Directors of the Bank in fulfilling their oversight responsibilities related to information security. The IT committee membership includes senior management from business units, as well as information security risk experts such as the Information Security Officer, experts from Enterprise Risk Management, Internal Audit, and Information Technology Leaders. At the IT Committee meetings, security-related policies and standards are reviewed and approved, annual risk assessment results and action plans are noted, annual penetration test reports shared, current security incidents discussed, emerging threats reported on, and relevant cyber risks and trends are presented. The IT Committee is responsible for governing the assessment and treatment of cyber risks. The Committee reports its activities, key conclusions, and recommendations to the Board on a quarterly basis.


text: The Chief Administrative Officer is responsible for the appointment of the Information Security Officer. The Information Security Officer serves as the focal point for the information security program and is responsible and accountable for its implementation and monitoring, and management of the Information Security team. The current Information Security Officer has over a decade of experience in the cyber security field, including critical roles in security operations, security governance, risk, and compliance, and cyber threat intelligence. They have multiple industry leading certifications, including nine GIAC and CISSP from the ISC2 and a Master of Engineering in Cybersecurity Policy and Compliance.


text: The Information Security Officer presents an Annual Information Security Review to the board which summarizes the previous year's threat landscape, risk assessment, service provider, and audit testing activities, results of security incidents, information security program changes, and future strategies and recommendations.


text: Risk Management and Strategy The Company recognizes the critical importance of developing, implementing and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: FIRST HAWAIIAN, INC.

ticker: FHB


text: Managing Material Risks and Integrated Overall Risk Management The Company has implemented a risk-based approach to identify and assess the cybersecurity threats that could affect our business and information systems. Our cybersecurity program is designed to align with industry standards and best practices, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. We use various tools and methodologies to manage cybersecurity risk that are tested on a regular cadence. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, third-party conducted penetration tests and network monitoring. We also provide security awareness training for employees and contractors, maintain a cybersecurity insurance policy and invest in new security capabilities designed to address emerging threats.


text: In addition, the Company has a set of enterprise-wide policies, standards, and procedures concerning cybersecurity matters, which include an information security policy and program reviewed and approved by senior management and the Board of Directors. Additionally, technical standards and procedures related to incident response and use of Bank systems and devices are in place, as well as standards for critical security operational functions related to encryption, endpoint protection, vulnerability management, remote access, multifactor authentication, handling confidential information, use of internet, social media, email, and wireless devices. Policies and standards are subject to an internal review process and are approved by senior management.


text: The Company has strategically integrated cybersecurity risk management into our enterprise-wide risk management framework in alignment with the three lines of defense model to promote an enterprise-wide culture of cybersecurity risk management. This integration aims to provide that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team works closely with our enterprise technology and cybersecurity management teams to evaluate and address cybersecurity risks in alignment with our business objectives, regulatory requirements and operational needs.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, the Company engages with a range of external experts, including cybersecurity service providers, assessors, advisors and consultants, in evaluating and testing our cybersecurity program. These partnerships enable us to leverage specialized knowledge and insights to ensure our cybersecurity strategies and processes are aligned to industry best practices. Our collaboration with these third parties includes threat assessments and consultation on security improvements, program maturity and regulatory compliance. Additionally, we conduct multiple penetration tests annually and retain an external consultant to periodically evaluate the overall state of our program.


text: Overseeing Third-Party Risk The Company has processes in place to oversee and manage risks associated with third-party service providers, including risks related to data breaches or other security incidents. This includes conducting security due diligence reviews of critical third-party providers, subjecting third parties to periodic risk assessments and requiring third parties to sign standard contractual provisions before receiving sensitive information from the Company.


text: Risks from Cybersecurity Threats Like all financial institutions, we, as well as our third-party service providers, are the target of various evolving and adaptive security threats, including malware, ransomware, phishing, credential validation and distributed denial-of-service attacks. Cyber-attacks have also focused on targeting online applications and services, such as online banking, as well as cloud-based and other products and services provided by third parties. Operational failures and breaches of security from such attempts could lead to the loss or disclosure of confidential information or personal data belonging to the Company or our employees and customers. These failures and breaches could result in business interruption or malfunction and lead to legal or regulatory actions that could result in a material adverse impact on the Company's operations, reputation and financial results.


text: The Company's Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats and the significance of these threats to our operational integrity and stakeholder confidence. Accordingly, the Board of Directors has established oversight mechanisms to ensure effective governance in managing these risks.


text: Board of Directors Oversight As part of its responsibility to oversee the management, business, and strategy of the Company, the Board of Directors, through its Risk Committee, reviews and approves the Company's risk management framework, including reviewing the overall risk appetite, risk management strategy and policies and practices established by management to identify and manage the risks we face. In addition, other Board committees are responsible for overseeing certain risks under their respective charters.


text: The Board's Risk Committee is central to the Board's oversight of cybersecurity risks and bears the primary oversight responsibility for this domain. The Risk Committee is composed of Board members with diverse expertise, including audit and finance and technology experience, equipping them to oversee cybersecurity risks effectively. The Risk Committee actively participates in strategic decisions related to cybersecurity, offering review and guidance on, among other things, program design, the Company's cybersecurity risk profile and the effectiveness of its risk management strategies.


text: The Board Risk Committee reviews and receives regular briefings from the Chief Information Officer, Chief Information Security Officer (the "CISO"), Chief Technology Officer, Chief Operating Officer, Chief Risk Officer, Senior Vice President – Enterprise Information Security, Chief Audit Officer, and Chief Executive Officer on information security and technology risks, including discussions of the Company's information security and cybersecurity risk management programs. The Board also receives regular reports on cybersecurity risks, vulnerabilities, incidents, staff security awareness training and overall progress to improve the Company's cybersecurity risk profile.


text: Management's Role in Managing Risk Senior management is responsible for creating and recommending for approval to the Board of Directors risk appetite metrics related to cybersecurity, reflecting the aggregate levels and types of risk the Company is willing to accept in connection with the operation of our business and pursuit of our business objectives.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO, our Vice President – Cyber Risk Governance and our Senior Vice President – Enterprise Information Security. The management team is highly experienced in cybersecurity matters. The CISO has over 20 years of experience in cybersecurity including working at a global bank and leading cybersecurity vendors, and holds Certified Information Systems Security Professional ("CISSP") and Certified Information Privacy Professional certifications for security and privacy, respectively. The CISO has a bachelor's, master's, and law degrees. The Vice President – Cyber Risk Governance has advanced degrees and certifications related to cybersecurity and over 15 years of experience with the federal government in a similar role. The Senior Vice President – Enterprise Information Security has more than 30 years of experience at the Company and held various information technology and information security risk management roles, including serving as a bank information security officer, and has a bachelor's degree and security certification.


text: The CISO is responsible for developing and implementing the Company's cybersecurity and information security program, reporting on cybersecurity matters to the Board and senior management, ensuring compliance with standards, remediating known risks, overseeing incident detection and response and leading the employee cybersecurity awareness training program. The Vice President – Cyber Risk Governance is responsible for third party cybersecurity risk management and cybersecurity risk and controls governance. The Senior Vice President – Enterprise Information Security provides regular updates to senior management and the Board's Risk Committee regarding the effectiveness of security controls and the state of the Company's cybersecurity program and risk level.