text: RISK MANAGEMENT AND STRATEGY Information security risk includes the risk that cyber incidents and threats could result in a failure or interruption of our business operations. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Cybersecurity threats are potential unauthorized occurrences on or conducted through information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. Information systems are any electronic information resources, owned or used by us, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our information to maintain or support our operations. We have implemented processes to identify, assess, and manage material risks from cybersecurity incidents or threats that may directly or indirectly impact our business strategy, results of operations, or financial condition. Please refer to " Item 1A. Risk Factors " for additional information on our operational risk, which includes the risk of failures or interruptions in information systems resulting from cybersecurity threats or incidents.

companyName: Federal Home Loan Bank of Des Moines


text: Our cybersecurity program is designed to identify, assess, and manage material risks from cybersecurity threats and to protect the confidentiality, integrity, and availability of our IT assets and data. We utilize a widely adopted industry framework to guide and benchmark the activities of our information security program in alignment with our risk appetite statement. Our cybersecurity program includes specific controls and processes for the monitoring, mitigation, and reporting associated with cybersecurity risks. For example, administrative, physical, and logical controls are in place for identifying, monitoring, and controlling system access, sensitive data, and system changes. In addition, we employ an information security training program that includes security training lessons and phishing exercises for all employees as well as mandatory staff training on cyber risks. We also regularly engage with third-parties to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include, among other things, penetration testing, detection and response services, cybersecurity tabletops, and cybersecurity framework assessments. We also maintain cyber insurance coverage in an effort to reduce financial losses stemming from a security incident.

secItem: Item 1C


text: To ensure the continuance of our operations in the event of a cybersecurity incident or threat, we have established an Information Security Policy and Security Incident Response Plan, and have adopted a business continuity management program.


text: Our Information Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of Bank information in accordance with Finance Agency regulations, the Gramm-Leach-Bliley Act and the interagency guidelines issued thereunder, and applicable laws.


text: Our Security Incident Response Plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to senior management and the Board of Directors. The Security Incident Response Plan requires management to assess materiality of the threat or incident for purposes of public disclosure.


text: Our Security Incident Response Plan includes third-party cybersecurity incidents and threats, as we do rely on third-party information systems and other technologies. As part of our vendor risk management process, we undertake due diligence of third-party systems with whom we interact, including risk profiling and classification, in addition to requiring data protection covenants in our vendor agreements. Our vendor risk management program includes regular reviews and oversight of service providers, including performance and technology reviews, and escalation of any unsatisfactory reviews.


text: Our business continuity management program is designed to ensure that necessary resources are in place to protect us from potential loss during a disruption, which includes the unavailability of IT assets due to unintentional events like fire, power loss, and other technical incidents, such as hardware failures.


text: During the period covered by this report, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, did not have a material impact on our business strategy, results of operations, or financial condition. Cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significantly harmful consequences to us, our members, and their customers. We are prepared to assess materiality of any such cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect the privacy of the data they or their customers have entrusted to us, lost revenue, disruption of business operations, increased operating costs, litigation, and reputational harm.


text: Our Information Security Department is led by the CIO, who reports to the President and CEO. Our CIO establishes our strategic direction and provides executive support for our information security program, and has significant experience in information systems and information security. Refer to " Item 10. Directors, Executive Officers and Corporate Governance " for more information.


text: Our dedicated Information Security Department is comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk, including the processes and procedures to mitigate and implement protective, proactive, and reactive measures to protect us against this risk. Personnel in this department hold a variety of technical certifications relevant to their job functions and engage in continuing education. This department is also responsible for developing, documenting, and approving our technical information security control standards, guidelines, and procedures designed to preserve the confidentiality, integrity, and availability of our IT assets and data under our control.


text: Our Technology and Operations Committee provides independent and integrated oversight over our information security program, physical security program, business continuity program, security policies and procedures, and security exceptions and violations. This committee is comprised of leadership representatives from our operational risk, information security, IT, and legal departments, as well as other departments that provide both specific, technical and multidisciplinary expertise to the committee. This committee is responsible for reviewing and approving our Information Security Policy. It also receives regular, prompt, and periodic information from the Information Security Department, which in turn provides periodic, regular and prompt reporting to the Technology Committee of the Board of Directors on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted us, as well risk assessment, management, and monitoring updates, as applicable or needed.


text: Our Board of Directors is responsible for the oversight of our information security program and establishes our information security risk appetite. The Technology Committee of our Board approves certain Bank-wide governing policies, including our Information Security Policy, as well as other standards, guidelines, and procedures for IT and information security. It also oversees the development of mitigation plans, monitors the tactical implementation of policy, and engages in detailed risk assessments.


text: Our Board of Directors receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics. These topics include, but are not limited to, updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources, environmental threats and vulnerability assessments, and efforts to prevent, detect, and respond to potential gaps, internal and external incidents and critical threats. At least quarterly, our Board of Directors discusses cybersecurity and information security risks with our CIO. Our Board of Directors is also required to complete cybersecurity training and participate in a cloud computing education session annually. Our policies and processes are designed such that the Board of Directors would receive prompt and timely information from Bank management on any cybersecurity or information security incident or threat that may pose significant risk to us and would continue to receive regular reports on any incident until its conclusion.


text: Our Technology and Operations Committee provides independent and integrated oversight over our information security program, physical security program, business continuity program, security policies and procedures, and security exceptions and violations. This committee is comprised of leadership representatives from our operational risk, information security, IT, and legal departments, as well as other departments that provide both specific technical and multidisciplinary expertise to the committee. This committee is responsible for reviewing and approving our Information Security Policy. It also receives regular, prompt, and periodic information from the Information Security Department, which in turn provides periodic, regular, and prompt reporting to the Technology Committee of the Board of Directors on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted us, as well as risk assessment, management, and monitoring updates, as applicable or needed.


text: Our Board of Directors is responsible for the oversight of our information security program and establishes our information security risk appetite. The Technology Committee of our Board approves certain Bank-wide governing policies, including our Information Security Policy. It also oversees the development of mitigation plans, monitors the tactical implementation of policy, and reviews detailed risk assessments.


text: Our Board of Directors receives regular presentations and reports throughout the year on cybersecurity and information security addressing a broad range of topics. These topics include, but are not limited to, updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources, environmental threats and vulnerability assessments, and efforts to prevent, detect, and respond to potential gaps, internal and external incidents, and critical threats. At least quarterly, our Board of Directors discusses cybersecurity and information security risks with our CIO. Our Board of Directors is also required to complete cybersecurity training and participate in a cloud computing education session annually. Our policies and processes are designed such that the Board of Directors would receive prompt and timely information from Bank management on any cybersecurity or information security incident or threat that may pose significant risk to us and would continue to receive regular reports on any incident until its conclusion.


text: FHLBank is subject to cybersecurity incident and threat risk. A cybersecurity incident is an unauthorized occurrence, or a series of related unauthorized occurrences, through information systems that jeopardizes the confidentiality, integrity, or availability of our information systems or any information residing therein. Cybersecurity threats are potential unauthorized occurrences on or conducted through information systems that may result in adverse effects on the confidentiality, integrity, or availability of information systems or any information residing therein. Information systems are any electronic information resources, owned or used by FHLBank, including physical or virtual infrastructure controlled by such information resources, or their components, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of our information to maintain or support our operations. Please refer to Item 1A – "Risk Factors" for a description of cybersecurity incident and threat risk. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats or incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition.

companyName: Federal Home Loan Bank of Topeka


text: Our cybersecurity risk management framework for assessing, identifying, and managing material risks from cybersecurity threats is designed to protect the confidentiality, integrity, and availability of the information technology assets and data under our control.


text: Cybersecurity risk management is part of our Enterprise Risk Management (ERM) Program, which includes specific controls and processes for mitigation, monitoring and reporting associated with those risks. Those controls and processes include the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The Risk Oversight committee of the board of directors oversees and annually reviews and recommends for approval and the full board of directors annually reviews and approves our Enterprise Security Policy, Security Incident Response Plan, and Business Resiliency Management Policy.


text: The Enterprise Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of FHLBank physical and information assets in accordance with the GLB Act and the interagency guidelines issued thereunder, and applicable laws.


text: The Security Incident Response Plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the Risk Oversight committee and the full board of directors. The Security Incident Response Plan also requires assessment of materiality of the threat or incident for the purposes of public disclosure.


text: The Business Resiliency Management Policy is designed to ensure our critical business functions remain available during business disruptions and to minimize the impact of such disruptions, including the unavailability of information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. The Business Resiliency Management Policy includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for FHLBank to operate.


text: We regularly engage with third parties to assist in the testing, maintenance, and development of our cybersecurity risk management practices and to assess, identify, and manage cybersecurity incident and threat risk.


text: Our cyber incident response plan includes third-party cybersecurity incidents and threats. Through our vendor management program, we undertake due diligence of third-party systems with which we will interact and vendors with whom we will interact, including regular reviews and oversight of these service providers through performance and technological reviews and escalation of any unsatisfactory reviews.


text: During the period covered by this report, risks from cybersecurity threats did not have a material impact on our strategy, results of operations, or financial condition. We have experienced cybersecurity incidents in the past, though none have had a material effect on our financial condition or results of operations.


text: Additional cybersecurity incidents may occur in the future and any such cybersecurity incident could result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of any such cybersecurity incident from several perspectives including, but not limited to, our ability to continue to service our members and protect the privacy of the data their customers have entrusted to us, lost revenue, disruption of business operation, increased operating costs, litigation, and reputational harm.


text: Cybersecurity Governance Our board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. Our board of directors oversees the Enterprise Risk Management (ERM) Program, the Enterprise Security Program and Information Security through policies and principles including the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The board of directors oversees management's approach to staffing, policies, processes, and practices to gauge and address cybersecurity and information security risk.


text: Our board of directors has oversight of our ERM Program, the Enterprise Security Program, and Information Security areas which include risks from cybersecurity threats and has approved specific controls for the mitigation, monitoring and reporting associated with those risks. The Risk Oversight Committee and Operations Committee of the board of directors receive regular reporting (at least quarterly) on the risks and are responsible for overseeing the risks, including receiving Enterprise Security Program updates from the information security officer (ISO), Information Technology status updates, and reviewing enterprise risk analysis and status information, and annually reviews the Business Resiliency Management Policy and Program.


text: Our Enterprise Security Program is led by the ISO. The ISO reports to the Chief Risk Officer (CRO). FHLBank's Information Security area is led by the Director of Information Security, who reports to the Chief Information Officer. The Business Resiliency Management Program is led by the Director of Vendor Risk and Business Resiliency, who reports to the Associate CRO.


text: We have a Technology Committee, which reviews and discusses all technology-related methodologies and initiatives related to information/cybersecurity, among other topics. The Technology Committee is a management committee and reports to the Strategic Operations Management Committee (SOMC). We also have an Operations Risk Committee (ORC), which is a management committee, and is the secondary venue for reviewing enterprise security initiatives. The ORC also serves as the primary governance venue for the Business Resiliency Management Program and escalates business resiliency concerns and risk issues, among other matters, to the Strategic Risk Management Committee (SRMC). The ORC, is responsible for annually reviewing and providing recommendations on FHLBank's Security Incident Response Plan and receives monthly updates on the Enterprise Security Program. The ISO is a required member of both the Technology Committee and the ORC.


text: The SOMC and SRMC are comprised of senior leadership and executive-level officers, including FHLBank's CRO and Chief Information Officer. The SOMC is responsible for receiving reports on issues escalated from the Technology Committee. The SRMC is responsible for management of operational risk and implementation of the cybersecurity risk management framework within the ERM Program as approved by the board of directors and receives reports on issues escalated from the ORC.


text: The Executive Team, comprised of chief-level officers, annually reviews and provides recommendations on the Enterprise Security Policy, Security Incident Response Plan, and the Business Resiliency Management Policy. The President and CEO annually approves each policy for submission to the board of directors for its consideration and ultimate approval. In addition to the board of directors and management committees, we have an Information Security Working Group (ISWG). Membership in the ISWG consists of leadership and business partners from a cross section of areas, including operational risk, information security, information technology, legal, operations, and others throughout FHLBank. The breadth and depth of experience of members of the ISWG allows for detailed discussions on information security trends and emerging risks which can be elevated to the Technology Committee for action or further discussion, as necessary and appropriate.


text: We have an Information Security area of the Information Technology department comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk. The area handles processes and procedures to mitigate and implement protective, proactive and reactive measures to protect FHLBank against cybersecurity risks and is responsible for the practices designed to prevent unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information.


text: Those responsible for assessing and managing FHLBank's material risks from cybersecurity threats have expertise and experience relevant to their roles. FHLBank's CIO has served in technology and leadership roles for over 30 years, including almost 26 years of experience with FHLBank. During the last 12 years, the CIO has provided oversight and strategic direction for the Information Security area of the Information Technology department. The ISO has more than 25 years of information technology experience, including 24 in the financial industry, and 22 years of experience managing information security. The ISO has a Bachelor of Science degree in Computer Science Information Systems. The Director of Information Security is a retired United States Air Force Lt. Colonel whose primary career focus was in intelligence analysis. The Director of Information Security also has 13 years experience building and leading cybersecurity programs, including cyber threat intelligence programs and cyber regulatory compliance; 16 years of cyber intelligence analysis experience, including military and civilian; five years of continuity of operations and business continuity program development; and holds a Master of Arts degree in Strategic Intelligence Studies and is a Certified Information System Security Professional.


text: The Technology Committee and ORC, as appropriate, receive regular and prompt information from the Information Security area as reported by the ISO, which in turn provide periodic, regular and prompt reporting to the SRMC and SOMC on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted FHLBank, as applicable and needed. The SRMC and SOMC may escalate reporting as applicable and needed to the Executive Team or board of directors.


text: The board of directors receives prompt and timely information from the Security Incident Response Team, which includes the CRO, CIO, ISO, and Director of Information Security, among others, as set forth in the Security Incident Response Plan, on any cybersecurity or information security incident that may pose significant risk to FHLBank and continues to receive regular reports on the incident until its conclusion. The board of directors, Risk Oversight Committee and Operations Committee each receive regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. At least quarterly, the board discusses cybersecurity and information security risks with the ISO and CRO.


text: FHLBank Topeka recognizes the critical importance of maintaining the trust and confidence of our members, business partners, employees and other stakeholders. We have implemented processes for assessing, identifying, and managing material risks from cybersecurity threats or incidents that may directly or indirectly impact our business strategy, results of operations, or financial condition.


text: Our cybersecurity risk management framework for assessing, identifying, and managing material risks from cybersecurity threats seeks to protect the confidentiality, security and availability of the information that we collect and store by focusing on identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Cybersecurity risk management is part of our ERM Program, which includes specific controls and processes for mitigation, monitoring and reporting associated with cybersescurity and information risks. Specifically, cybersecurity controls and processes include the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The Risk Oversight committee of the board of directors oversees these controls and processes and annually recommends each for approval. The full board of directors annually reviews and approves each of our Enterprise Security Policy, Security Incident Response Plan, and Business Resiliency Management Policy.


text: The Enterprise Security Policy establishes administrative, technical, and physical safeguards designed to protect the security, confidentiality, and integrity of FHLBank physical and intangible information technology assets in accordance with the GLB Act and the interagency guidelines issued thereunder, and applicable laws.


text: The Security Incident Response Plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting, and providing relevant information to the Risk Oversight committee and the full board of directors. The Security Incident Response Plan also requires assessment of materiality of the threat or incident for the purposes of public disclosure.


text: The Business Resiliency Management Policy is designed to ensure our critical business functions remain available during business disruptions and to minimize the impact of such disruptions, including the unavailability of information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. The Business Resiliency Management Policy includes, among other items, business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for FHLBank to operate.


text: We regularly engage with third parties to assist in the testing, maintenance, and development of our cybersecurity risk management practices and to assess, identify, and manage cybersecurity incident and threat risk.


text: Our cyber incident response plan includes third-party cybersecurity incidents and threats. Through our vendor management program, we undertake due diligence of third-party systems with which we will interact and vendors with whom we will interact, including regular reviews and oversight of these service providers through performance and technological reviews and escalation of any unsatisfactory reviews.


text: As of the date of this report, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect FHLBank, including FHLBank's business strategy, results of operations or financial condition.


text: Cybersecurity Governance Our board of directors devotes significant time and attention to data and systems protection, including cybersecurity and information security risk. Our board of directors oversees the ERM Program, the Enterprise Security Program and Information Security through policies and principles including the Enterprise Security Policy, the Security Incident Response Plan, and the Business Resiliency Management Policy. The board of directors oversees management's approach to staffing, policies, processes, and practices to gauge and address cybersecurity and information security risk.


text: Our board of directors has oversight of our ERM Program, the Enterprise Security Program, and Information Security areas which include risks from cybersecurity threats and has approved specific controls for the mitigation, monitoring and reporting associated with those risks. The Risk Oversight Committee and Operations Committee of the board of directors receive regular reporting (at least quarterly) on the risks and are responsible for overseeing cybersecurity and information risks, including receiving Enterprise Security Program updates from the information security officer (ISO), Information Technology status updates, and reviewing enterprise risk analysis and status information, and annually reviews the Business Resiliency Management Policy and Program.


text: Our Enterprise Security Program is led by the ISO. The ISO reports to the Chief Risk Officer (CRO). FHLBank's Information Security area is led by the Director of Information Security, who reports to the Chief Information Officer (CIO). The Business Resiliency Management Program is led by the Director of Enterprise Risk Management, who reports to the CRO.


text: We have a Technology Committee, which reviews and discusses all technology-related methodologies and initiatives related to information technology and cybersecurity, among other topics. The Technology Committee is a management committee and reports to the Strategic Operations Management Committee (SOMC). We also have an Operations Risk Committee (ORC), which is a management committee, and is the secondary venue for reviewing enterprise security initiatives. The ORC also serves as the primary governance venue for the Business Resiliency Management Program and escalates business resiliency concerns and risk issues, among other matters, to the Strategic Risk Management Committee (SRMC). The ORC, is responsible for annually reviewing and providing recommendations on FHLBank's Security Incident Response Plan and receives monthly updates on the Enterprise Security Program. The ISO is a required member of both the Technology Committee and the ORC.


text: The SOMC and SRMC are comprised of senior leadership and executive-level officers, including FHLBank's CRO and CIO. The SOMC is responsible for receiving reports on issues escalated from the Technology Committee. The SRMC is responsible for management of operational risk and implementation of the cybersecurity risk management framework within the ERM Program as approved by the board of directors and receives reports on issues escalated from the ORC.


text: The Executive Team, comprised of chief-level officers, annually reviews and provides recommendations on the Enterprise Security Policy, Security Incident Response Plan, and the Business Resiliency Management Policy. The President and Chief Executive Officer (CEO) annually approves each policy for submission to the board of directors for its consideration and ultimate approval. In addition to the board of directors and management committees, we have an Information Security Working Group (ISWG). Membership in the ISWG consists of leadership and business partners from a cross section of areas, including operational risk, information security, information technology, legal, operations, and others throughout FHLBank. The breadth and depth of experience of members of the ISWG allows for detailed discussions on information security trends and emerging risks which can be elevated to the Technology Committee for action or further discussion, as necessary and appropriate.


text: We have an Information Security area of the Information Technology department comprised of specialized professionals responsible for the day-to-day, hands-on management of cybersecurity risk. The area handles processes and procedures to mitigate and implement protective, proactive and reactive measures to protect FHLBank against cybersecurity risks and is responsible for the practices designed to prevent unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction of information.


text: Those responsible for assessing and managing FHLBank's material risks from cybersecurity threats have expertise and experience relevant to their roles. FHLBank's CIO has served in technology and leadership roles for over 30 years, including almost 27 years of experience with FHLBank. During the last 14 years, the CIO has provided oversight and strategic direction for the Information Security area of the Information Technology department, including cybersecurity risk management, cybersecurity governance, and incident response. The ISO has more than 25 years of information technology experience, including 24 in the financial industry, and 22 years of experience managing information security. The ISO has a Bachelor of Science degree in Computer Science Information Systems. The Director of Information Security is a retired United States Air Force Lt. Colonel whose primary career focus was in intelligence analysis. The Director of Information Security also has 14 years of experience building and leading cybersecurity programs, including cyber threat intelligence programs and cyber regulatory compliance; 16 years of cyber intelligence analysis experience, including military and civilian; five years of continuity of operations and business continuity program development; and holds a Master of Arts degree in Strategic Intelligence Studies and is a Certified Information System Security Professional.


text: The Technology Committee and ORC, as appropriate, receive regular and prompt information from the Information Security area as reported by the ISO, which in turn provide periodic, regular and prompt reporting to the SRMC and SOMC on topics such as threat intelligence, major cybersecurity risk areas, technologies and best practices, and any cybersecurity incidents that may have impacted FHLBank, as applicable and needed. The SRMC and SOMC may escalate reporting as applicable and needed to the Executive Team or board of directors.


text: The board of directors receives prompt and timely information from the Security Incident Response Team, which includes the CRO, CIO, ISO, and Director of Information Security, among others, as set forth in the Security Incident Response Plan, on any cybersecurity or information security incident that may pose significant risk to FHLBank and continues to receive regular reports on the incident until its conclusion. The board of directors, Risk Oversight Committee and Operations Committee each receive regular presentations and reports throughout the year on cybersecurity and information security risk. These presentations and reports address a broad range of topics, including updates on technology trends, regulatory developments, legal issues, policies and practices, information security resources and organization, the threat environment and vulnerability assessments, and specific and ongoing efforts to prevent, detect, and respond to internal and external incidents and critical threats. At least quarterly, the board discusses cybersecurity and information security risks with the ISO and CRO.


text: Risk Assessment and Management We regularly assess risks from cybersecurity threats; monitor our information systems for potential vulnerabilities; and test those systems pursuant to our cybersecurity policies, processes, and practices, which are integrated into our overall risk management program. To protect our information systems from cybersecurity threats, we use various security tools that are designed to help identify, escalate, investigate, resolve, and recover from security incidents in a timely manner.

companyName: ImmunityBio, Inc.

ticker: IBRX


text: The company has an ERM program to identify, evaluate, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with the company's broader business goals and objectives. We believe that integrating cybersecurity risks into our ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the company's operations, financial condition, and reputation in an ever-evolving threat landscape.


text: The company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems Cybersecurity threats, including those resulting from any previous cybersecurity incidents, had not materially affected the company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. See Item 1A. Risk Factors "— Our systems, infrastructure or data, or those used by our CROs, CMOs, clinical sites or other contractors or consultants, may or may be perceived to fail or suffer a cyberattack, security breach or other incident, including a breakdown or compromise of the confidentiality, integrity and availability of our systems, networks or data, which could adversely affect the operation of our business and reputation " for more information regarding cybersecurity risks and the potential impact on the company.


text: Incident Response The company has a dedicated incident management team responsible for managing and coordinating its cybersecurity incident response efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to the executive incident team and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks cybersecurity incidents to help identify and analyze them. The company's incident response team partners with other key stakeholders as appropriate to respond to cybersecurity incidents. The company maintains a cybersecurity and incident response program to prepare for and respond to cybersecurity incidents, which includes standard processes for reporting and escalating cybersecurity incidents to the executive incident team. Additionally, the company conducts at least one incident response test exercise on an annual basis, where members of a cross-functional team engage in a simulated incident scenario.


text: Board Oversight Role Our Board of Directors oversees our risk management process, including as it pertains to cybersecurity risks, directly and through its committees. The Audit Committee (the Committee) of the Board of Directors oversees our cybersecurity and data privacy. The Committee meets periodically to review and discuss with management risks relating to significant cybersecurity matters and concerns involving the company, including information security, data privacy, backup of information systems and related regulatory matters and compliance. The Committee regularly reports to the Board of Directors with respect to the Committee's activities and recommendations, including those relating to cybersecurity matters and concerns. The CIO provides quarterly reports to the Committee on information security matters, including the adequacy and effectiveness of the company's information security policies and practices and the internal controls regarding information security, and notifies the chairperson of the Committee as soon as practicable of significant information security matters and concerns as they arise.


text: Management's Role The company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The company's cybersecurity function is led by the company's director of information security, who reports to the CIO. The director of information security and CIO (collectively, the Cybersecurity Leaders) are actively involved in assessing and managing cybersecurity risks, and are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are as follows:


text: The CIO provides leadership for the company's technology department. She holds a Bachelor of Science, Communication from Arizona State University, has served in various roles in information technology for over 25 years, holds multiple certifications, and has been actively involved in the information security and cybersecurity domains for over 20 years.


text: The director of information security is responsible for all aspects of cybersecurity across the company's locations and data centers, including security engineering, security operations, incident response, threat intelligence, risk and compliance, and vulnerability management. He holds a Bachelor of Science in Business Administration, Management Information Systems from the University of Arizona, holds various certifications, and has served in various roles in information technology for over 25 years at numerous technology companies and consulting firms.


text: The company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response. These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility to major issues and seek alignment with strategy. As discussed above, the company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. The company's incident response team also coordinates with external legal advisors, communication specialists, and other key stakeholders.


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants The company engages cybersecurity consultants and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments and penetration testing to identify weaknesses and recommend improvements. Additionally, the company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, including a managed security service provider to augment the company's internal resources, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.


text: Oversight of Third-Party Service Providers The company also uses third-party service providers to support its operations and many of its technology initiatives, and evaluates its third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following such evaluation, the company determines and prioritizes service provider risk based on the potential threat impact and likelihood, and such risk determination drives the level of due diligence and ongoing compliance monitoring required for each service provider.


text: The company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems.


text: Cybersecurity threats, including those resulting from any previous cybersecurity incidents, have not materially affected the company, including our business strategy, results of operations, or financial condition. We do not believe that cybersecurity threats resulting from any previous cybersecurity incidents of which we are aware are reasonably likely to materially affect our company. See Item 1A. "Risk Factors— Our systems, infrastructure or data, or those used by our CROs, CMOs, clinical sites or other contractors or consultants, may or may be perceived to fail or suffer a cyberattack, security breach or other incident, including a breakdown or compromise of the confidentiality, integrity and availability of our systems, networks or data, which could adversely affect the operation of our business and reputation " for more information regarding cybersecurity risks and the potential impact on the company.


text: Ensuring the security of Duke Energy's assets, information and teammates is vital for delivering the essential service on which Duke Energy's customers and communities depend. In light of the ever-evolving threat landscape and increasing sophistication of threat actor tactics, techniques and procedures, steadfast and sophisticated cybersecurity and security operations are integral parts of Duke Energy's enterprise risk management framework. Duke Energy's enterprise risk management framework is used across the enterprise by subject matter experts to identify, assess, monitor and communicate enterprise level risks to the Chief Risk Officer. Duke Energy's technology and cybersecurity risk management program is integrated into the Company's overall Enterprise Risk Management program and is composed of three primary lines of defense: (1) the Cybersecurity Incident Response Team (CIRT); (2) the Duke Energy Enterprise Security Team (EST); and (3) internal and external cybersecurity audits.

companyName: PROGRESS ENERGY INC


text: Duke Energy's first line of defense is the CIRT under the Office of the Chief Information Officer. The CIRT reports up to leaders in the Chief Security and Information Security Office, including the Chief Security and Information Security Officer (CSISO), Managing Director of Cybersecurity and Network Defense, and Director of Cybersecurity Operations, whose cybersecurity backgrounds include many years serving in operational cyber roles, leading incident response, participating in industry engagement, collaborating with federal and local cyber programs, and time analyzing security breaches across the industry. The CIRT oversees an enterprisewide process that identifies, assesses, responds to and resolves cyber incidents, both internal and those associated with the Company's use of third-party service providers, by defining roles, responsibilities and the process for problem source identification, mitigation, and eradication triggered by a suspected cyber incident. Duke Energy manages cybersecurity threats through its 24/7 Duke Energy Cybersecurity Operations Center (CSOC), which serves as the Company's central command center for monitoring and coordinating responses to cyberthreats. The CSOC engages in daily information sharing within the utilities industry and with government partners and monitors incoming intelligence and cyber incident impacts. The CSOC assesses the relevant information by assigning a CIRT Heat Map score, which results in CIRT activation if a certain threat level is met. It also results in the assignment of additional roles and responsibilities to enable the cybersecurity leadership and technical teams to collectively and regularly review incident information, score the impact, communicate to leadership, and respond appropriately. Another key component of Duke Energy's first line of defense against cybersecurity threats is its Third-Party Risk Management (TPRM) process, whereby third parties providing services that meet certain criteria such as storing or transmitting Duke Energy data, hosting an application, or connecting to the Duke Energy network are required to undergo a cybersecurity assessment primarily to ascertain the risk of a third party's proposed services to Duke Energy.


text: Duke Energy's second line of defense against cybersecurity threats is the EST, which is led by the CSISO, and actively evaluates, anticipates and tests Duke Energy's cybersecurity risk level and preventive and risk mitigation controls relative to the enterprisewide risk level and controls. The EST is responsible for infrastructure defense and security controls, performing vulnerability assessments and third-party information security assessments, employee awareness and training programs and security incident management, including oversight of the remediation of cybersecurity incidents. The EST monitors cyber activity and also reports on the status of the Company's cybersecurity performance and any ongoing remediation efforts to the Company's Chief Information Officer (CIO) and CSISO. The CIO and CSISO report these cybersecurity metrics, which use a vulnerability management scoring system and closely align with the National Institute of Standards and Technology Cybersecurity Framework, to the Audit Committee at each regularly scheduled Audit Committee meeting. The EST also employs tools and oversees and challenges Duke Energy's cybersecurity and technology metrics under its Enterprise Security Risk Register to track, identify and manage risk. To this end, the EST engages outside expert firms to perform a comprehensive external penetration test each year, performs system and application penetration testing several times throughout the year, and conducts annual exercises simulating the tactics, techniques, and procedures of advanced threat actor groups to test the Company's ability to prevent penetration, detect suspicious activity and respond to these threats in a timely manner. Lessons learned inform the ongoing improvement of security preventive and mitigating controls and procedures and the results of such testing and threat actor simulations are shared with senior management and the Board of Directors. Duke Energy also has a senior management committee, the Executive Cybersecurity Oversight Governance Committee (ECOG), which governs enterprise-level cybersecurity risk tolerance.


text: Internal and external cybersecurity audits provide a third line of defense and independently provide assurance on how effectively the Company, as a whole, manages cybersecurity risk. Each year, Duke Energy Corporate Audit Services (CAS) performs various audits of key Duke Energy security systems and functions, such as third-party risk management programs, to assess whether appropriate security controls are in place and operating effectively. In addition to these internal audits, the Company is subject to a variety of external audits, performed periodically as required by the auditing entity, including external audits performed by the North American Electric Reliability Corporation under the Critical Infrastructure Protection framework (NERC CIP), Transportation & Security Administration Pipeline Security Directive and Federal Energy Regulatory Commission Dam Security.


text: Duke Energy is not currently aware of any potential cybersecurity threats, including as a result of any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, however, Duke Energy cannot provide assurance that it will not be materially affected in the future by cybersecurity risks or any future material incidents.


text: The Audit Committee has primary oversight of management's efforts to mitigate cybersecurity and technology risk and respond to cyber incidents. The Audit Committee receives updates throughout the year from the CIO and CSISO on cybersecurity and grid security issues, including compliance with regulations, employee training, and drills, at every regularly scheduled Audit Committee meeting, and engages in discussions throughout the year with management on the effectiveness of Duke Energy's overall cybersecurity program and progress for addressing any identified risks. In 2023, the Audit Committee received four updates on cybersecurity. The Audit Committee also receives periodic updates on Duke Energy's digital transformation and the operation of, and enhancements to, the Company's financial systems and business and operational technical systems. The reviews presented to the Audit Committee are followed with an update to the full Board of Directors by the Chair of the Audit Committee.


text: In addition, the Operations and Nuclear Oversight Committee (ONOC) of the Board of Directors provides oversight of the nuclear safety and cybersecurity of Duke Energy's nuclear power program, which is integrated with the companywide cyber protocols, and the Chair of the ONOC reports out to the Board of Directors on such oversight activities. Duke Energy's nuclear cybersecurity program and associated cybersecurity plan (CSP) were fully implemented in 2017 in accordance with NRC regulation 10 CFR 73.54, "Protection of digital computer and communication systems and networks" and leverage monitoring, testing, drills, audits, assessments, and NRC inspections to continue to validate the effectiveness of the program to protect plant assets from cybersecurity threats.


text: Moreover, Duke Energy's processes ensure that the Board of Directors receive contemporaneous reporting on potentially significant cyber events including response, legal obligations, and outreach and notification to regulators and customers when needed, as well as an opportunity to provide guidance to management as appropriate.


text: In addition, the Company's Executive Cybersecurity Oversight Governance Committee (ECOG), comprised of the Company's Chair, President, and Chief Executive Officer (CEO), Executive Vice President (EVP) and Chief Financial Officer, EVP and Chief Commercial Officer, EVP Customer Experience, Solutions and Services, and EVP, Chief Generation Officer and Enterprise Operational Excellence, receives monthly updates from the CIO and CSISO and provides senior management throughout the Company informational technology and operational technology perspectives, oversight and governance on investments and priorities for the broader cybersecurity organization, in addition to providing final decision oversight on recommendations and response to the ever challenging cybersecurity threat landscape. The ECOG also is leveraged to supply information and bring transparency to senior management throughout the company on the increasing threat landscape and the actions, response and road map to combat the threats.


text: The relevant cybersecurity risk expertise of Duke Energy's management who serve on the ECOG and/or senior management who lead the CIRT and EST is described below.


text: • The CEO of Duke Energy has over 20 years of experience in the utilities industry, and has gained cybersecurity experience as CEO of one of America's largest utility companies, and through service on the board of the Edison Electric Institute, the Institute of Nuclear Power Operations, the World Association of Nuclear Operators, and past service on the Department of Homeland Security Advisory Council. • The EVP and Chief Financial Officer of Duke Energy (CFO) previously served as the Company's Chief Transformation and Administrative Officer and led the Company's business transformation through digital innovation, new ways of working and process redesign. In this role, the CFO gained an in-depth understanding of the Company's cybersecurity procedures and key threats, and was responsible for the enterprise business services and technology team, including the information and technology organization. • The EVP, Chief Generation Officer and Enterprise Operational Excellence of Duke Energy has gained cybersecurity experience through being responsible for the safe, efficient and reliable operation of Duke Energy's fleet of nuclear, natural gas, hydro, solar and coal units.


text: • The EVP, Customer Experience, Solutions and Services of Duke Energy has gained cybersecurity experience through focusing on transmission and the development of long-term grid strategies and solutions and through a prior role as Chief Distribution Officer, overseeing the safe, reliable, and efficient operation of Duke Energy's electric distribution systems, and through serving on the board of the Association of Edison Illuminating Companies. • The EVP and Chief Commercial Officer of Duke Energy has cybersecurity experience gained through responsibility for enterprise technology and security, among other areas. • The CSISO of Duke Energy has over 25 years of experience building and leading security teams within multiple industries. The CSISO holds a Secret Security clearance and is committed to strengthening U.S. critical infrastructure through active collaboration with federal partners at the Federal Bureau of Investigation, Department of Energy, Department of Homeland Security, and state partners including the national guard, law enforcement and universities. • The CIO of Duke Energy has over 25 years of experience in delivering secure information technology solutions across multiple industries, leading technology delivery for all core business functions. The CIO holds a Secret Security clearance and has active interactions and partnership with the Federal Bureau of Investigation, Edison Electric Institute and State Fusion Centers in the jurisdictions that Duke Energy serves.


text: Ensuring the security of Duke Energy's assets, information and teammates is vital for delivering the essential service on which Duke Energy's customers and communities depend. In light of the ever-evolving threat landscape and increasing sophistication of threat actor tactics, techniques and procedures, steadfast and advanced cybersecurity and security operations are integral parts of Duke Energy's enterprise risk management framework. Duke Energy's enterprise risk management framework is used across the enterprise by subject matter experts to identify, assess, monitor and communicate enterprise level risks to the Chief Risk Officer. Duke Energy's technology and cybersecurity risk management program is integrated into the Company's overall Enterprise Risk Management program and is composed of three primary lines of defense: (1) the Cybersecurity Incident Response Team (CIRT); (2) the Duke Energy Enterprise Security Team (EST); and (3) internal and external cybersecurity audits.


text: Duke Energy's first line of defense is the CIRT under the Office of the Chief Administrative Officer (CAO). The CIRT reports up to leaders in the Chief Security and Information Security Office, including the Chief Security and Information Security Officer (CSISO), Managing Director of Cybersecurity and Network Defense, and Director of Cybersecurity Operations, whose cybersecurity backgrounds include many years serving in operational cyber roles, leading incident response, participating in industry engagement, collaborating with federal and local cyber programs, and time analyzing security breaches across the industry. The CIRT oversees an enterprisewide process that identifies, assesses, responds to and resolves cyber incidents, both internal and those associated with the Company's use of third-party service providers, by defining roles, responsibilities and the process for problem source identification, mitigation, and eradication triggered by a suspected cyber incident. Duke Energy manages cybersecurity threats through its 24/7 Duke Energy Cybersecurity Operations Center (CSOC), which serves as the Company's central command center for monitoring and coordinating responses to cyber-threats. The CSOC engages in daily information sharing within the utilities industry and with government partners and monitors incoming intelligence and cyber incident impacts. The CSOC assesses the relevant information by assigning a CIRT Heat Map score, which results in CIRT activation if a certain threat level is met. It also results in the assignment of additional roles and responsibilities to enable the cybersecurity leadership and technical teams to collectively and regularly review incident information, score the impact, communicate to leadership, and respond appropriately. Another key component of Duke Energy's first line of defense against cybersecurity threats is its Third-Party Risk Management (TPRM) process, whereby third parties providing services that meet certain criteria such as storing or transmitting Duke Energy data, hosting an application, or connecting to the Duke Energy network are required to undergo a cybersecurity assessment primarily to ascertain the risk of a third-party's proposed services to Duke Energy.


text: Duke Energy's second line of defense against cybersecurity threats is the EST, which is led by the CSISO, and actively evaluates, anticipates and tests Duke Energy's cybersecurity risk level and preventive and risk mitigation controls relative to the enterprisewide risk level and controls. The EST is responsible for infrastructure defense and security controls, performing vulnerability assessments and third-party information security assessments, employee awareness and training programs and security incident management, including oversight of the remediation of cybersecurity incidents. The EST monitors cyber activity and also reports on the status of the Company's cybersecurity performance and any ongoing remediation efforts to the Company's CAO, Chief Information Officer (CIO) and CSISO. The CAO and CSISO report these cybersecurity metrics, which use a vulnerability management scoring system and closely align with the National Institute of Standards and Technology Cybersecurity Framework, to the Audit Committee at each regularly scheduled Audit Committee meeting. The EST also employs tools and oversees and challenges Duke Energy's cybersecurity and technology metrics under its Enterprise Security Risk Register to track, identify and manage risk. To this end, the EST engages outside expert firms to perform a comprehensive external penetration test each year, performs system and application penetration testing several times throughout the year, and conducts annual exercises simulating the tactics, techniques, and procedures of advanced threat actor groups to test the Company's ability to prevent penetration, detect suspicious activity and respond to these threats in a timely manner. Lessons learned inform the ongoing improvement of security preventive and mitigating controls and procedures and the results of such testing and threat actor simulations are shared with senior management and the Board of Directors. Duke Energy also has a senior management committee, the Executive Cybersecurity Oversight Governance Committee (ECOG), which governs enterprise-level cybersecurity risk tolerance.


text: The Company's Executive Cybersecurity Oversight Governance Committee (ECOG), comprised of the Company's Chair and Chief Executive Officer (CEO), President, Executive Vice President (EVP) and Chief Financial Officer, and EVP, Chief Generation Officer and Enterprise Operational Excellence, receives monthly updates from the CAO and CSISO and provides senior management throughout the Company informational technology and operational technology perspectives, oversight and governance on investments and priorities for the broader cybersecurity organization, in addition to providing final decision oversight on recommendations and response to the ever-challenging cybersecurity threat landscape. The ECOG also is leveraged to supply information and bring transparency to senior management throughout the Company on the increasing threat landscape and the actions, response and road map to combat the threats.


text: Duke Energy is not currently aware of any potential cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition, however, Duke Energy cannot provide assurance that it will not be materially affected in the future by cybersecurity risks or any future material incidents.


text: The Audit Committee has primary oversight of management's efforts to mitigate cybersecurity and technology risk and respond to cyber incidents. The Audit Committee receives updates throughout the year from the CAO and CSISO on cybersecurity and grid security issues, including compliance with regulations, employee training and drills, at every regularly scheduled Audit Committee meeting, and engages in discussions throughout the year with management on the effectiveness of Duke Energy's overall cybersecurity program and progress for addressing any identified risks. In 2024, the Audit Committee received three updates and the full Board of Directors received one update on cybersecurity. The Audit Committee also receives periodic updates on Duke Energy's digital transformation and the operation of, and enhancements to, the Company's financial systems and business and operational technical systems. The reviews presented to the Audit Committee are followed with an update to the full Board of Directors by the Chair of the Audit Committee.


text: • The CEO of Duke Energy has over 20 years of experience in the utilities industry, and has gained cybersecurity experience as CEO of one of America's largest utility companies, and through service on the board of the Edison Electric Institute, the Institute of Nuclear Power Operations, the World Association of Nuclear Operators, and past service on the Department of Homeland Security Advisory Council. • The EVP and Chief Financial Officer of Duke Energy (CFO) previously served as the Company's Chief Transformation and Administrative Officer and led the Company's business transformation through digital innovation, new ways of working and process redesign. In this role, the CFO gained an in-depth understanding of the Company's cybersecurity procedures and key threats, and was responsible for the enterprise business services and technology team, including the information and technology organization. • The EVP, Chief Generation Officer and Enterprise Operational Excellence of Duke Energy has gained cybersecurity experience through being responsible for the safe, efficient and reliable operation of Duke Energy's fleet of nuclear, natural gas, hydro, solar and coal units. • The President of Duke Energy has gained cybersecurity experience through focusing on transmission and the development of long-term grid strategies and solutions and through a prior role as Chief Distribution Officer, overseeing the safe, reliable, and efficient operation of Duke Energy's electric distribution systems, and through serving on the board of the Association of Edison Illuminating Companies. • The CSISO of Duke Energy has over 25 years of experience building and leading security teams within multiple industries. The CSISO holds a Secret Security clearance and is committed to strengthening U.S. critical infrastructure through active collaboration with federal partners at the Federal Bureau of Investigation, Department of Energy, Department of Homeland Security, and state partners including the national guard, law enforcement and universities. • The CAO of Duke Energy has over 25 years of experience in delivering secure information technology solutions across multiple industries, leading technology delivery for all core business functions. The CAO holds a Secret Security clearance and has active interactions and partnership with the Federal Bureau of Investigation, Edison Electric Institute and State Fusion Centers in the jurisdictions that Duke Energy serves.


text: As part of its oversight role, the Audit Committee of our Board is responsible for overseeing cybersecurity risk exposure as well as management's actions to identify, assess, mitigate and remediate cybersecurity threats. The Audit Committee receives regular reports, on a quarterly basis, from our Chief Financial Officer and Senior Director of Information Technology regarding our cybersecurity risk programs. Our Chief Financial Officer also provides quarterly updates to the Board that include a summary of our cybersecurity risk programs to enable discussion of cybersecurity risk management at the Board level. The Audit Committee annually reviews and recommends our information security policy and program to the Board. The Audit Committee is composed of members with financial expertise as well as one member with a cybersecurity oversight certification.

companyName: Altimmune, Inc.

ticker: ALT


text: Our Chief Financial Officer has overall responsibility for our cybersecurity and has over 20 years of experience managing information technology, or IT, departments at biotechnology and pharmaceutical companies. Our Senior Director of Information Technology is responsible for the development and implementation of IT department controls, policies, infrastructure, and day-to-day operations, in addition to managing security risk, evaluating safeguards and recommending security improvements, and has over seven years of experience managing IT departments for a biotechnology company. We utilize third-party vendors to help strengthen our information security risk management by conducting evaluations of our security controls on at least a quarterly basis.


text: Identifying assets at risk from cybersecurity threats and taking mitigation measures including the implementation of data backup, recovery and restore procedures to ensure business continuity, as well as through IT controls, policies and infrastructure.


text: Identifying potential cybersecurity threats that could disrupt our IT systems, cause a data breach or compromise data security by implementing the following protective measures: patching and updating systems and applications, monitoring our email systems, endpoint protection, Domain Name System (DNS) filtering, Security Information and Event Management, and Multi-Factor Authentication (MFA). Conducting periodic assessment of protections to prevent or mitigate cybersecurity threats.


text: Retaining of third parties to periodically assess our cybersecurity management program, provide cybersecurity training, perform phishing tests, gap analysis and penetration tests, advise on business continuity plans, and to provide additional support in the event of a cybersecurity incident.


text: The Chief Financial Officer and Senior Director of Information Technology work with other groups in the Company to understand the severity of the potential consequences of a cybersecurity incident and to make decisions about how to prioritize mitigation and other initiatives based on, among other things, materiality to the business. All employees and contractors receive cybersecurity training, and we plan to implement additional annual training for all employees and contractors. All trainings are intended to raise awareness of cybersecurity threats in order to reduce our vulnerability as well as to encourage consideration of cybersecurity risks across functions.


text: Our Chief Financial Officer has overall responsibility for our cybersecurity and has over 30 years of experience managing information technology, or IT, departments at biotechnology and pharmaceutical companies. Our Senior Director of Information Technology is responsible for the development and implementation of IT department controls, policies, infrastructure, and day-to-day operations, in addition to managing security risk, evaluating safeguards and recommending security improvements, and has over eight years of experience managing IT departments for a biotechnology company. We utilize third-party vendors to help strengthen our information security risk management by conducting evaluations of our security controls on at least a quarterly basis.


text: Risk Management and Strategy An important part of our business involves the receipt, processing and storage of personal information of our customers and associates, including, in the case of our customers, payment information. Security of this information and our other proprietary data is imperative to ensure the trust of our customers, vendors, and employees. We assess, identify and manage material risks related to potential cybersecurity attacks on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems through various processes. These processes include a wide variety of controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft and misuse, and unauthorized access to, or other cybersecurity attacks or vulnerabilities affecting, our data.

companyName: GameStop Corp.

ticker: GME


text: The assessment of cybersecurity risk is integrated into our overall risk management processes and cybersecurity is identified as a key risk within our Enterprise Risk Management ("ERM") program. The Company strives to implement cybersecurity policies, standards, processes and controls for assessing, identifying and managing material risks from cybersecurity threats and responding to cybersecurity attacks that are aligned with industry best practices and applicable frameworks.


text: We have an information technology ("IT") security team, led by our chief information security officer, that is responsible for implementing and maintaining cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. We seek to address cybersecurity risks through a cross-functional approach, including relevant training for applicable employees and regular reviews and tests of our cybersecurity program that leverage audits performed by our internal audit team. In addition to our in-house cybersecurity capabilities, at times we also engage consultants or other third parties to assist with assessing, identifying and managing cybersecurity risks.


text: We use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems. We maintain processes to reduce the impact of a cybersecurity attack at a third-party vendor.


text: We maintain a cybersecurity incident response plan, which details the incident response procedures and points of contact related to the response processes. The response plan includes a decision-tree-based playbook, which is a supplement to the plan, and focuses on specific types of incidents and the appropriate response steps.


text: As of the date of this report, we are not aware of any recent cybersecurity attacks that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition.


text: See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information security systems.


text: As indicated above, we have an IT security team, led by our chief information security officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at the Company in close coordination with senior leadership and other teams across GameStop. The security team's leadership has an average of over 12 years of prior work experience in various roles including monitoring, response, compliance and privacy. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: The Audit Committee of the Board of Directors, with input from management, assesses the measures implemented by us to mitigate and prevent cybersecurity attacks. The Company's IT team consults with, and provides regular updates to, our Audit Committee, as well as members of our senior management team, as appropriate, on technology and cybersecurity matters, the status of projects to strengthen our information security systems, assessments of our cybersecurity program, and timely reports regarding any cybersecurity attack that meets established reporting thresholds. Our Audit Committee has oversight responsibility for our cybersecurity program.


text: The Company's Board of Directors, in coordination with the Audit Committee of the Board of Directors (the Audit Committee), is responsible for overseeing the Company's risk management and information technology programs of which cybersecurity is a critical element. Management is responsible for the administration of the Company's cybersecurity policies, standards, procedures and practices. The Company's cybersecurity policies, standards, procedures, and practices are based on the Center for Internet Security (CIS) Critical Security Controls, a framework for companies to establish and evaluate cybersecurity policies, procedures and practices. The Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they arise.

companyName: Xencor Inc

ticker: XNCR


text: Identification and Reporting: The Company has implemented a comprehensive approach to assessing, identifying and managing material cybersecurity threats and incidents. The Company's program includes controls and procedures to timely identify, classify and escalate certain cybersecurity incidents to provide management visibility and allow for direction from management as to the public disclosure and reporting of material incidents in a timely manner.


text: Technical Safeguards: The Company implements current information technologies to support its cybersecurity practices. These technologies are designed to protect the Company's information systems from cybersecurity threats and include: email and internet protection, firewall and network security, intrusion detection and prevention systems, anti-malware endpoint detection and response, security event monitoring and alerting, high availability and replication, system configuration and asset management, backup and restoration processes, vulnerability and patch management, identity and access management and data encryption. These technologies and controls are continuously evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as audits by third party specialists and certifications.


text: Incident Response and Recovery Planning: The Company has established and maintains a comprehensive incident response plan, designed to address the Company's response to a cybersecurity incident. Cross-functional members of the Company comprise the Incident response team to respond and disclose material incidents. The incident response plan defines pre-incident activities and preparation, classification of incidents, response team internal and external contacts, process flow of the response team, escalation of incidents to outside entities and law enforcement and frequency of review of the incident response plan. The Company conducts regular tabletop exercises to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, contractors, consultants and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on the Company's cybersecurity systems. Third parties are regularly assessed to determine the need for cybersecurity auditing based on risk evaluation.


text: Education and Awareness: The Company provides regular, mandatory training and assessment for all levels of employees regarding cybersecurity threats as a means to equip the Company's employees with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes, and practices.


text: The Company conducts periodic assessment and testing of the Company's policies, standards, processes, and practices including audits by independent third party specialists in a manner intended to address cybersecurity threats and events. Policies are reviewed and revised on a frequent basis for relevance and to maintain compliance. The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit Committee, and the Company adjusts its cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board, in coordination with the Audit Committee, oversees the Company's risk management and information technology programs, including the management of cybersecurity threats. The Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by the Company's peers and third parties. The Audit Committee also receive prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses the Company's approach to overseeing cybersecurity threats with the Company's head of Information Technology and other members of senior management.


text: The head of IT, in coordination with senior management, including the CFO, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications with these teams, the head of IT and senior management are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Material Affects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Our Board of Directors, in coordination with the Audit Committee of the Board of Directors (the Audit Committee), is responsible for overseeing our risk management and information technology programs of which cybersecurity is a critical element. Management is responsible for the administration of our cybersecurity policies, standards, procedures and practices. Our cybersecurity policies, standards, procedures, and practices are based on the Center for Internet Security (CIS) Critical Security Controls, a framework for companies to establish and evaluate cybersecurity policies, procedures and practices. We seek to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of our information systems or the information that we collect and store, by assessing, identifying and managing cybersecurity issues as they arise.


text: Identification and Reporting: We have implemented a comprehensive approach to assessing, identifying and managing material cybersecurity threats and incidents. Our program includes controls and procedures to timely identify, classify and escalate certain cybersecurity incidents to provide management visibility and allow for direction from management as to the public disclosure and reporting of material incidents in a timely manner.


text: Technical Safeguards: We implement current information technologies to support our cybersecurity practices. These technologies are designed to protect our information systems from cybersecurity threats and include email and internet protection, firewall and network security, intrusion detection and prevention systems, anti-malware endpoint detection and response, security event monitoring and alerting, high availability and replication, system configuration and asset management, backup and restoration processes, vulnerability and patch management, identity and access management and data encryption. These technologies and controls are continuously evaluated and improved through vulnerability assessments and cybersecurity threat intelligence, as well as audits by third-party specialists and certifications.


text: Incident Response and Recovery Planning: We have established and maintain a comprehensive incident response plan, designed to address our response to a cybersecurity incident. Our cross-functional members comprise the incident response team to respond and disclose material incidents. The incident response plan defines pre-incident activities and preparation, classification of incidents, response team internal and external contacts, process flow of the response team, escalation of incidents to outside entities and law enforcement and frequency of review of the incident response plan. We conduct regular tabletop exercises (i.e., discussion-based simulations) to test these plans and ensure personnel are familiar with their roles in a response scenario.


text: Third-Party Risk Management: We maintain a comprehensive, risk-based approach to identifying and overseeing material cybersecurity threats presented by third parties, including vendors, service providers, contractors, consultants and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a material cybersecurity incident affecting those third-party systems, including any outside auditors or consultants who advise on our cybersecurity systems. Third parties are regularly assessed to determine the need for cybersecurity auditing based on risk evaluation.


text: Education and Awareness: We provide regular, mandatory training and assessment for all levels of employees regarding cybersecurity threats as a means to equip our employees with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes, and practices.


text: We conduct periodic assessment and testing of our policies, standards, processes, and practices including audits by independent third-party specialists in a manner intended to address cybersecurity threats and events. Policies are reviewed and revised on a frequent basis for relevance and to maintain compliance. The results of such assessments, audits, and reviews are evaluated by management and reported to the Audit Committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary based on the information provided by these assessments, audits, and reviews.


text: The Board, in coordination with the Audit Committee, oversees our risk management and information technology programs, including the management of cybersecurity threats. The Audit Committee receives regular presentations and reports on developments in the cybersecurity space, including risk management practices, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends, and information security issues encountered by our peers and third parties. The Audit Committee also receives prompt and timely information regarding any cybersecurity risk that meets pre-established reporting thresholds, as well as ongoing updates regarding any such risk. On an annual basis, the Audit Committee discusses our approach to overseeing cybersecurity threats with our head of Information Technology (IT) and other members of senior management.


text: Xencor's head of IT has 33 years of experience and has managed information technology in complex environments for 20 years. In coordination with senior management, including the CFO, the head of IT works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any material cybersecurity incidents in accordance with our incident response and recovery plans. Cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents support the success of our cybersecurity program. Ongoing communications with these teams are designed to keep the head of IT and senior management informed about the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Material Effects of Cybersecurity Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY We are subject to cybersecurity risk, which includes intentional and unintentional acts that may jeopardize the confidentiality, integrity, or availability of our information technology assets and data under our control. Cybersecurity risk can take the form of a variety of circumstances that cause harm to us, our members, our service providers, and the economy in general. These circumstances include malicious software or exploited vulnerabilities, social engineering, such as phishing, denial-of-service attacks, viruses, malware, and natural or other disasters. See Item 1A. Risk Factors for additional description of cybersecurity and other operational risks.

companyName: Federal Home Loan Bank of Cincinnati


text: In alignment with industry standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, and Finance Agency regulatory guidance, we have implemented processes for assessing, identifying, and managing cybersecurity risk through a layered approach throughout our environment and in our service provider arrangements, including software-as-a-service and infrastructure-as-a-service engagements. We continuously evaluate and update our policies and practices to mitigate our exposure to cybersecurity risks given, among other things, the evolving natures of these risks, the involvement of uncontrollable circumstances, such as fires or flooding, and our role in the financial services industry and the broader economy. Our cybersecurity risk-mitigating processes include the implementation of firewalls, anti-virus software, real-time network monitoring, various forms of testing, and the deployment of software updates to address security vulnerabilities, as well as annual and periodic employee training to educate employees on how to identify and avoid various forms of social engineering.


text: Our security incident response plan determines how cybersecurity threats and incidents are identified, classified, and escalated, including for the purposes of reporting and providing relevant information to senior management and the Board of Directors. The security incident response plan also requires management to assess materiality of the threat or incident for the purposes of public disclosure.


text: We also maintain a business continuity program designed to ensure that resources and plans are in place to protect us from potential loss during a disruption, which includes the unavailability of our information technology assets due to unintentional events like fire, power loss, and other technical incidents such as hardware failures. These business continuity resources and plans include maintaining business continuity sites to ensure continued operations, regular backing up of data and systems on offsite facilities, testing our ability to operate on disaster recovery systems, and annually reviewing department level business continuity procedures.


text: We regularly engage third parties to test, maintain, and enhance our cybersecurity risk management practices and threat monitoring. These engagements include incident response exercises, penetration testing, constant managed detection and response services, and intrusion prevention and detection applications. Our vendor risk management program includes regular reviews and oversight of these third parties, including performance and technological reviews and escalation of any unsatisfactory performance, in order to identify, prioritize, assess, mitigate and remediate third party risks. However, we rely on the third parties we use to implement security programs commensurate with their risk, and we cannot ensure in all circumstances that their efforts will be successful.


text: During the period covered by this report, the risk from cybersecurity threats or incidents did not have a material impact on our strategy, results of operations, or financial condition. We expect that cybersecurity threats and incidents will continue to occur and any such cybersecurity incident impacting us could result in significantly harmful consequences to us, our members, and their customers. We assess the materiality of any such cybersecurity incident from several perspectives including our ability to continue to service our members, any loss of or unauthorized access to data, lost revenue, increased operating costs, litigation, and reputational harm.


text: CYBERSECURITY GOVERNANCE Our chief information officer and chief information security officer provide regular reports (at least quarterly) to the Risk Committee of our Board and management committees on topics such as threat intelligence, major cybersecurity risk areas and threats, technologies and best practices, and any cybersecurity incidents that may have impacted us, and more frequently if there was an ongoing cybersecurity incident. Our Board oversees our information security program through regular review of policies, including our information security policy designed to establish clear management direction and commitment to preserve the confidentiality, integrity, and availability of all information technology assets and data.


text: Our Enterprise Risk Management Committee – a management level committee, including senior management and other leadership representatives from our operational risk, information security, information technology, legal, operations, and other departments – is responsible for approving policies to support the management and implementation of the cybersecurity program and recommending the annual information technology strategic plan to senior management prior to Board review and approval. This committee receives regular reporting from our chief information security officer similar to what is provided to the Board, and more detailed reporting regarding the availability of information technology assets and cybersecurity threats being monitored.


text: Our chief information security officer, who reports both to our chief risk officer and our chief information officer, manages the cybersecurity governance framework designed to protect the confidentiality, integrity, and availability of our information technology assets and data under our control. Our chief information security officer and assistant chief information security officer collectively have approximately 20 years of experience with the FHLB in successively more responsible roles and have led teams to design, secure, implement, and audit numerous technology solutions. Our information security group is responsible for developing, documenting, and approving our information security control standards, guidelines, and procedures, in line with the policies and standards set forth by the Board and management committee. They are experienced and knowledgeable in both technology and cybersecurity and maintain industry recognized security certifications.


text: The business continuity program is overseen by the Business and Operations Committee of the Board and includes business impact analysis for developing effective plans and a disaster recovery plan to respond, recover, resume, and restore technology assets critical for us to operate. Our Enterprise Risk Management Committee is responsible for oversight of operational risk and oversees the implementation of the business continuity program as approved by the Board.