text: Risk Management and Strategy Hilltop recognizes the critical importance of protecting company data and the information systems that collect, process and maintain data, and we have developed an enterprise-wide program for assessing, identifying and managing material cybersecurity risks and threats. The systems we utilize include safeguards to protect against or mitigate possible threats, as well as controls designed to ensure accountability, availability, integrity and confidentiality of the data. Security measures are implemented to guard against unauthorized access, alteration, disclosure or destruction of data and systems, including accidental loss and destruction. Our program is supported by management and the board of directors.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Information Technology ("IT") Risk assesses technology risks and controls, evaluates application systems' conformance to internally defined and approved security standards, coordinates audits and examinations for IT and IT security, as well as tracks open risk issues and exceptions. IT Security defines security policies and standards, conducts security awareness and training, evaluates security configuration and assesses vulnerability risk.

secItem: Item 1C


text: Security Operations utilizes security solutions to detect and respond to security threats and supports the end-user security needs. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.


text: Supporting these core information security functions is an Information Security Engineering team within our Engineering organization. This team is charged with the configuration, implementation and ongoing maintenance of the solutions that enhance our security posture.


text: Managing Material Cybersecurity Risks As a part of our overall risk management strategy, IT Risk conducts risk assessments on the technology environment as well as application systems implemented to support the various business functions of Hilltop based on the Gramm-Leach-Bliley Act guidance. Risks are identified from the Enterprise Risk Management and Internal Audit assessments of IT and Information Security. IT then quantifies the incidents and risks that have been identified and reports to the Operations & Strategy Committee, which is comprised of executives from across the enterprise representing disciplines including compliance, regulatory, information technology, risk, finance and operations, if they meet certain thresholds. The necessary controls are identified to address the risk and this control evaluation contributes to the assessment of the residual risk value. In 2023, additional assessments were completed utilizing the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool for the enterprise.


text: Engage Third-Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Hilltop engages with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements. In particular, each year we engage a firm to perform penetration testing. We do not allow the same firm to be engaged for more than three years in an effort to obtain diversity in methods of testing. Additionally, at least every two years, we engage a firm to perform a red-team exercise for a simulated cybersecurity event.


text: Service Provider Oversight HTH Procurement processes contract requests, contract renewals and onboard of vendors. Such process creates a single point of entry for all sourcing and contract requests. Vendors who match certain inherent risk levels are then sent to Vendor Risk Management ("VRM") for further review and due diligence. Vendors who host Non-Public Personally Identifiable Information or vendors who we deem materially critical, regardless of risk, are managed by VRM. The VRM's due diligence process is risk-based and serves as a verification and analysis tool to assist in the evaluation of risk associated with new vendor relationships and ongoing reviews of inherently high-risk and vital vendors. VRM also is tasked with monitoring managed vendors business continuity and disaster recovery processes.


text: VRM considers specific factors in performing their due diligence based on the risk profile of the high-risk and vital vendor and services being performed. The specific factors include, but are not limited to, a review of the vendor's: Information security and related controls (third-party audit); Existence of disaster recovery and business continuity program and testing; Geographic location (country risk).


text: Material findings are reported to the Operations & Strategy Committee. A report of these vendors also is provided to the Risk Committee of the board of directors, which provides updates to the full board of directors.


text: Risks from Cybersecurity Threats We face a number of cybersecurity risks in connection with our business. We do not currently believe that any current cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, Hilltop, including its business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see Item 1A., "Risk Factors — Our operational systems and networks have been, and will continue to be, subject to an increasing risk of continually evolving cybersecurity or other technological risks, which could result in a loss of customer business, financial liability, regulatory penalties, damage to our reputation or the disclosure of confidential information."


text: The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. To address the significance of these threats to our operations, customers and stockholders, we have established oversight mechanisms to ensure effective management, oversight and governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight Our board of directors and the Risk Committee of the board of directors oversee an enterprise-wide approach to risk management, including cybersecurity risks, intended to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance stockholder value. The Risk Committee is central to the board of directors' oversight of cybersecurity risks and bears the primary responsibility for this function. The Risk Committee is composed of board members with diverse expertise including, risk management assisting them to oversee cybersecurity risks. The Risk Committee receives regular reports from our Chief Information Officer ("CIO") and provides updates to the full board of directors at each regular meeting of the board of directors, The Risk Committee also reviews all information security plans and policies, which are then recommended to the full board of directors for its review and approval.


text: Management's Role Managing Risk Our CIO plays a pivotal role in informing the Risk Committee on cybersecurity risks and developments. Our CIO provides comprehensive briefings to the Risk Committee on a regular basis, with a minimum frequency of four times per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events;


text: Vulnerability management, including software patching, reviews of risk accepted vulnerabilities (remediated, renewed and top risks) and trends related thereto; and Compliance with regulatory requirements and industry standards. In addition to Risk Committee meetings, our CIO generally meets with executive management weekly to provide updates regarding current activities and areas of focus. In the event of a potential or actual cybersecurity event, the CIO immediately notifies the General Counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition. We also conduct cybersecurity tabletop exercises each year to ensure our processes and procedures align with our technical controls, and to ensure that the organization is prepared for a security-related event.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CIO. With over twenty years of experience in the field of cybersecurity, our CIO brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Our CIO is responsible for our Information Security Program and our information security leaders report directly to our CIO. In order to maintain a separate reporting line for our information security leaders, we also maintain a standing committee, the Information Security Governance Committee, which consists of certain members of executive management and the information security leaders. Our Information Security Governance Committee allows for direct management reporting for IT Risk management, audit/examination report(s) review, and oversight of our IT Security strategy and daily Security Operations.


text: Monitor Cybersecurity Incidents Our CIO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. To assist our information security team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our CIO oversees the implementation of, and the processes for, the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: Processes for Assessing, Identifying and Managing Cybersecurity Risks We are continuously assessing and adopting new processes, systems and resources in an effort to make our business safer from cybersecurity threats. We depend on digital technology in many areas of our business and operations, including, but not limited to, our gathering and compression and water handling services, processing and recording financial and operating data, oversight and analysis of our operations and communications with the employees supporting our operations and our customers and service providers. We also collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary information for our business and that of our customers, suppliers, investors and other stakeholders.

companyName: Antero Midstream Corp

ticker: AM


text: Attacks on our assets or security breaches in our systems or infrastructure could lead to the corruption, loss or unauthorized use of such data, delays in production or delivery of our production to customers, difficulty in completing and settling transactions, challenges in maintaining our books and records, environmental damage, communication interruptions or other operational disruptions. We seek to address these risks by safeguarding assets, data and operations through the cybersecurity risk management processes described below:


text: Risk Assessments We assess our systems, networks and data infrastructure to identify potential cybersecurity threats and vulnerabilities via continuous automated processes that are complemented by manual processes that are executed on both a routine and ad hoc basis. These processes are designed to prevent, detect and investigate activities and events that could pose a cybersecurity risk or threat to us, and include, but are not limited to, monitoring and evaluating cybersecurity intelligence information published or provided by certain United States federal government agencies as well as private cybersecurity groups. Our risk assessment processes are conducted, monitored and reviewed by our security and compliance team as well as third-party consultants. In addition, we perform cybersecurity tabletop exercises with our information technology ("IT") department throughout the year. We also engage a third-party consultant to conduct an annual penetration test of our systems, networks and data infrastructure to complement our risk assessment processes and activities. These risk assessments help evaluate the likelihood and potential impact of cybersecurity incidents.


text: Our Chief Administrative Officer ("CAO") oversees these risk assessments and meets regularly with the security and compliance team to review cybersecurity risks and threats, and also participates in our enterprise risk management process. In addition, the Company engages several third-party consultants in connection with the risk assessments, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties. All third parties involved in our cybersecurity risk assessments are required to provide reports designed to allow us to monitor and assess such third parties' security controls.


text: We monitor and manage our cybersecurity risk and threat exposure through prioritized remediation efforts. Any cybersecurity risk or threat that requires corrective action is managed by our security and compliance team together with certain business partners and IT specialists, as deemed necessary. Potential solutions are assessed in alignment with risk, business and cybersecurity priorities and our controls and security architecture. Plans to remediate cybersecurity risks are approved and monitored regularly for completion.


text: Incident Identification and Response We have implemented a monitoring and detection system, with oversight from our CAO to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have a formal incident response plan designed to provide for immediate action to contain the incident, mitigate the impact and restore normal operations efficiently.


text: Cybersecurity Training and Awareness We train our users throughout the year using a wide variety of methods on cybersecurity-related topics, including how to identify and report potential social engineering including phishing through emails, text messages and phone calls. Formal training on cybersecurity practices begins when an employee is hired and is re-administered annually. We also require third-party contractors with access to our systems be trained on these topics. In addition, special training is held both formally and informally for groups that entail higher threat risks.


text: Our IT polices are designed to address and manage all aspects of our IT environment, including cybersecurity, and we review and update our policies regularly as part of our risk management processes. We deploy both an internal Protection of Personal Identifiable Information Policy and a publicly available Privacy Notice to help us understand and respect the privacy of the individuals whose data we have custody over. We monitor our data collection practices, policies and notices in an effort to comply with the evolving nature of applicable data privacy and security laws.


text: Our cybersecurity risk management processes are integrated into our enterprise risk management program. Cybersecurity threats are understood to be dynamic and intersect with various other enterprise risks. As such, cybersecurity is considered to be an important component of our enterprise risk management approach. Our cybersecurity strategies are based on standard cybersecurity frameworks, including the National Institute of Standards and Technology and the International Organization for Standardization.


text: Board of Directors' Oversight of Cybersecurity Risks and Management's Role in Assessing and Responding to Cybersecurity Risks Cybersecurity risks are overseen at the board level through the Audit Committee. Our CAO, together with the security and compliance team, is responsible for the monitoring, assessment and management of cybersecurity risk, and seeks to maintain the security and continuity of our operations. Our CAO oversees the Company's cybersecurity strategy, cybersecurity and data privacy policies, measures and controls, and Board of Directors and Audit Committee communications on cybersecurity matters. Our CAO regularly briefs senior management, the Board of Directors and the Audit Committee on cybersecurity issues as part of our overall enterprise risk management program, including quarterly updates to the Audit Committee, which may include information regarding our exposure to privacy and cybersecurity risks, plans and activities to monitor and mitigate privacy and cybersecurity risks, IT governance policies and programs, including our cybersecurity incident response plan, and legislative and regulatory developments that could impact our privacy and cybersecurity risks. Additionally, our Vice President – Risk Management oversees our enterprise risk management process and apprises the Audit Committee and our Board of Directors of all significant risks facing the Company, including cybersecurity risks.


text: Our CAO, Aaron S.G. Merrick, has more than 25 years of experience in the technology sector and 16 years of experience in managing cybersecurity risk. Mr. Merrick was named CAO in 2022 and previously served as our Vice President – IT since 2016. Prior to joining Antero, he held IT leadership positions of increasing responsibility at Apache Corporation, including Director of IT from 2006 to 2009 and Vice President of IT from 2009 to 2015. Additionally, Mr. Merrick was President of a computer consulting business from 2002 to 2006, and he also held several positions of increasing responsibility at T-NETIX, Inc., including Vice President of IT, during his tenure from 1995 to 2000. Mr. Merrick graduated from Bob Jones University in 1984 with a Bachelor of Science degree in Accounting.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future discovery of cybersecurity incidents remains. Please see "Item 1A. Risk Factors" for additional information about cybersecurity risks. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a cyberattack with significant impact will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Processes for Assessing, Identifying and Managing Cybersecurity Risks We are continuously assessing and adopting new processes, systems and resources in an effort to make our business safer from cybersecurity threats. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with our employees and third-party customers and service providers. We also collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary information for our business and that of our customers, suppliers, investors and other stakeholders.

companyName: ANTERO RESOURCES Corp

ticker: AR


text: Cybersecurity Risk Management and Strategy The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: The Company assesses its program based on guidance from the National Institute of Standards and Technology ("NIST"). This does not imply that the Company meets any particular technical standards, specifications, or requirements, only that the Company uses the NIST as a guide to help it identify, assess, and manage cybersecurity risks relevant to its business.


text: The Company's cybersecurity risk management program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: The Company's cybersecurity risk management program includes the following, among other things: risk assessments designed to help identify material cybersecurity risks to the Company's critical systems and information;


text: cross-functional teams responsible for managing the Company's (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the Company's security processes and controls; cybersecurity awareness training of the Company's employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for certain service providers based on the Company's assessment of their criticality to its business and risk profile.


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including its operations, business strategy, results of operations, or financial condition. The Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Information Technology, Cybersecurity and Data Privacy."


text: Cybersecurity Governance The Company's Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of the Company's cybersecurity risk management program.


text: The Committee receives quarterly reports from management on the Company's cybersecurity risks. In addition, management updates the Committee, as necessary, regarding cybersecurity incidents as determined by its Chief Information Officer (the "CIO").


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the Company's cybersecurity risk management program. Members of the Board of Directors receive presentations on cybersecurity topics from the CIO or external experts as part of the Board's continuing education on topics that impact public companies.


text: The Company's management team is responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company has a Cybersecurity Steering Committee comprised of members of management, including the CIO and the Company's Director of Cybersecurity, as well as other subject matter experts throughout the Company. The Cybersecurity Steering Committee has primary responsibility for the Company's overall cybersecurity risk management program and supervises both internal cybersecurity personnel and retained external cybersecurity consultants. The experience of the members of the Cybersecurity Steering Committee includes its CIO, who has 37 years of IT experience across various industries, including 32 years in manufacturing, and who is a member of the National Association of Manufacturer's Cybersecurity Advisory Council, and its Director of Cybersecurity, who has 28 years of IT experience, including seven years leading the Company's Cybersecurity Team of IT security professionals, and who is a member of the Information Systems Audit and Control Association and the International Information System Security Certification Consortium.


text: The Cybersecurity Steering Committee supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by the Company; and alerts and reports produced by security tools deployed in the IT environment.


text: To identify and assess material risks from cybersecurity threats, our enterprise risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. We describe how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our results of operations and financial condition, under the heading " A significant disruption to our information technology systems or those of our third-party service providers could adversely affect our business and operating results" in our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.

companyName: ROYAL GOLD INC

ticker: RGLD


text: The Chief Financial Officer and Treasurer, with assistance from other members of management and contracted information technology and cybersecurity consultants (including consultants with decades of experience in information technology and cybersecurity roles), is responsible for managing our cybersecurity program, policies and strategy. Under its Charter, the Audit and Finance Committee ("AFC") of our Board of Directors is responsible for oversight of our cybersecurity program. Quarterly and annual reports are provided to our AFC and Board of Directors, respectively, on the cyber risks, threats and projects impacting our cybersecurity program. As part of our continuing effort to evaluate and enhance our cybersecurity program, including risks associated with using third-party service providers, we regularly evaluate the effectiveness of our cybersecurity policies and procedures and provide our employees with cybersecurity training on current and evolving cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: ARCH RESOURCES, INC.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, but rather that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key aspects of our cybersecurity risk management program include: risk assessments designed to help identify material cybersecurity risks to our critical systems and information;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training for our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a process to review the cybersecurity risk profile and operational criticality of the key service providers and to seek appropriate contractual cybersecurity protections.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face ongoing risks from certain cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Item 1A, "Risk Factors – Serious cyber-attacks or other security incidents that disrupt our operations or compromise proprietary or confidential information could expose us to significant liability, reputational harm, loss of revenue, increased costs and material risks to our business and results."


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of cybersecurity and other information technology risks. Our Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: Our Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates our Audit Committee, as necessary, regarding significant cybersecurity incidents. Our Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Our Board of Directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from IT leadership, which includes our Senior Vice President & Chief Administrative Officer and our Vice President of IT and CIO, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Computer Security Incident Response Team ("CSIRT") is responsible for coordinating and executing on the cybersecurity response procedures and for seeking assistance from other Company stakeholders and external advisors. Our CSIRT includes IT leadership, an Incident Commander, our Senior Vice President & Chief Financial Officer, Legal counsel, Human Resources, and Internal Audit. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team includes our Vice President of IT and CIO, who has over 20 years of experience in IT with direct experience overseeing our IT security team for the past two years.


text: Our management team and IT leadership stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Cybersecurity Risk Management and Strategy Our approach to mitigating information technology and cybersecurity risk comprises a range of activities with the primary objective of maintaining the confidentiality, integrity and availability of our critical IT Systems and information related to our business. Although IT Systems are inherently vulnerable to interruption due to a variety of sources, we have aligned our cybersecurity risk management program, including our processes and controls, with certain applicable and relevant guidelines. For example, we have aligned our processes with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and assess our cybersecurity maturity against the NIST CSF's core functions; however, this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: SKYWEST INC

ticker: SKYW


text: Our cybersecurity risk management processes include a cybersecurity incident response plan, and we have invested in technical and organizational safeguards intended to manage and mitigate material risks from cybersecurity threats to our IT Systems, including network security controls, employee training, internal vetting of third-party vendors and service providers with whom we may share data, and regular system reviews and security exercises. Our cybersecurity risk management program is a component of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: While we work closely with accredited third-party cybersecurity firms, where appropriate, to audit our security architecture, our Information Security Team, consisting of experienced cybersecurity professionals, is responsible for the day-to-day management of our cybersecurity risks, including directing our cybersecurity risk assessment processes, our security processes, and our response to cybersecurity incidents.


text: During 2021, we identified malware on our system resulting from a cyberattack. We successfully quarantined the malware without disruption to our operations. However, this quarantine required a rebuild of a triple-redundant server. While moving one of our critical systems to a newly rebuilt server, we experienced a server outage that resulted in approximately 1,700 flight cancellations. We estimate the impact of the outage negatively impacted our 2021 financial results by approximately $16 million (pre-tax). Approximately half of the loss we incurred in 2021 from this incident was recovered through our cyber insurance policy during the year ended December 31, 2023. Based on our assessment, we do not believe the incident has or will materially affect us, including our operations, business strategy, results of operations, or financial condition. For the year ended December 31, 2023, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cybersecurity incidents, hardware or software failures or other information technology disruptions may negatively impact our operations, reputation and financial condition."


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Audit Committee members also receive presentations on cybersecurity topics from our Vice President of Information Technology and Chief Financial Officer, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Financial Officer and Vice President of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our Vice President of Information Technology has more than 25 years of experience managing and leading IT and cybersecurity teams. Our Vice President of Information Technology participates in the Aviation ISAC organization, an international membership community of airframers, airlines, airports, satellite manufacturers, aviation services, and their supply chains that collaborate to prevent, detect, respond to, and remediate cyber risk through threat intelligence sharing and best practices.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Governance Related to Cybersecurity Risks Our management, with involvement and input from our audit committee, performs an annual enterprise-wide risk management (ERM) assessment to identify and manage key existing and emerging risks for our company. Our ERM process seeks to identify both the potential impacts to our company of a particular risk and the likelihood and proximity of any such risk. Our management team is responsible for implementing and overseeing our ERM process. Cybersecurity is among the risks identified for board of directors' level risk oversight as a result of our most recent ERM assessment, with our audit committee of the board of directors having been delegated responsibility for overseeing our policies, practices and assessments with respect to cybersecurity and other information technology risks.

companyName: Blueprint Medicines Corp


text: Our information security team is led by the SVP of IS, who reports to our chief financial officer. Our SVP of IS has over 25 years of experience managing and securing technology infrastructure. The information security team has responsibility for the planning and execution of our processes to manage cybersecurity and other information technology risks. The information security team also institutes and maintains controls for our systems, applications, and databases.


text: The audit committee receives periodic updates on our cybersecurity risks from our information security team, which include biannual presentations on the status of our cybersecurity risk management program by the SVP IS. These reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents, if any. In addition, as needed, management updates the audit committee regarding any material cybersecurity incidents. We have also implemented an annual process for employees to complete security awareness training.


text: Cyber Risk Management and Strategy Our processes to identify, assess, and manage risks presented by cybersecurity threats are based on the National Institute of Standards and Technology Cybersecurity Framework. Our SVP of IS, with support from the information security team, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include leveraging external third parties for security testing.


text: The information security team monitors security alerts from information security research sources and peer networking, and we have implemented processes and technologies for monitoring our networks for exfiltration of sensitive company information. Before contracting with third parties or purchasing third party technology or other solutions that involve exposure to sensitive company information the team assesses vendor risk, including by requesting SOC2 reports and/or security documentation from a vendor, where appropriate, and we receive and review security updates and alerts from these third parties. Penetration testing is performed periodically across our network boundaries to identify issues for remediation. Additionally, we maintain off-site back-ups and disaster recovery plans to restore our information and systems in the event of a disruptive event.


text: The information security team also has processes in place to inform and update management and, as needed, the audit committee about cybersecurity incidents that may pose significant risk to the company. Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' data and systems. For more information, please see " Item 1A, Risk Factors. "


text: Cybersecurity is an integral part of risk management at our company. Cybersecurity is overseen by LTC's Board of Directors (the "Board") and the Audit Committee of the Board (the "Audit Committee"), along with subject matter experts serving our company including our information technology director. Pursuant to its charter, the Audit Committee has the responsibility and duty to review and discuss with management on a regular basis our company's programs, policies and procedures related to information security and data protection, including data privacy and network security, as they relate to financial reporting. The Board and the Audit Committee receive reports on cybersecurity from management at least quarterly and more often as needed. These reports on cybersecurity typically encompasses the nature and threats, defense and detection capabilities, and training activities at our company.

companyName: LTC PROPERTIES INC

ticker: LTC


text: We routinely provide education, such as simulated phishing campaigns, to our employees to mitigate material risks from cybersecurity threats. This education includes cybersecurity training for new employees and training modules sent monthly to all employees. We also use various authentication technologies and third-party monitoring to mitigate material risks from cybersecurity threats. We annually retain a third-party vendor to test our information systems security and we annually review information systems security protocols of our vendors that interact with our financial data. We maintain insurance coverage that may, subject to policy terms and conditions, including deductibles, cover particular aspects of cybersecurity risk, such as social engineering and computer system fraud. However, it is possible such coverage may not fully insure all future costs or losses associated with all types of cybersecurity incidents such as ransomware.


text: We are not aware of any material losses to our business or results of operations in the past three years due to information technology systems failures, data breaches, or other cybersecurity incidents.


text: We have a multilayered framework for assessing, identifying, detecting and responding to reasonably foreseeable cybersecurity risks and threats. To protect our information technology, or IT, systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. In the event of a material change to our systems or operations, we would conduct an assessment of the internal and external threats to the security, confidentiality, integrity, and availability of our data and systems, along with other material risks to our operations. We leverage third-party security services for audit, benchmarking, and improvement and use various tools and methodologies to manage cybersecurity risks that are tested regularly, including a cybersecurity assessment guided by the National Institute of Standards and Technology (NIST) cybersecurity framework and ongoing security awareness training. We oversee third-party service providers by conducting vendor diligence upon onboarding and ongoing monitoring. Vendors are assessed for risk based on the nature of their digital footprint, company profile, domain name services health, internet protocol reputation, external access threats and social engineering landscapes, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, and scans or other technical evaluations. We also monitor and evaluate our cybersecurity posture and performance on an ongoing basis through regular vulnerability scans, simulated phishing tests, penetration tests, and threat intelligence feeds. The results of these assessments are reported to the Audit Committee of the Board of Directors.

companyName: IRONWOOD PHARMACEUTICALS INC

ticker: IRWD


text: We have developed an incident response plan designed to coordinate the activities that we and our third-party security service provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate any reputational damage.


text: Our business strategy, results of operations and financial condition have not been materially affected as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity-related risks, see Item 1A, Risk Factors, elsewhere in this Annual Report on Form 10-K.


text: The Company's Chief Information Officer, or CIO, is responsible for developing and implementing our information security program and reporting on cybersecurity matters to the Audit Committee of the Board of Directors and management. Our CIO has over 20 years of cybersecurity experience in various roles involving information security, developing cybersecurity strategies, and implementing cybersecurity programs.


text: Our Board of Directors is responsible for overseeing our enterprise risk management activities in general, and each of our Board committees assists the Board in the role of risk oversight. The Audit Committee of the Board of Directors oversees our cybersecurity risk and receives regular reports, with a minimum frequency of once per year, from our CIO on various cybersecurity matters, including risk assessments, mitigation strategies, areas of emerging risks, incidents and industry trends, and other areas of importance. Promptly after becoming aware of a material cybersecurity incident affecting our IT systems or data, the Audit Committee would work with management to formulate a mitigation plan and review compliance with such plan, as well as to ensure compliance with any external regulatory or disclosure requirements, including any disclosures of material cybersecurity breaches.


text: We maintain policies, procedures and controls designed to safeguard against cybersecurity incidents by protecting the confidentiality, integrity, availability and reliability of our systems, networks and information. These policies, procedures and controls are subject to monitoring, auditing, and evaluation practices, pursuant to our Enterprise Risk Management program, which is supported by a three-line defense strategy that includes, the business lines, the Enterprise Risk Management Committee, the Risk Management and Information Security Department, the Compliance Department and the Internal Audit Department. Further, we have developed and conduct at least annually cybersecurity and data privacy training programs for our employees and our third-party consultants who have access to our systems. At least annually, we also conduct simulations, tabletop exercises, independent third-party cybersecurity penetration assessments, and response readiness tests. In addition, the information technology systems of our self-regulatory organizations are subject to periodic reviews, audits, and inspections by regulatory authorities. We also conduct diligence on cybersecurity practices in connection with our overall risk assessment when evaluating expansion into new regions, strategic opportunities, and new products.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: We engage assessors, consultants, auditors and other third parties in connection with developing and evaluating our overall risk management framework. Additionally, our internal audit team periodically engages third parties to co-source internal audits of our information security processes. We strive to utilize best practices in our information security management and follow applicable industry standards.


text: In support of our risk management framework, we maintain a vendor management policy and program to manage third-party risk. Embedded in our vendor management policy is a defined process to assess the risks related to new vendors. Vendors deemed to be high risk are re-assessed annually. These assessments include security questionnaires and reviews of Service Organization Controls (SOC) Reports, where applicable. Cboe uses a third-party service to help monitor the security posture of our vendors that process and/or store confidential Cboe information.


text: We have committees, response and management teams, and dedicated positions for managing and assessing cybersecurity risk, including a Chief Information Security Officer, a Chief Risk Officer, an Enterprise Risk Management Committee and a dedicated internal information security team. Our Chief Information Security Officer and Chief Risk Officer have extensive experience in the industry. Our Chief Information Security Officer has over 20 years of experience leading information security programs including 12 years of experience in cybersecurity consulting, building efficient and sustainable cybersecurity programs for large, complex and heavily regulated global enterprises. Our Chief Information Security Officer is currently responsible for developing and executing the Company's global security strategy and roadmap along with its long-range plan to meet industry and regional regulatory compliance requirements. We have an information security department with associates who are located around the globe. Our Chief Risk Officer's tenure with Cboe spans 23 years, during which time he has held senior positions in information security and risk management. He is currently responsible for oversight of the Company's risk function including the enterprise risk management, information security, privacy, vendor management, and IT asset management programs.


text: Our incident response team is responsible for identifying potential cybersecurity incidents and communicating information regarding the nature and severity of the incident to senior management and others as required by the Company's written Incident Response Plan. Cybersecurity incidents are tracked pursuant to our incident monitoring processes defined within the Incident Response Plan. Potential cybersecurity incidents may also be reported to our Disclosure Committee to determine if further action and/or public disclosure is required. We have also put in place a vulnerability management program through which our systems are routinely scanned to help identify vulnerabilities and track remediation activities.


text: The Board recognizes that our business depends on the confidentiality, integrity, availability, performance, security, and reliability of our data and technology systems and devotes time and attention to the oversight of cybersecurity and information security risk. In particular, the Board's Risk Committee receives recurring updates and reports on information security-related topics from senior management, including from the Company's Chief Compliance Officer, Chief Risk Officer, and Chief Information Security Officer. More specifically, the Risk Committee receives recurring presentations from senior management on cybersecurity, including architecture and resiliency, incident management, business continuity and disaster recovery, significant information technology changes, data privacy, insider threats, physical security, information related to third-party cyber assessments and risks associated with the use of third party service providers. The Risk Committee also reviews and approves any changes to the related information security and privacy program charter. Further, summaries of the proceedings from prior Risk Committee meetings are provided to the Board on a routine basis.


text: We have experienced in the past, and we expect to continue to experience, cybersecurity threats and events of varying degrees. However, we are not aware of any of these threats or events having a material impact on our business or our business strategy, results of operations or financial condition results to date. We cannot assure you that we will not experience future threats or events that may be material. Please also refer to the risk factors above for additional information.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board of Directors and the Board's Audit Committee through our annual ERM assessment. Our cybersecurity policies and practices follow the cybersecurity framework of the National Institute of Standards and Technology and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) maintaining the confidence of our customers, clients and business partners; (iii) preserving the confidentiality of our employee's information; and (iv) protecting the Company's intellectual property.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Vigilance: The Company maintains a global presence, with cybersecurity threat operations operating 24/7 around the world with a specific goal of detecting, containing and responding to cybersecurity threats and incidents.


text: Collaboration: The Company has established collaboration mechanisms with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers to identify and assess cybersecurity risks.


text: Systems Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments.


text: Third-Party Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, such as vendors, service providers and other users of the Company's systems.


text: Education: The Company provides periodic training for personnel regarding cybersecurity threats, with such training scaled to reflect the roles, responsibilities, and access of the relevant Company personnel.


text: Incident Response Planning: The Company has established and maintains incident response plans that address the Company's response to a cybersecurity incident, and such plans are tested on an ongoing basis.


text: Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats and has formed an Information Security Leadership Group which includes management personnel from information technology, operations, legal, internal audit and other key business functions. The Information Security Leadership Group typically meets on a monthly basis, and more frequently as necessary.


text: Governance: Pursuant to the Company's ERM practices, oversight of cybersecurity risk management has been assigned to the full Board and to the Board's Audit Committee. Quarterly updates are provided by Company management, including the Company's Chief Information Security Officer, to the Audit Committee (three times per year) and the full Board (annually), to help ensure an ongoing dialogue regarding the Company's cybersecurity initiatives, threats and incidents.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises and other exercises focused on evaluating effectiveness. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness and adjusts its cybersecurity processes and practices as necessary.


text: The Audit Committee oversees the management of risks from cybersecurity threats, including the policies, processes and practices that the Company's management implements to address risks from cybersecurity threats. Management's quarterly presentations include reports on a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and vendors. The Board also receives prompt and timely information regarding any cybersecurity incident that could pose a significant risk to the Company and receives ongoing updates regarding such incident until it has been addressed. At least once each year, and more frequently as required, the Board discusses the Company's approach to cybersecurity risk management with the Company's Chief Information Security Officer.


text: The Company's Chief Information Security Officer is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other members of the Information Security Leadership Group. Our Chief Information Security Officer has served in various roles in information technology and information security for over twenty years. Our Chief Information Security Officer holds graduate degrees in cybersecurity and business administration and has attained multiple professional certifications including CISSP, CISA and CISM.


text: The Company's Chief Information Security Officer, in coordination with the Information Security Leadership Group, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response plan. Through ongoing communications with these teams, the Chief Information Security Officer and the Information Security Leadership Group monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Board when appropriate, as addressed above.


text: While we and our third-party providers have in the past experienced cybersecurity incidents, we are not aware of any current incidents or new types of threats which have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Liberty Broadband's corporate level IT and cybersecurity functions are provided by Liberty as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in Liberty's processes for assessing, identifying, and managing risks from cybersecurity threats at the corporate headquarters, as detailed below. GCI operates its own cybersecurity function with oversight from Liberty Broadband.

companyName: Liberty Broadband Corp

ticker: LBRDA


text: Charter, an equity method affiliate, as a separate publicly traded company from Liberty Broadband, operates its own cybersecurity function. Oversight for Charter's cybersecurity functions rests with its board of directors and Audit Committee of which our Chief Executive Officer is a member.


text: We are committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, have implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.


text: Cybersecurity risks are assessed as part of our enterprise risk assessment and risk management program and our cybersecurity risk management program is designed and assessed based on recognized frameworks, including the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF").


text: We rely on a multidisciplinary team, including our information security function, legal department, management, and third-party consultants, as described further below, to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, Security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our board of directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at GCI. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our businesses, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third-party consultants, legal advisors and assessors to keep us appraised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: For additional information on our cybersecurity risks, see "Risk Factors" under the section entitled "Cyberattacks or other network disruptions could have an adverse effect on our company and GCI's business" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Role of the Board of Directors Our board of directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full board of directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full board of directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and board of directors informed and to monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through our services agreement with Liberty discussed in Item 1 of this 10-K, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level and our subsidiaries.


text: At GCI, there is an Enterprise Security Office ("ESO"), led by the Chief Information Security Officer ("CISO"), which is responsible for day-to-day management and oversight of subsidiary cybersecurity, including assessing, monitoring and mitigating cybersecurity risk. The CISO provides regular reporting to GCI executive management and the ISSC.


text: Liberty Broadband has also established a Compliance Committee responsible for overseeing and monitoring all corporate compliance initiatives at GCI, including cybersecurity. The Compliance Committee is composed of members of Liberty Broadband's ISSC as well as GCI's executive leadership team, including the President & Chief Operating Officer, General Counsel, and Chief Financial Officer. The CISO reports periodically to the Compliance Committee on cybersecurity risks and initiatives as well as any cybersecurity events, as applicable.


text: Our management team's experience includes a diverse background in telecom and other industries, with decades of experience in various aspects of cybersecurity. Liberty's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. GCI's CISO has more than 20 years of experience and hold multiple certifications including Certified Information Security Systems Professional and Certified in Risk and Information System Control. Both have worked at a variety of companies, including large publicly traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data.


text: Risk Management and Strategy TripCo's corporate level IT and cybersecurity functions are provided by Liberty Media as part of the services agreement described in Item 1. Business. Through the services agreement, we participate in Liberty Media's processes for assessing, identifying, and managing risks from cybersecurity threats, as detailed below. Tripadvisor, as a separate publicly traded company from TripCo, operates its own cybersecurity function. While primary oversight for Tripadvisor rests with its board of directors and Audit Committee, we receive regular reporting from Tripadvisor management and collaborate with those tasked with oversight to ensure risks are appropriately addressed.

companyName: Liberty TripAdvisor Holdings, Inc.


text: The Company is committed to protecting the security and integrity of our systems, networks, databases and applications and, as a result, has implemented processes designed to prevent, assess, identify, and manage material risks associated with cybersecurity threats.


text: We rely on a multidisciplinary team, including our information security functions, legal departments, management, and third-party consultants, as described further below, at the corporate level and at Tripadvisor to identify, assess, and manage cybersecurity threats and risks. We identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and our risk profile using various methods including, using manual and automated tools, such as vulnerability scanning software, monitoring existing and emerging cybersecurity threats, analyzing reports of threats and threat actors, conducting scans of the threat environment, evaluating our industry's risk profile, utilizing internal and external audits and assessments, and conducting threat and vulnerability assessments.


text: To manage and mitigate material risks from cybersecurity threats to our information systems and data, we implement and maintain various technical, physical and organizational measures, processes and policies. These measures include risk assessments, incident detection and response, vulnerability management, disaster recovery and business continuity plans, internal controls within our IT, Security and other departments, encryption of data, network security controls, access controls, physical security, asset management, system monitoring, vendor risk management program, employee cybersecurity awareness and training, phishing tests, and penetration testing. Cybersecurity awareness training is also made available annually to our Board of Directors.


text: In the event of a potential cybersecurity incident, or a series of related cybersecurity incidents, we have cybersecurity incident response frameworks in place at the corporate level and at Tripadvisor. These frameworks are a set of coordinated procedures and tasks that our incident response teams execute with the goal of ensuring timely and accurate identification, resolution and reporting of cybersecurity incidents both internally and externally, as necessary.


text: To operate our business, we utilize certain third-party service providers to perform a variety of operational functions. We have implemented a third-party risk management program to evaluate the cybersecurity practices of higher risk vendors and vendors that encounter our systems or data. We additionally engage and retain third party consultants, legal advisors and assessors to keep us apprised of emerging third-party risk, defense and mitigation strategies, and governance best practices.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition As of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations and financial condition.


text: For additional information on our cybersecurity risks, see "Risk Factors" under the section entitled "Risks Related to Information Security, Cybersecurity and Data Privacy" in Part I, Item 1A of this Annual Report on Form 10-K.


text: For additional information on Tripadvisor's cybersecurity program and risks refer to Item 1C in their 2023 Form 10-K filed on February 16, 2024.


text: Role of the Board of Directors Our Board of Directors has overall responsibility for risk oversight and has delegated to the Audit Committee primary enterprise risk oversight responsibility, including privacy and cybersecurity risk exposures, policies and practices, the steps management takes to detect, monitor and mitigate such risks and the potential impact of those exposures on our business, financial results, operations and reputation. The Audit Committee receives quarterly updates on the enterprise risk management program, including cybersecurity risks and the initiatives undertaken to identify, assess and mitigate such risks. This cybersecurity reporting may include threat and incident reporting, vulnerability detection reporting, risk mitigation metrics, systems and security operations updates, employee education initiatives, and internal audit observations, if applicable. In addition to the efforts undertaken by the Audit Committee, the full Board of Directors regularly reviews matters relating to cybersecurity risk and cybersecurity risk management. Any material cybersecurity events would be brought to the attention of the full Board of Directors once the event is deemed material. We additionally use our incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Role of Management Through our services agreement with Liberty Media, we have established a cross functional Information Security Steering Committee ("ISSC") with executives from our Legal, Accounting, Internal Audit and Risk Management, Cybersecurity and Facilities departments. The ISSC has management oversight responsibility for assessing and managing technology and operational risk, including information security, fraud, vendor, data protection and privacy, business continuity and resilience, and cybersecurity risks at the corporate level. The ISSC receives regular reports and updates from Tripadvisor regarding their cybersecurity risk management activities and, if any, incidents that have occurred.


text: Tripadvisor also has executive oversight committees responsible for assessing and managing cybersecurity risk as part of their enterprise risk management and compliance programs. Tripadvisor has designated the Compliance Committee and Chief Compliance Officer ("CCO") with day-to-day management and oversight of corporate compliance initiatives, including cybersecurity. The Tripadvisor Compliance Committee consists of, among others, the Chief Financial Officer, Chief Legal Officer and CCO. The CCO has further established an Information Governance and Privacy Committee responsible for oversight of privacy and cybersecurity risks. The Information Governance and Privacy Committee consists of the Chief Information Security Officer ("CISO") and CCO, as well as representatives from engineering, product development and data privacy. The Information Governance and Privacy Committee meets regularly to discuss and monitor information uses and governance and risks associated with Tripadvisor's information assets, including prevention, detection, mitigation and remediation of risks from cybersecurity threats.


text: Our management team's experience includes a diverse background in telecom and other industries, with decades of experience in various aspects of cybersecurity. Liberty Media's Head of Cybersecurity has more than 25 years of cybersecurity and information technology experience and holds Certified Information Security Manager and Certified in Risk and Information System Control certifications. Tripadvisor's CISO is a Certified Information Security Systems Professional with more than 15 years of experience in building and leading information security teams. Both have worked at a variety of companies, including large publicly-traded companies, implementing and managing IT and cybersecurity programs and teams, developing tools and processes to protect internal networks, customer payment systems and telecommunications networks used by customers to transmit data.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, computer hardware and software, and our critical data includes proprietary, confidential and sensitive data, including, without limitation, personal data (such as health-related data), intellectual property and trade secrets (collectively "Information Assets"). Accordingly, we maintain certain risk assessment processes intended to identify cybersecurity threats, determine their likelihood of occurring, and assess potential material impact to our business. Based on our assessment, we implement and maintain risk management processes designed to protect the confidentiality, integrity, and availability of our Information Assets and mitigate harm to our business.

companyName: BICYCLE THERAPEUTICS PLC

ticker: BCYC


text: Risks from cybersecurity threats are among those that we address in our general risk management program. We rely on a multidisciplinary team (including personnel from our information security function, management and third-party service providers, as needed, as described further below) to help identify, assess and manage our risks. We identify and assess such threats by, among other things, monitoring and evaluating the threat environment using various methods, including, for example, manual and automated tools, information security tools and platforms to alert us to potentially unwarranted activity on our networks, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting threat assessments for internal and external threats, and conducting risk and vulnerability assessments to identify vulnerabilities.


text: Depending on the environment, we implement and maintain various technical, physical and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Assets. For example, the risk management and reduction measures we implement for certain of our Information Assets include: policies and procedures designed to address cybersecurity threats, including an incident response plan, vulnerability management, and disaster recovery/business continuity plans; incident detection and response solutions; internal and/or external audits to assess our exposure to cybersecurity threats; documented risk assessments; implementation of certain security standards/certifications; encryption of data; network security controls; data segregation; physical and electronic access controls; physical security; asset management, tracking and disposal; systems monitoring; employee security training; penetration testing; and cyber insurance. In addition to the above, management obtains a third-party review and formal certification of its information management system policies and procedures, which has been collated into an Information Security Management System (ISMS) which is maintained to ISO 27001 standards.


text: We work with third parties from time to time that assist us to identify, assess, and manage cybersecurity risks, including professional services firms, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms and other vendors that help to identify, assess, or manage cybersecurity risks.


text: To operate our business, we utilize certain third-party service providers to perform a variety of functions, such as outsourced business critical functions including contract research organizations, or CROs, for managing clinical trials, professional services, SaaS platforms, managed services, property management, cloud-based infrastructure, data center facilities, content delivery to customers, encryption and authentication technology, corporate productivity services, and other functions. We generally engage reliable, reputable service providers that maintain cybersecurity programs. Depending on the nature of the services provided, the sensitivity and quantity of information processed, and the identity of the service provider, our vendor management process may include reviewing the cybersecurity practices of such provider, contractually imposing obligations on the provider related to the services they provide and/or the information they process, conducting security assessments, requiring their completion of written questionnaires regarding their services and data handling practices, and conducting periodic re-assessments during their engagement.


text: For service providers that provide particularly critical services to us or process particularly sensitive information for us, we may also require that such providers possess at least one of the following certificates, reports, or procedures: SOC 2 Type 2; ISO 27001; annual penetration tests; and/or red/blue team tests.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including the risk factor titled: Cyber-attacks or other failures in telecommunications or information technology systems and deficiency in our, or those of third parties upon which we rely, cybersecurity could result in information theft, data corruption and significant disruption of our business operations.


text: Our cybersecurity risk management strategy relies on input from management, including our Vice President, Technology & Information Security, who reports directly to our Chief Operating Officer, and has over ten years of experience in developing and implementing cybersecurity strategies for companies in the biopharmaceutical industry, as well as our Chief Financial Officer and General Counsel. We have also formed an Information Risk Assessment Committee, or IRAC, consisting of senior members of the finance, legal, operations and information technology functions, to oversee the management of information security as a whole, including integrating cybersecurity considerations into the company's overall risk management strategy, and for communicating key priorities to employees. The IRAC meets on a regular basis, generally quarterly, to discuss cybersecurity risk and to review our cybersecurity program.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our incident response team, which includes, but is not limited to, our Vice President, Technology & Information Security, General Counsel and Chief Financial Officer. In addition, our incident response processes include reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Management, including the IRAC, is also responsible for approving budgets, helping prepare for cybersecurity incidents, responding to cybersecurity incidents, approving cybersecurity policies and procedures, reviewing audit reports, and reporting to the board of directors.


text: Our board of directors oversees our risk management strategy with respect to cybersecurity threats. The board, through its Audit Committee, holds regular meetings, at least quarterly, to discuss issues including our cybersecurity threats. The meetings involve presentations and reports from our management, including our Vice President, Technology & Information Security, concerning our significant cybersecurity threats and risks and the processes we have implemented to address them.


text: Risk Management and Strategy We recognize the critical importance in developing, implementing and maintaining robust cybersecurity measures and processes that are designed to safeguard our information systems and to assess, identify and manage material risks from cybersecurity threats.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: The fundamental controls of our cybersecurity program are based around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We engage qualified third-party consultants and advisors to conduct risk and vulnerability assessments to evaluate our systems and to advise us on cybersecurity risk management processes. We maintain a robust vulnerability-management program to evaluate our systems on a monthly basis, and we prioritize remediation efforts based on risk level and criticality of the system or data. We conduct comprehensive penetration testing with external consultants on our enterprise environment and our own products on at least an annual basis.


text: Cybersecurity risk management is an integral part of our technology modernization program. It is integrated into our business, as well as the broader software and digital environment. Our technology modernization program will move many of our core applications to industry-specific healthcare cloud solutions that offer robust HIPAA compliant, data security capabilities and tools. Our modernization plans revolve around simplifying our technology estate to reduce technical debt, automate security functions, and enable applications to take full advantage of best-practice, cloud security capabilities.


text: Our cybersecurity risk management process includes assessment of third-party service providers, suppliers and other business partners' ability to maintain compliance with our cybersecurity requirements, including review of Service Organization Control Type 2 ("SOC 2") reports and security controls. Our onboarding process for any third-party service provider includes execution of a business associate agreement that defines the service provider's responsibility to notify us in the event of any known or suspected cyber incident.


text: We maintain a thorough business continuity and resilience program designed to ensure our operations will withstand significant disruption and minimize impact on our patients and employees in the face of a significant challenge. Using standards developed by Disaster Recovery Institute International (DRII), we regularly conduct a business impact analysis to determine risk level, assess impact severity and prioritize business processes based on company needs.


text: As part of our monitoring process, we perform tabletop exercises at least annually to test our current plans. These cross-functional exercises involve employees from multiple departments and are designed to gain perspective, collect feedback and validate plan effectiveness. The information obtained from the business impact analysis, exercises and testing is utilized to update contingency plans for each department.


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: The Audit Committee of the Board of Directors oversees our cybersecurity and risk management programs, and receives updates from our Information Security and Compliance teams regarding the effectiveness of these programs on a quarterly basis. These reports include descriptions of security incidents and observed trends in threat activity, new programs and tooling designed to address developing areas of risk, and performance reporting of third-party testing, including security awareness training and cybersecurity assessments. The full Board of Directors has general oversight of the Company's risk management programs, which include cybersecurity risks, and the Audit Committee provides regular reports to the full Board of Directors related to cybersecurity matters and related risk oversight.


text: The Company's Director of Information Security reports to our Chief Information Officer. Our Director of Information Security is responsible for our cybersecurity program, develops and publishes security policies and procedures, and reports to the Audit Committee on the effectiveness of our security program. Our Director of Information Security has 24 years of technology leadership experience, including 18 years directly overseeing cybersecurity programs in the healthcare device manufacturing industry, and holds the Certified Information Systems Security Professional (CISSP) certification. Our Director of Information Security is responsible for the Company's Information Security Awareness Program, which includes security training for new hires and ongoing education for all staff, including annual refresher training and periodic bulletins regarding security risks. Security awareness email testing is performed on a monthly basis, with employee performance reported to management for inclusion in performance evaluations. Our Director of Information Security also performs risk assessments of third-party partners, including reviews of SOC 2 reports.


text: Risk management and strategy Ball Corporation is committed to maintaining a strong cybersecurity posture. We have a dedicated, globally distributed information security team that is responsible for leading information security strategy, standards and processes, which are integrated into our comprehensive enterprise risk management process.

companyName: BALL Corp

ticker: BALL


text: The company employs a standards-based cybersecurity program aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), including ongoing assessment and continuous improvement to address the rapidly evolving threat landscape. Ball partners closely with a strong network of external partners, including conducting annual assessments of the cyber risk management program against the NIST CSF.


text: Our information security team has designed and implemented formal processes for assessing, identifying and managing material risk from cybersecurity threats, both internally and related to the use of third-party service providers. Ball has strategically integrated its cyber incident assessment process with its well-defined incident response plan and processes.


text: In addition, we have aligned our incident response plan and process with our enterprise risk and global crisis management processes. These critical linkages ensure that we have an effective and efficient overall response to potential threats, with appropriate leadership governance involved in the ongoing cyber materiality assessment and determination.


text: In response to the ever-evolving cyber threat landscape, Ball utilizes external experts to support continuous improvement across our cyber program, processes and operations. This includes involving independent cybersecurity assessors and auditors to perform ongoing evaluation of our cyber program and operational maturity. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on cyber enhancements. These partnerships enable us to leverage specialized knowledge and insights to ensure our cybersecurity strategy and improvements remain aligned to critical improvements and address relevant threats and risks for Ball. In addition, we also augment and extend our cyber team, using a select few, trusted third-party partners, integrated as members of our global operations. This provides us with expanded global threat intel and enhances our ability to deliver continuous, global cyber operations 24/7.


text: We are aware of the increasing risks associated with third-party service providers and have implemented processes to oversee and manage these risks. Prior to engaging with third-party providers, Ball conducts thorough security assessments and also performs ongoing monitoring to ensure compliance with our cybersecurity standards. Third-party cyber incidents follow our incident response plan and processes, including full assessment and remediation. Our oversight of third-party cyber risk aids our ability to lessen and mitigate impacts related to data breaches and other security incidents originating from third-parties.


text: Ball faces risks from cybersecurity threats that could have a material adverse effect on the company, including its business strategy, results of operations, financial condition and reputation. Ball experiences cyber threats in the normal course of its business; however, prior cybersecurity incidents have not materially affected the company. Refer to Item 1A, Risk Factors – Technological Risks, for additional details on cybersecurity risks that could potentially materially affect the company, including its business strategy, results of operations, financial condition and reputation.


text: Ball's Chief Information Security Director (CISD) reports to the Senior Vice President and Chief Information Officer (CIO) and leads the company's cybersecurity team. The CISD is responsible for overseeing cybersecurity, including assessing and managing cybersecurity risk, and together with the CIO, providing comprehensive briefings to the executive leadership team with respect to the cybersecurity program and emerging or potential cybersecurity risks. The cybersecurity team has extensive experience selecting, deploying, and operating cybersecurity technologies, strategies and processes, and couples this knowledge with the use of external experts employed by Ball to protect the company from cyber threats.


text: Through our global security incident management plan, we aim to prevent potential cybersecurity incidents from becoming material with early detection, escalation, mitigation and remediation activities. If a cybersecurity threat is at risk of materially affecting our company, our cross-functional response team will enact our escalation processes to notify appropriate levels of management, along with the executive leadership team, disclosure committee, and Board of Directors, as necessary.


text: Our Board of Directors is responsible for providing oversight and governance with respect to IT and cybersecurity matters, which includes providing oversight over disclosure controls and procedures related to any cybersecurity breach occurrences and IT matters. Annually, the CIO briefs the Board of Directors on the company's cybersecurity posture, the effectiveness of its risk management strategies, and the emerging threat landscape, which creates alignment of cybersecurity efforts with Ball's risk management framework.


text: Strategy and Risk Management To mitigate cybersecurity risks we have adopted a process of continuous improvement and adaptation to the ever-changing threat landscape. As part of this process, we engage with industry-leading managed security service provider(s) to supplement our efforts in preventing, identifying and responding to cybersecurity threats. Our information technology operations, information security processes and CIRP are generally aligned with the National Institute of Standards and Technology's framework.

companyName: JBG SMITH Properties

ticker: JBGS