text: Our management, represented by our Director of IT, Marcus O. Pegues, and our Senior Vice President of Finance and Chief Accounting Officer, Robert D. Velasquez, leads our cybersecurity risk assessment and management processes and oversees their implementation and maintenance. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Marcus O. Pegues is an experienced information technology professional in our information technology department and has served as Director of IT since 2021. He works with the Company's internal information technology department and external partners to monitor and improve our cybersecurity capabilities. Mr. Pegues possesses a proven track record of guiding our organization through strategic technology, risk mitigation, process improvement initiatives, and digital transformations. He also possesses extensive experience in technology and cybersecurity, gained over his career spanning more than 15 years. He earned his Master of Science in Information Technology with Specialization in Project Management from Colorado Technical University and his Bachelor of Science in Business Management with Specialization in Information Technology from Colorado Technical University.

companyName: TEJON RANCH CO

ticker: TRC

secItem: Item 1C


text: Robert D. Velasquez, CPA, is an experienced risk management professional in our finance and risk management function and has served as Senior Vice President, Finance and Chief Accounting Officer since March 2022. Mr. Velasquez currently oversees key functions for the Company's accounting, finance, and treasury strategies, including risk management. In addition, Mr. Velasquez leads the Company's cybersecurity risk oversight and the development and enhancement of internal controls designed to prevent, detect, address, and mitigate the risk of cyber incidents.


text: Cybersecurity Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things: operational risks, intellectual property theft, fraud, extortion, harm to employees or customers and violation of data privacy or security laws.


text: The identification and assessment of cybersecurity risk are integrated into our overall risk management systems and processes, which are managed by senior management and overseen by the Board of Directors. Cybersecurity risks related to our business, privacy and compliance issues are identified and addressed through a multi-faceted approach that includes third party assessments, internal information technology (IT) audit, IT security, governance, risk and compliance reviews. In connection with the aforementioned approaches, and to defend, detect and respond to cybersecurity incidents, we, among other things: conduct proactive privacy and cybersecurity reviews of systems and applications, audit applicable data policies, perform penetration testing using external third-party tools and techniques to test security controls, conduct employee training, monitor emerging laws and regulations related to data protection and information security, and implement appropriate changes.


text: We have implemented incident response and breach management processes, which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such incident responses are overseen by leaders from our IT and accounting teams.


text: Cybersecurity incident events are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality, as well as operational and business impact, and reviewed for privacy impact.


text: We also conduct tabletop exercises that simulate responses to cybersecurity incidents. Our team of cybersecurity professionals then collaborate with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation and remediation strategies.


text: As part of the above processes, we regularly engage external auditors and consultants with expertise in cybersecurity to assess our internal cybersecurity programs and compliance with applicable practices and standards.


text: Our risk management program also assesses third party risks, and we perform third-party risk management to identify and mitigate risks from third parties, such as vendors, suppliers, and other business partners associated with our use of third-party service providers. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Information technology failures and data security breaches could harm our business," which discussion is included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K.


text: Third Party Risk Management The Company uses third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, a managed service security provider that monitors certain of the Company's computer networks and third-party hosted services.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board of Directors and management. The Board of Directors ' Audit Committee is responsible for the oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on a quarterly basis from senior management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Marcus O. Pegues has served as Director of IT since 2021. He works with the Company's internal information technology department and external partners to monitor and improve our cybersecurity capabilities. Mr. Pegues has guided, in coordination with other management staff, strategic technology, risk mitigation, process improvement initiatives, and digital initiatives. His experience in technology and cybersecurity, spans a career of more than 15 years. He earned his Master of Science in Information Technology with Specialization in Project Management from Colorado Technical University and his Bachelor of Science in Business Management with Specialization in Information Technology from Colorado Technical University.


text: Cyberattacks continue to evolve in sophistication and frequency. Among other things, an attack could impair our ability to interact with customers and suppliers, fulfill orders, generate invoices, collect and make payments, ship products, provide support to customers, fulfill contractual obligations and otherwise perform business functions.

companyName: TELEFLEX INC

ticker: TFX


text: Management has implemented a program ("Program"), which is part of our overall Enterprise Risk Management system, focused on the assessment, identification, and management of material risks resulting from cybersecurity threats. The Program was developed and is managed by our Vice President of Information Security and Privacy (CISSP, CISM and CISA) with oversight from the Chief Information Officer. Both leaders collectively have over 50 years of technology risk and cybersecurity work experience supporting multiple life science organizations.


text: Industry standard frameworks including International Organization of Standardization (ISO)/27001 and National Institute of Standards and Technology (NIST) are the foundation of the Program, which includes but is not limited to the fundamental security principles of least privilege access, event monitoring, vulnerability management, education, third-party risk management and incident response. The Program leverages external subject-matter experts that assist with identifying and remediating security risks present in our environment through threat hunting and vulnerability/control testing with a focus on the latest attack vectors. These external experts bring to bear risk mitigation tactics based on current threats observed across multiple organizations with similar risk profiles.


text: Key Program activities include: • Annual risk assessment to evaluate our profile against cyber risk threats; • Global policies based on the guiding principles of security by design and least-privilege access; • Maintenance of a critical incident response plan and simulation programs, which include procedures to comply with material security incident reporting requirements in collaboration with key members of Executive Management; • A communication framework designed to ensure that the individuals managing the Program are informed about, and in position to monitor the prevention, detection, mitigation, and remediation of, cybersecurity incidents; • Internal and external security assessments and testing to determine our susceptibility to compromise, lateral movement, privilege escalation and overall cybersecurity internal control posture; • Routine phishing simulations to identify areas for control enhancement and additional training; • Periodic end-user security training and cyber-threat awareness; • Suite of tools and processes to minimize the risk of security compromise in addition to detect controls alerting of potential malicious activity; and • Review and approval process focused on evaluating cybersecurity posture and internal controls relating to third party service providers.


text: The Audit Committee of the Board of Directors receives an update from the members of management referenced above on our security posture on at least an annual basis, and more often as needed. The Audit Committee provides oversight as to the status of our cybersecurity apparatus and overall Program management (including with respect to the identification and implementation of planned security enhancements), while also advising on risk mitigation activities to address the latest threats.


text: To date, we have not experienced any known cybersecurity incidents that have materially affected or are reasonably likely to materially affect us in the future, including our business strategy, results of operations, or financial condition.


text: Management has implemented a program ("Program"), which is part of our overall Enterprise Risk Management system, focused on the assessment, identification, and management of material risks associated with cybersecurity threats. The Program was developed and is managed by our Vice President of Information Security and Privacy (CISSP, CISM and CISA) with oversight from the Chief Information Officer. Both leaders collectively have over 60 years of technology risk and cybersecurity work experience supporting multiple life science organizations. The Program is also closely aligned with the Legal and Global Compliance organizations to oversee adherence with legal, regulatory and contractual requirements from an information security and data privacy perspective.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity processes to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our approach to assessing, prioritizing, and effecting cybersecurity processes and projects is based on standards from the National Institute of Standards and Technology (NIST).

companyName: TENNANT CO

ticker: TNC


text: We have established an enterprise risk management (ERM) program that considers our enterprise strategy, information from internal stakeholders, and information from external sources (e.g., emerging risks and trends, evaluations by third parties, and best practices) to identify, assess, categorize, and monitor risks including cybersecurity risks. The ERM program develops enterprise risk profiles to address individual risk drivers, develop action plans, and monitor against key risk indicators. At least annually, the ERM program is presented to our Board, Audit Committee, and members of management.


text: We have strategically integrated cybersecurity risk management into our broader ERM program to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes. Our strategy includes regular employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software, a patch management program, the execution of table top exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: We test our ability to respond to cybersecurity incidents on a recurring basis. Additionally, we engage third-party service providers to assist with the ongoing monitoring for cybersecurity events and incidents, as well as to complete risk quantification analysis and perform penetration and vulnerability testing. If any gaps are identified, the third-party service providers also assist with incident assessment and response. We conduct thorough up-front security assessments of all third-party providers before engagement, led by our Vice President, Chief Information Office (CIO) and our cybersecurity team, and we maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to security incidents originating from third-parties.


text: We have not encountered cybersecurity incidents or identified risks from cybersecurity threats that have materially impaired our operations or financial standing.


text: Within our organization, we have a management team responsible for assessing and managing cybersecurity risks. The team is led by our CIO and consists of the Cyber Security Incident Response Team (CSIRT) and internal audit personnel. The CSIRT is comprised of IT management and experienced cybersecurity personnel. The role of the CSIRT is to promptly handle an incident so that containment, investigation, and recovery can occur quickly. Where third-party services are leveraged, they ensure they are engaged as necessary. The CSIRT Leader oversees and prioritizes actions during an incident's detection, analysis, and containment. They are also responsible for conveying the special requirements of high severity incidents to the rest of the organization as well as communicating potential impacts to the CIO. Additionally, they are responsible for understanding the SLAs in place with third parties, and the role third parties may play in specific response scenarios. Our CIO has more than 30 years of experience in IT, enterprise security, and cyber risk management and has previously held global IT infrastructure and business solutions roles, including nearly 20 years in such positions in the manufacturing industry. In addition, our CSIRT Leader has 30 years of technology and cybersecurity experience and has previously held data security and global IT infrastructure positions at risk management and asset protection services companies. Effective February 2, 2024, our CIO has retired from employment and continues to serve as our CIO as a contractor through April 2024. During this time, he will continue his existing duties including oversight and management of cybersecurity risks. An active search is underway for a new CIO.


text: The CIO and CSIRT, in combination with the Senior Vice President, Technology and Innovation and CEO, play a pivotal role in informing the Audit Committee of the Board of Directors on cybersecurity risks. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: The Vice President, CIO provides comprehensive quarterly briefings to the Audit Committee. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our quarterly meetings, the Audit Committee, CIO and CEO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. The CIO and CEO provide updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, as well as tabletop exercises for tactical response readiness. This involvement ensures that cybersecurity considerations are integrated into the broader strategic objectives of Tennant Company. The Audit Committee conducts an annual review of the Company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: Risk Management and Strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity processes to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our approach to assessing, prioritizing, and effecting cybersecurity processes and projects is based on standards from the National Institute of Standards and Technology ("NIST").


text: We have established an enterprise risk management ("ERM") program that considers our enterprise strategy, information from internal stakeholders, and information from external sources (e.g., emerging risks and trends, evaluations by third parties, and best practices) to identify, assess, categorize, and monitor risks including cybersecurity risks. The ERM program develops enterprise risk profiles to address individual risk drivers, develop action plans, and monitor against key risk indicators. At least annually, the ERM program is presented to our Board, Audit Committee, and members of management.


text: We have strategically integrated cybersecurity risk management into our broader ERM program to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes. Our strategy includes regular employee training and awareness on cybersecurity risks and related best practices, required password complexity, the use of multi-factor authentication, information security protocols, anti-virus and anti-ransomware software, a patch management program, the execution of tabletop exercises on a periodic basis, established policies and protocols for cyber incident response planning and reporting, and ongoing internal cybersecurity testing. Our risk management team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.


text: We test our ability to respond to cybersecurity incidents on a recurring basis. Additionally, we engage third-party service providers to assist with the ongoing monitoring for cybersecurity events and incidents, as well as to complete risk quantification analysis and perform penetration and vulnerability testing. If any gaps are identified, the third-party service providers also assist with incident assessment and response. We conduct thorough up-front security assessments of all third-party providers before engagement, led by our Vice President, Chief Information Office ("CIO") and our cybersecurity team, and we maintain ongoing monitoring to ensure compliance with our cybersecurity standards. This approach is designed to mitigate risks related to security incidents originating from third parties.


text: Within our organization, we have a management team responsible for assessing and managing cybersecurity risks. The team is led by our CIO and consists of the Cyber Security Incident Response Team ("CSIRT") and internal audit personnel. The CSIRT is comprised of IT management and experienced cybersecurity personnel. The role of the CSIRT is to promptly handle an incident so that containment, investigation, and recovery can occur quickly. Where third-party services are leveraged, they ensure they are engaged as necessary. The CSIRT Leader oversees and prioritizes actions during an incident's detection, analysis, and containment. They are also responsible for conveying the special requirements of high severity incidents to the rest of the organization as well as communicating potential impacts to the CIO. Additionally, they are responsible for understanding the service level agreements ("SLAs") in place with third parties, and the role third parties may play in specific response scenarios. Effective February 2, 2024, our CIO retired from employment and continued to serve as our CIO as a contractor through May 2024. During that time, he continued his existing duties including oversight and management of cybersecurity risk. In June 2024, the Company announced the hiring of a new CIO who will lead the enterprise technology team. The new CIO has over 30 years of experience in IT, enterprise security, and cyber risk management and has previously held global IT infrastructure and business solutions roles. In addition, our CSIRT Leader has 30 years of technology and cybersecurity experience and has previously held data security and global IT infrastructure positions at risk management and asset protection services companies.


text: The CIO and CSIRT, in combination with the Senior Vice President, Chief Transformation Officer and CEO, play a pivotal role in informing the Audit Committee of the Board of Directors on cybersecurity risks. The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of Board members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Terex bases its enterprise-wide cybersecurity program on the National Institute of Standards and Technology's Cybersecurity Framework to ensure our cybersecurity measures are rigorous, adaptable, transparent and aligned with best practices in the industry. We take a comprehensive approach to cybersecurity risks, with a multi-layered cybersecurity strategy based on prevention, detection and mitigation. Primary responsibility within management for assessing, monitoring and managing our cybersecurity risks and program rests with our Vice President ("VP") Cybersecurity and Senior Vice President ("SVP") Chief Digital Officer. Our VP Cybersecurity has significant cybersecurity education/training and many years of industry experience in the field of cybersecurity. In addition, our SVP Chief Digital Officer offers added in-depth knowledge with significant experience leading technology teams. Terex also has a Global Cybersecurity Group ("GCG"), consisting of management and non-management team members, that is tasked with the continuous development and implementation of information security policies and controls.

companyName: TEREX CORP

ticker: TEX


text: Terex utilizes the concept of defense in depth and deploys multiple layers of controls across operations to manage cybersecurity risk. Our GCG monitors and evaluates our cybersecurity infrastructure and performance on an ongoing basis through regular assessments, vulnerability scans, penetration tests and threat intelligence feeds, enabling Terex to identify, prioritize, and effectively manage risks. Additionally, our GCG engages an external third party to complete an annual red team penetration test to assess our preparedness. We apply lessons learned from our defense and monitoring efforts to help prevent future attacks. We also provide awareness training to our team members to help identify, avoid and mitigate cybersecurity threats. Our team members with network access participate annually in required training, including spear phishing and other awareness training. Terex also conducts at least one cyber-incident tabletop exercise annually in collaboration with outside counsel, cybersecurity insurance carriers and/or other third parties. Our Senior Director, Risk Management, works closely with our VP Cybersecurity and information technology department to ensure we are aligned and covered with respect to any cybersecurity insurance coverage needs and overall risk management strategies.


text: Before initiating a third-party service provider, Terex's GCG performs a thorough assessment of its cyber security measures including a review of the third-party provider's information security policy, service organization control report(s), architectural diagram(s) and an overview of its cyber security program. It is also our practice to negotiate breach notification clauses into our IT vendor contracts for vendors who are hosting or storing any Terex information.


text: Terex maintains a variety of policies, plans and procedures that carefully detail the roles and responsibilities of those involved in monitoring, addressing and reporting any cybersecurity incidents, enabling Terex to respond efficiently and effectively, and to minimize any risks or impact to the business or customers. The VP Cybersecurity keeps members of senior management continually informed of any cybersecurity incidents, ensuring they are promptly and appropriately handled. The VP Cybersecurity also keeps the SVP Chief Digital Officer, Chief Executive Officer and other members of our senior management informed of the Company's overall cybersecurity posture and potential risks.


text: The Board of Directors is cognizant of the critical value of managing cybersecurity threat risks and is updated on such matters accordingly. Cybersecurity risks are reviewed by the Board of Directors, at least annually, as part of our enterprise risk management process and as part of a separate update by our SVP Chief Digital Officer. The Audit Committee assists the Board of Directors with its oversight of cybersecurity risks and the steps taken by the Company to monitor and mitigate such cybersecurity risks. The VP Cybersecurity and SVP Chief Digital Officer provide regular, periodic reports to the Audit Committee on cybersecurity metrics and matters. Senior management also keeps the Board of Directors apprised of cybersecurity incidents and related materiality assessments as appropriate.


text: Terex has experienced cyber incidents in the normal course of business; however, no prior cybersecurity incident has had a material adverse effect on Terex's business, strategy, results of operations, financial condition or reputation. For more information on the cybersecurity threats and risks we face, see Part I, Item 1A. – Risk Factors.


text: The Board of Directors ("Board") is cognizant of the critical value of managing cybersecurity threat risks and is updated on such matters accordingly. Cybersecurity risks are reviewed by the Board, at least annually, as part of our enterprise risk management process and as part of a separate update by our SVP Chief Digital Officer. The Audit Committee assists the Board with its oversight of cybersecurity risks and the steps taken by the Company to monitor and mitigate such cybersecurity risks. The VP Cybersecurity and SVP Chief Digital Officer provide regular, periodic reports to the Audit Committee on cybersecurity metrics and matters. Senior management also keeps the Board apprised of cybersecurity incidents and related materiality assessments as appropriate.


text: Cybersecurity risk management and strategy Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards, including those of the National Institute of Standards and Technology, the Center for Internet Security Controls, and the International Organization for Standardization. We use these frameworks, together with information collected from internal assessments, to develop policies for use of our information assets (for example, TI business information and information resources such as mobile phones, computers and workstations), access to specific intellectual property or technologies, and protection of personal information. We protect these information assets through industry-standard techniques, such as multifactor authentication and malware defenses. We also work with internal stakeholders across the company to integrate foundational cybersecurity principles throughout our organization's operations, including employment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. Throughout the year, we also regularly train our employees on cybersecurity awareness, confidential information protection and simulated phishing attacks.

companyName: TEXAS INSTRUMENTS INC

ticker: TXN


text: We regularly engage third-party assessors to conduct penetration testing and measure our program to industry standard frameworks. We also have standing engagements with incident response experts and external counsel. We frequently collaborate with industry experts and cybersecurity practitioners at other companies to exchange information about potential cybersecurity threats, best practices and trends.


text: Our cybersecurity risk management extends to risks associated with our use of third-party service providers. For instance, we conduct risk and compliance assessments of third-party service providers that request access to our information assets.


text: Our cybersecurity risk management is an important part of our comprehensive business continuity program and enterprise risk management. Our global information security team periodically engages with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity risk posture and preparedness. For example, we regularly evaluate and update contingency strategies for our business in the event that a portion of our information resources were to be unavailable due to a cybersecurity incident. We practice our response to potential cybersecurity incidents through regular tabletop exercises, threat hunting and red team exercises.


text: Governance of cybersecurity risk management The board of directors, as a whole, has oversight responsibility for our strategic and operational risks. The audit committee assists the board of directors with this responsibility by reviewing and discussing our risk assessment and risk management practices, including cybersecurity risks, with members of management. The audit committee, in turn, periodically reports on its review with the board of directors.


text: Management is responsible for day-to-day assessment and management of cybersecurity risks. Our chief information officer has primary oversight of material risks from cybersecurity threats. Our chief information officer is the senior vice president responsible for the Information Technology Solutions (ITS) organization and for information protection. Our chief information officer has more than 25 years of experience across various engineering, business and management roles, including serving as the vice president of the design and manufacturing ITS organization, leading the development and implementation of information technology strategies and roadmaps for manufacturing automation.


text: Our chief information security officer reports to our chief information officer. Our chief information security officer has more than 15 years of experience working in information technology-related roles, a degree in Information Technology, and Global Information Assurance Certifications in Security Essentials (GSEC) as an Intrusion Analyst (GCIA) and as a Penetration Tester (GPEN).


text: Our chief information officer and chief information security officer assess our cybersecurity readiness through internal assessment tools as well as third-party control tests, vulnerability assessments, audits and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our chief information officer and chief information security officer, such as potential threats or vulnerabilities. We also employ various defensive and continuous monitoring techniques using recognized industry frameworks and cybersecurity standards.


text: Our chief information officer meets with the audit committee periodically to review our information technology systems and discuss key cybersecurity risks. In addition, the chief financial officer reviews with the audit committee at least annually our global enterprise risk management program, which includes cybersecurity risks, and is also reported to the board.


text: Cybersecurity Risk Management and Strategy As is the case for most large global companies, we are regularly subject to cyberattacks and other cybersecurity incidents and, therefore, we incorporate cybersecurity into our overall risk management process. Our commitment to cybersecurity emphasizes using a risk-based, "defense in depth" approach to assess, educate, block, identify, respond to and recover from cybersecurity threats. Recognizing that no single technology, process or control can effectively prevent or mitigate all risks, we employ a strategy of technologies, processes and controls, all working independently but as part of a cohesive strategy to manage or reduce risk.

companyName: THERMO FISHER SCIENTIFIC INC.

ticker: TMO


text: Our cybersecurity program assists in the management of risks associated with the confidentiality, integrity and availability of data and systems within the company environment to effectively support our business objectives and customer expectations. The program provides guidance to business stakeholders on cybersecurity risks as input into their risk management processes that balance cybersecurity risk with other important risks that may include strategic, regulatory, economic and financial considerations. THERMO FISHER SCIENTIFIC INC.


text: We seek to routinely refine our cybersecurity approach to adapt to changes in the threat landscape and manage emerging security risks. In order to evaluate risks from cybersecurity threats associated with the company's use of certain third-party technology providers, we have incorporated a risk-based assessment into the corporate information technology (IT) procurement process designed to assess the security risk of certain third parties providing new technology solutions to our environment.


text: We believe cybersecurity is the responsibility of every employee, and regularly educate and share best practices with our employees to raise awareness of cybersecurity threats through a security awareness training program, including regular exercises, periodic cyber-event simulations and annual attestation to our Technology Acceptable Use Policy.


text: We do not reasonably believe there are currently any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the company or its business strategy, results of operations or financial condition. For more information on the risks related to our IT systems, see "A significant disruption in, or breach in security of, our IT systems or violation of data privacy laws could adversely affect our business or customers that use our products" under the heading "Risk Factors" in Part I, Item 1A.


text: Cybersecurity Governance and Oversight The Board of Directors has delegated the oversight of cybersecurity risks to the Audit Committee. Our cybersecurity program is led by the company's senior vice president, chief information officer, along with our vice president, chief information security officer. Management provides an operational update to the Audit Committee each quarter. In addition, the Audit Committee and our full Board of Directors receive an annual overview of the cybersecurity program, cybersecurity threat landscape, investments, and opportunities to enhance the company's systems and security of products and operations.


text: The company's corporate IT security team leads the company-wide cybersecurity strategy and advocates to protect the company systems, its employees and customers against cybersecurity risks. Through annual internal and external audits, we maintain an ISO/IEC 27001:2013 certification for the management of our cybersecurity program consisting of the following areas: • cybersecurity program management and governance including risk management; • cybersecurity operations including security operation centers; • product security; • security investigations; • cybersecurity architecture and engineering; and • security awareness and training.


text: Our senior vice president, chief information officer, vice president, chief information security officer (CISO), and vice president, chief product security officer have each served in various roles in IT and information security for over 20 years. These individuals' knowledge and experience along with the culture and talent of the corporate IT security team organization are instrumental in developing and executing our cybersecurity strategies. The CISO meets with senior leadership to review and discuss the cybersecurity program, including emerging cybersecurity risks, threats and industry trends.


text: Cybersecurity is integrated into the risk management process for the company through various corporate mechanisms, including quarterly business reviews, annual budget planning, and targeted risk-based engagements.


text: Our cybersecurity program assists in the management of risks associated with the confidentiality, integrity and availability of data and systems within the company environment to effectively support our business objectives and customer expectations. The program provides guidance to business stakeholders on cybersecurity risks as input into their risk management processes that balance cybersecurity risk with other important risks that may include strategic, regulatory, economic and financial considerations.


text: We seek to routinely refine our cybersecurity approach to adapt to changes in the threat landscape and manage emerging security risks. In order to evaluate risks from cybersecurity threats associated with the company's use of certain third-party technology providers, we have incorporated a risk-based assessment into the corporate information technology (IT) procurement process designed to assess the security risk of certain third parties providing new technology solutions to our environment. THERMO FISHER SCIENTIFIC INC.


text: Cybersecurity Governance and Oversight The Board of Directors has delegated the oversight of cybersecurity risks to the Audit Committee. Our cybersecurity program is led by the company's senior vice president, chief information officer, along with our vice president, chief information security officer (CISO). Management provides an operational update to the Audit Committee each quarter. In addition, the Audit Committee and our full Board of Directors receive an annual overview of the cybersecurity program, cybersecurity threat landscape, investments, and opportunities to enhance the company's systems and security of products and operations.


text: Our senior vice president, chief information officer, vice president, CISO, and vice president, chief product security officer have each served in various roles in IT and information security for over 20 years. These individuals' knowledge and experience along with the culture and talent of the corporate IT security team organization are instrumental in developing and executing our cybersecurity strategies. The CISO meets with senior leadership to review and discuss the cybersecurity program, including emerging cybersecurity risks, threats and industry trends.


text: Cybersecurity Risk Management and Governance Information security is an integral part of the Company's overall enterprise risk management program. The Company's information security program provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of third-party service providers. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity testing, detection, response, prevention and mitigation strategies and informing management and the Company's Board of Directors of material cybersecurity threats and incidents. The Company's information security team also engages third-party security consultants for penetration testing, training and system enhancements.

companyName: TIMKEN CO

ticker: TKR


text: The Board of Directors has overall oversight responsibility for the Company's risk management function, and primarily relies on the Audit Committee to administer this oversight. With respect to cybersecurity, the Board and Audit Committee are responsible for confirming that the Company's management maintains appropriate cybersecurity policies and has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed, to manage cybersecurity risks and to mitigate any cybersecurity incidents. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes for monitoring and mitigating potential cybersecurity risks, exposures, implementing appropriate mitigation measures and maintaining our cybersecurity program. The Company's cybersecurity program is under the direction of our Vice President, Technology who receives reports from its cybersecurity team and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents. The Company's dedicated personnel are certified and experienced information systems security professionals and information security managers with many years of experience. Management reports to either the Board of Directors or the Audit Committee at least annually on, among other topics, updates to the Company's cybersecurity program and mitigation strategies, developments in cybersecurity practices generally, and third-party assessments of the Company's cybersecurity program. Management also provides general program updates and industry trends to the Board and Audit Committee on a more ad hoc basis.


text: In 2023, the Company did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, the Company cannot eliminate all risks from cybersecurity threats, or provide assurances that it has not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors – Risks Related to Data Privacy and Information Security in this Annual Report on Form 10-K.


text: Cybersecurity Risk Management and Governance Information security is an integral part of the Company's overall enterprise risk management program. The Company maintains cybersecurity processes designed to detect and assess the severity of cybersecurity threats and incidents and, where applicable and possible, to identify the source of a threat or incident, including, whether it is associated with the use of third-party service providers. The Company's processes also include cybersecurity testing, detection, response, prevention and mitigation strategies, conducting contract and vendor due diligence review, and informing management and the Company's Board of Directors of material cybersecurity threats and incidents. The Company's information security team also engages third-party security consultants for penetration testing, training and system enhancements. The Company provides training and education for employees on cybersecurity awareness, including confidential information protection and simulated phishing attacks where appropriate for the employee's role.


text: The Board of Directors has overall oversight responsibility for the Company's risk management function, and primarily relies on the Audit Committee to administer this oversight. With respect to cybersecurity, the Board and Audit Committee are responsible for confirming that the Company's management maintains appropriate cybersecurity policies and has processes in place designed to identify and evaluate cybersecurity risks to which the Company is exposed, to manage cybersecurity risks and to mitigate any cybersecurity incidents. The Vice President of Information Technology is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes for monitoring and mitigating potential cybersecurity risks, exposures, implementing appropriate mitigation measures and maintaining our cybersecurity program. The Company's dedicated personnel, who report to the Vice President of Information Technology, are certified and experienced information systems security professionals and information security managers with many years of experience. The Vice President of Information Technology has managed this team for over five years after having progressed through various roles of increasing responsibility in both operations and technology at the Company. The Vice President of Information Technology and other members of management report to either the Board of Directors or the Audit Committee at least annually on, among other topics, updates to the Company's cybersecurity program and mitigation strategies, developments in cybersecurity practices generally, and third-party assessments of the Company's cybersecurity program. Management also provides general program updates and industry trends to the Board and Audit Committee on a more ad hoc basis.


text: In 2024, the Company did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, despite our efforts, the Company cannot eliminate all risks from cybersecurity threats, or provide assurances that it has not experienced an undetected cybersecurity incident. For more information about these risks, please refer to Item 1A. Risk Factors – Risks Related to Data Privacy and Information Security in this Annual Report on Form 10-K.


text: We recognize the increasing volume and sophistication of cyber threats and take our responsibility to protect the information and systems under our purview seriously. Our cybersecurity processes aim to provide a comprehensive approach to assess, identify, and manage material risks arising from these cybersecurity threats.

companyName: TRANSCONTINENTAL GAS PIPE LINE COMPANY, LLC


text: Comprehensive Cybersecurity Program: We have implemented a comprehensive cybersecurity risk management program (Cybersecurity Program) that is aligned with the National Institute for Standards and Technology Cybersecurity Framework. Our Cybersecurity Program provides a risk-based approach to cybersecurity, and security controls are tailored so that cost-effective controls can be applied commensurate with the risk and sensitivity of specific information systems, control systems and enterprise data. Our Cybersecurity Program incorporates best practices and industry standards from multiple sources and is designed to comply with applicable regulations. The Cybersecurity Program includes, but is not limited to, the following elements: risk assessment, policies and procedures, training and awareness, auditing, compliance monitoring and testing, and incident response.


text: Integration with Overall Risk Management: Our cybersecurity processes have been integrated into our overall risk management system and processes. We consider cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our cybersecurity risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: Engagement of Third Parties: We often engage with specialized third-party assessors, consultants, auditors, and other experts to review, validate, and enhance our cybersecurity practices. Their independent assessments provide an external perspective on our cybersecurity posture, allowing us to leverage best practices from the industry and ensure our defenses remain robust. All third parties engaged for such processes are subjected to rigorous scrutiny to ensure they meet our security standards, and the engagements are documented and reviewed periodically.


text: Oversight of Third-party Service Providers: We acknowledge the potential risks associated with our use of third-party service providers. Therefore, we have established processes to oversee and identify material cybersecurity risks that may be associated with third-party service providers with whom we engage. This includes conducting thorough, risk-based due diligence before onboarding, performing security assessments, and confirming adherence to our cybersecurity requirements. We also maintain active communication channels with these providers to stay informed about any potential security incidents or concerns.


text: Disclosure of Risks: We describe how risks from cybersecurity threats could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A of this Annual Report on Form 10-K.


text: We are committed to continually enhancing our cybersecurity processes and practices to address the dynamic nature of the threats we face and to ensure the security and integrity of our systems and data.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for Williams' Board of Directors and management. Each member of our organization, from facility operators to board members, has a responsibility to safeguard our cybersecurity. Williams' Chief Information Security Officer (CISO) is responsible for our cybersecurity strategy and execution, while the Board and Williams' Audit Committee are responsible for oversight of our cybersecurity risk.


text: The Cybersecurity Executive Advisory Board (Executive Advisory Board) is led by the CISO, with Williams' Chief Information Officer (CIO), Chief Financial Officer, Chief Human Resources Officer, General Counsel, and Chief Operations Officer as standing members. The Executive Advisory Board's purpose is to ensure enterprise alignment with the Cybersecurity Program and provide executive oversight of the Cybersecurity Program.


text: The Williams' Board of Directors oversees cybersecurity-related policy and strategy. As part of this oversight, the CISO provides a cybersecurity dashboard that is reviewed by the Board at every regularly scheduled Board meeting, which includes key performance indicators for cybersecurity process maturity, operational performance, and enterprise performance toward TSA compliance. Additionally, the CIO and/or CISO presents to the Board bi-annually regarding our cybersecurity risks and strategies, including as part of our annual long-term strategy session. The Audit Committee, comprised of independent directors, reviews the implementation and effectiveness of cybersecurity risk management protocols and reviews the effectiveness of cybersecurity as part of the Company's accounting and internal control policies. As part of this oversight, the CIO presents to the Audit Committee bi-annually, as well as periodically in conjunction with any internal audits related to cybersecurity. Additionally, we have protocols by which cybersecurity incidents that meet established reporting thresholds are escalated internally and, where appropriate, are reported to the Board, as well as ongoing updates regarding any such incident until it has been addressed.


text: The CIO has been in his role at Williams for over 10 years and has over 30 years of combined Information Technology experience with a broad scope of responsibility. He has provided senior leadership support of the cybersecurity and risk management programs since 2013. Our CIO holds a bachelor's degree in management information systems (MIS) from the University of Oklahoma and a Master of Business Administration in MIS from the University of Dallas.


text: The CISO has been at Williams for over 25 years. During that time, he has held a variety of IT positions at multiple levels in the organization ranging from network engineering to application development, project management as well as several IT Manager and Director roles. He has had oversight of our cybersecurity and risk management programs since 2017. Active in government and private sector partnerships, he is currently serving as the outgoing Chair of the Oil & Natural Gas Subsector Coordinating Council and recently acted as the Chair of the Interstate Natural Gas Association of America security committee. Our CISO holds degrees in Business Administration and MIS from the University of Oklahoma and is certified in Leadership from Harvard Business School's executive education. In 2018, he obtained his Chief Information Security Officer certification from Carnegie Mellon University.


text: Risk Management and Strategy We rely on the proper functioning and availability of our information technology systems, some of which are dependent on services provided by third parties, in operating our business. It is important that the data processed by these systems remains confidential, as it often includes sensitive information relating to our business, customers, employees, and vendors. Consequently, we are focused on mitigating cybersecurity risks. Trinity has an information risk management ("IRM") organization headed by an experienced Chief Information Security Officer ("CISO"), which is separate from our broader information technology organization.

companyName: TRINITY INDUSTRIES INC

ticker: TRN


text: Assessing, Identifying, and Managing Material Risks Trinity's IRM program is aligned to the National Institute of Science and Technology ("NIST") Cybersecurity Framework ("CSF") and conducts maturity assessments against the NIST CSF on a quarterly basis. Our IRM program encompasses the full lifecycle of information risk, from creation through disposition, and is guided by policies, processes, standards, and procedures in vulnerability management, incident response, information governance, risk management, and security awareness. Additionally, Trinity exercises a variety of testing approaches to assess the state of systems and personnel, including frequent automated simulated breaches, annual penetration testing by independent third parties, ad hoc penetration testing by internal personnel, and tabletop exercises for information technology, IRM and legal employees. Trinity also maintains an incident response relationship with an industry-leading provider to ensure resource availability if a significant event were to occur.


text: As cybersecurity touches all employees, we include formal training on cybersecurity in the annually required Code of Business Conduct training. The training focuses on awareness of cybersecurity risks and requirements. For targeted groups, we conduct phishing email response checks.


text: Integration Into Overall Risk Management Cybersecurity risk management is integrated into our broader enterprise risk management framework to promote a culture of cybersecurity awareness. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes throughout Trinity. Our IRM team works closely with our information technology department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Cybersecurity risks are assessed by Trinity's IRM team, and the risk assessment is aligned with business-level processes and is consistent with Trinity's standard enterprise risk management methods and thresholds. Our IRM organization regularly consumes a variety of threat intelligence and information security news sources to inform and align risk management decisions to current threats and threat landscapes.


text: Oversight of Third-Party Risk Trinity implements stringent processes to oversee and manage cybersecurity risks associated with its use of third-party service providers. These processes include targeted assessments of both third parties and the solutions being implemented or used in accordance with Trinity's information security policies, standards, and risk appetites. In addition, we seek contractual safeguards where appropriate regarding cybersecurity and information risk management.


text: Risks From Cybersecurity Threats To date, we have not experienced any risks from cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition.


text: Board of Directors Oversight and Reporting The Audit Committee of our Board of Directors reviews the Company's risks related to data privacy, cybersecurity, and information technology. The Audit Committee periodically reviews and assesses the adequacy of the security for the Company's information systems and the Company's contingency plans in the event of a systems breakdown or security breach. The CISO reports to the Audit Committee twice per year and to the Board of Directors once per year on cybersecurity risks, activities, policies and procedures.


text: Management's Role Our CISO and Chief Legal Officer oversee all cybersecurity efforts and lead our IRM organization. Our CISO has over two decades of experience in the cybersecurity and information security fields, including experience with both private businesses and the military. In addition, he has degrees in both information technology and business administration. Our IRM professionals include multiple personnel with more than ten years of experience and expertise in information security and are continually building their professional knowledge through local information systems communities and an available set of educational materials.


text: Assessing, Identifying, and Managing Material Risks Trinity's IRM program is aligned to the National Institute of Science and Technology ("NIST") Cybersecurity Framework ("CSF") and conducts maturity assessments against the NIST CSF on a quarterly basis. Our IRM program encompasses the full lifecycle of information risk, from creation through disposition, and is guided by policies, processes, standards, and procedures in vulnerability management, incident response, information governance, risk management, and security awareness. Additionally, Trinity exercises a variety of testing approaches to assess the state of systems and personnel, including annual penetration testing by independent third parties, ad hoc penetration testing by internal personnel, and tabletop exercises for executive and senior leadership, information technology, IRM, and legal employees. Trinity also maintains an incident response relationship with an industry-leading provider to ensure resource availability if a significant event were to occur.


text: In response to ever-changing cybersecurity threats, TEP maintains a comprehensive cybersecurity risk management program for its operations, information systems, data, and critical infrastructure. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected TEP, including its business strategy, results of operations, or financial condition. See Part I, Item 1A Risk Factors of this Form 10-K for a discussion of cybersecurity threats that could have a material impact on TEP, which should be read in conjunction with this Item 1C for a detailed description of the risks related to cybersecurity.

companyName: TUCSON ELECTRIC POWER CO


text: Risk Management and Strategy TEP's cybersecurity risk management program is informed by the National Institute of Standards and Technology Cybersecurity Framework. This program includes dedicated investments in people, processes, and technology to manage and reduce cybersecurity risk, including third-party threats. Multiple layers of security controls are deployed across asset and technology classes with a special emphasis on the reliable and safe operation of TEP's utility systems. Cybersecurity controls employed include firewalls, access management, multi-factor authentication, backups, endpoint protection, threat intelligence, and security monitoring. TEP continues to adjust and refine this program in response to the shifting threat landscape, third-party assessments, and industry best practices.


text: Cybersecurity risk is tactically and strategically managed by TEP's Enterprise Cybersecurity team comprised of experienced professionals with various cybersecurity certifications, including Certified Information Systems Security Professional (CISSP) and Global Industrial Cyber Security Professional (GICSP). This team uses governmental and industry threat intelligence, such as the Electricity Information Sharing and Analysis Center, Cybersecurity and Infrastructure Security Agency, and internal cybersecurity tools to proactively identify, assess, manage, and respond to risk, including network monitoring and vulnerability scanning.


text: TEP regularly conducts internal evaluations and testing of its design and operational effectiveness of security controls and is subject to external independent cybersecurity audits including those associated with the NERC Critical Infrastructure Protection standards. TEP engages third-party services to provide consulting on best practices to address new challenges. TEP participates in regular cybersecurity roundtable discussions with peer cybersecurity professionals to review current threats and opportunities, lessons learned, and best practices. TEP's Compliance Program Management Office provides additional ongoing internal oversight of response to cybersecurity regulation. Third-party cybersecurity risk is addressed through vendor risk management processes and includes technology reviews and contractual specifications. Third-party risk management is designed to reduce risk associated with the use of third-party providers.


text: Cybersecurity training is conducted on a regular basis and includes awareness campaigns, in-person training, and simulations. Users of TEP's information systems are required to comply with a comprehensive internal acceptable use policy.


text: TEP employs and regularly exercises UNS Energy's Cybersecurity Incident Response and Reporting Plan. This plan identifies key roles and responsibilities applicable during a cybersecurity incident and classifies incidents according to qualitative and quantitative factors that are continuously reviewed as information evolves over the course of an incident. The plan also identifies certain reporting obligations and may trigger additional response processes such as activation of UNS Energy's Data Breach Response Plan.


text: Cybersecurity risk is identified and tracked through TEP's Enterprise Risk Management (ERM) program that consists of formal vetting and quarterly reporting to the UNS Energy Audit and Risk Committee and the UNS Energy Board. The UNS Energy Board Environmental, Safety, and Security Committee oversees cybersecurity strategy, performance, and risk, and timely reviews cybersecurity events, depending on severity, even if not material to TEP. The UNS Energy Board is notified of significant cybersecurity events as outlined in UNS Energy's Cybersecurity Incident Response and Reporting Plan.


text: TEP's Security Steering Committee provides management oversight to its cybersecurity strategy, performance, and risk. This committee also reviews significant cybersecurity events, including the scope of the incident and the associated prevention, detection, mitigation, and remediation efforts. This committee includes the Chief Information Officer, Chief Financial Officer, Chief Legal Officer, Senior Director of IT Operations and Enterprise Security, and others with the requisite cybersecurity experience, training, and skills who oversee TEP's ERM program. The Senior Director of IT Operations and Enterprise Security holds CISSP and GICSP certifications.


text: TEP's Security Steering Committee provides management oversight to its cybersecurity strategy, performance, and risk assessment and management. This committee also reviews significant cybersecurity events, including the scope of the incident and the associated prevention, detection, mitigation, and remediation efforts. This committee includes the Chief Operating Officer, Chief Legal Officer, Senior Vice President of Finance, Senior Director of IT Operations and Enterprise Security, and others with the requisite cybersecurity experience, training, and skills who oversee TEP's ERM program. The Senior Director of IT Operations and Enterprise Security has 16 years of experience in managing technology and risks and advising on cybersecurity issues and holds CISSP and GICSP certifications.


text: As part of our overall risk management program, we run and maintain a formal information security, cybersecurity, and privacy program led by our Chief Information Security Officer ("CISO") that uses a risk-based approach to evaluate new technology, third parties, and changes to the technology landscape. The program is assessed using multiple industry frameworks including the National Institute of Standards and Technology Cybersecurity Framework (NIST-CSF Version 2.0). We engage with industry partners, assessment firms and advisors, law enforcement, and others to periodically assess our cybersecurity capabilities, and utilize a defense-in-depth approach to protect our systems and services.

companyName: TYSON FOODS, INC.

ticker: TSN


text: Additionally, we assess data risks using privacy impact assessments and manage these risks in close alignment with data governance, operations, and analytics teams. We identify assets and their criticality to business operations and provide reasonable protection, threat detection, response and recovery capabilities.


text: We address third-party cybersecurity risks presented by our use of third-party software, service, data and technology providers, including cloud-based services, and proactively evaluate the cybersecurity risk of third parties using multiple evaluation factors which are aligned with our contracting and vendor selection processes. We actively work with internal partners to assess and implement methods of transferring risk to appropriate parties.


text: We assess our technology assets and their vulnerabilities, including risks from our suppliers and vendors, to prioritize and improve program efforts consistent with our risk management strategy. We engage in the periodic assessment and testing of our program. These include tabletop exercises, vulnerability testing and other methods focused on evaluating the effectiveness of our cybersecurity measures and planning. We actively engage third parties to assist with our assessments and testing processes. We adjust our cybersecurity policies, standards, processes and practices, where appropriate, based on internal and external assessments and testing results.


text: We provide technical safeguards that are designed to provide commercially reasonable protection of our technology and information systems. We actively monitor and assess the impact of potential cybersecurity threats to our technology systems. We partner with public and private organizations, such as the Food and Agriculture Information Sharing and Analysis Center (Food and Ag-ISAC), to understand and modify our programs to respond to an ever-evolving threat landscape. We implement training and awareness practices to mitigate human risk, including regular phishing awareness campaigns, mandatory computer-based training and internal communications.


text: Detection, Response and Recovery We employ threat monitoring and detection capabilities intended to identify active attackers and threats to our technology systems. We have established a defined incident response plan to assess, respond and recover from cybersecurity incidents, including cyberattacks and other non-cybersecurity related business technology outages. The plan includes the coordination of activities that include an evaluation of materiality and facilitation of any required notifications, regulatory obligations and disclosures.


text: We are not aware of any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, which have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, the cybersecurity threat environment is increasingly challenging, and we constantly face risks from cybersecurity threats. There can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that could materially affect us. Additional information about the cybersecurity risks we face is discussed in Item 1A. Risk Factors, which should be read in conjunction with the information above.


text: The Board of Directors and management work together to manage cybersecurity risk as part of our broader enterprise risk management approach.


text: Our Board of Directors has delegated risk management oversight responsibility for information security, which includes data privacy and cybersecurity, to the Governance and Nominating Committee. Certain of our board members, including certain members of our Governance and Nominating Committee, have backgrounds or experience in risk management and/or information technology. On at least an annual basis, the Governance and Nominating Committee receives updates from our CISO, Chief Information & Technology Officer ("CITO") and other members of management on risks related to information systems, information security, data privacy and cybersecurity. The Board of Directors also receives regular reports from the Governance and Nominating Committee on these and other risk-related matters as necessary. Our CISO provides information to the Governance and Nominating Committee pursuant to risk-based escalation protocols for cybersecurity incidents that exceed designated thresholds.


text: MANAGEMENT'S ROLE IN CYBERSECURITY RISK MANAGEMENT Our CISO leads the Information Security team and has global responsibility for overseeing our information security, data privacy and cybersecurity program. The program is operationalized through use of multi-disciplinary teams including governance, risk and compliance; identity and access management; cloud and infrastructure security; data security; application security; vulnerability and threat management; and security detection and response operations.


text: Additionally, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity incidents and reports cybersecurity incidents that reach designated thresholds to senior management and, if necessary, to the Governance and Nominating committee. Our CISO has been with the Company since 1997, has held numerous roles in information technology and has led the information security program since 2016. Our CITO, to whom the CISO reports, has been with the company since 2017 and has served as the Company's CITO since 2023.


text: Our Board of Directors has delegated risk management oversight responsibility for information security, which includes data privacy and cybersecurity, to the Governance and Nominating Committee. In addition, beginning in fiscal 2025, the Company's Board of Directors appointed a special committee of the Board of Directors (the "Technology Committee") to oversee and advise on technology-related strategies, investments, risks and innovations to enable alignment with the Company's strategy, operational priorities and cybersecurity protections. Among other responsibilities, the Technology Committee oversees the Company's cybersecurity framework, data privacy practices, and information security programs and scorecards.


text: Certain of our board members, including certain members of our Governance and Nominating Committee and the Technology Committee have backgrounds or experience in risk management and/or information technology. On at least an annual basis, the Governance and Nominating Committee receives updates from our CISO, Chief Technology Officer ("CTO") and other members of management on risks related to information systems, information security, data privacy and cybersecurity. The Board of Directors also receives regular reports from the Governance and Nominating Committee and the Technology Committee on these and other risk-related matters as necessary. Our CISO provides information to the Technology Committee pursuant to risk-based escalation protocols for cybersecurity incidents that exceed designated thresholds.


text: Additionally, our CISO monitors the prevention, detection, mitigation and remediation of cybersecurity incidents and reports cybersecurity incidents that reach designated thresholds to senior management and, if necessary, to the Governance and Nominating committee. Our CISO has been with the Company since 1997, has held numerous roles in information technology and has led the information security program since 2016. Our CTO, to whom the CISO reports, has been with the Company since 2013 and has served as the Company's CTO since 2025.


text: Board and Management Oversight of Cybersecurity Risks The Company considers management of cybersecurity and digital risk as essential for enabling success. The Audit Committee (the "Audit Committee") of the Board provides oversight of the Company's risk assessment and risk management policies and strategies with respect to significant business risks, including cybersecurity and digital risk. On a regular basis, the Audit Committee receives reports from the Company's Chief Information Security Officer ("CISO") or her representative(s) regarding the identification and management of cybersecurity risks, including when applicable, notable cybersecurity threats or incidents impacting the aviation sector or the Company, results of independent third-party assessments of the Company's cybersecurity program, key metrics, capabilities, resourcing and strategy regarding the Company's cybersecurity program and updates related to cybersecurity regulatory developments.

companyName: United Airlines Holdings, Inc.

ticker: UAL


text: The Company's CISO leads the Cybersecurity and Digital Risk ("CDR") organization, which oversees the approach to identifying and managing cybersecurity and digital risk. The Company's current CISO has extensive technology and risk management experience in critical infrastructure sectors and is qualified as a boardroom certified technology expert by the Digital Directors Network. She serves on the U.S. President's National Infrastructure Advisory Council, examining and providing recommendations related to cross-sector critical infrastructure security and resilience. She serves on the board of directors of the Internet Security Alliance, has served, and continues to serve, as Chair of the Cybersecurity Council at Airlines for America, and has served as Chair and is currently a member of the board of directors of the Aviation Information Sharing and Analysis Center (A-ISAC). The CDR organization includes teams focusing on Cyber Defense, Identity & Digital Trust, and Secure Product Solutions & Aircraft Cybersecurity Operations. The teams include individuals with a broad array of cybersecurity expertise, including experience in offensive cybersecurity; application cybersecurity; product cybersecurity; cloud cybersecurity; infrastructure cybersecurity; cybersecurity systems; engineering and architecture; information technology cybersecurity; operational technology cybersecurity; identity and access management; vulnerability and asset management; cybersecurity threat intelligence; cybersecurity regulatory compliance; digital fraud; digital trust; incident response; insider threat assessment; and aircraft cybersecurity.


text: The Company's senior leadership, including the Safety, Legal, Government Affairs, Operations, Aviation Security, Finance, Communications and Digital Technology functions, as well as others as needed, support the CDR and contribute to the management of cybersecurity and digital risk by attending regular cybersecurity risk reviews and participating in cybersecurity drills.


text: Cybersecurity Risk Management and Strategy The Company established a risk-based strategy informed by guiding principles from industry standard cybersecurity and risk management frameworks, such as those published by the National Institute of Standards and Technology (NIST). The Company's cybersecurity risk management framework is integrated with the Company's Enterprise Risk Management ("ERM") process that is subject to oversight by the Board. Cybersecurity risks are one of the key risks regularly evaluated, assessed and monitored as part of the Company's overall ERM process.


text: As part of its risk-based strategy, the Company maintains appropriate technical and organizational measures and regularly reviews the appropriateness of those controls considering changes to the technical or regulatory environment. The Company also regularly incorporates cybersecurity awareness training into employee communications, engagement and training activities. The Company participates in various information sharing organizations to timely share and receive threat information, thereby improving the collective defense of the aviation and other critical infrastructure sectors. The Company regularly seeks opportunities to improve its capabilities, including through cybersecurity trainings and skill development programs for its CDR members.


text: The Company utilizes a variety of third parties in connection with its cybersecurity risk management. For example, the Company uses the U.S. Department of Homeland Security's Cybersecurity and Infrastructure Security Agency's Known Exploitable Vulnerabilities Catalog, the MITRE Corporation's Common Vulnerabilities and Exposures database and other threat intelligence portals and feeds to identify vulnerabilities. The Company also employs third-party cybersecurity companies to add capacity or expertise when necessary. Additionally, regular assessments of the Company's cybersecurity program are conducted by independent third-party assessors.


text: The Company is subject to cybersecurity risks related to its business partners and third-party service providers, as further detailed under the heading "Increasing privacy, data security and cybersecurity obligations or a significant data breach may adversely affect the Company's business" included as part of our risk factor disclosures in Part I, Item 1A. of this report. To manage these risks, the Company has integrated third-party incidents into its cybersecurity incident response processes. The Company also conducts evaluations and assessments of key suppliers based on risk and seeks to incorporate appropriate measures to manage the risk. The Company also regularly monitors the external cybersecurity posture of thousands of third parties through various service providers.


text: Crucially, the Company, or its third-party service providers it may rely on, may not be able to design or implement technical or organizational controls comprehensively, consistently or effectively as intended to protect the confidentiality, integrity or availability of systems and data. Because the Company utilizes a risk-based strategy, based on professional judgment and analysis of the risks, it is possible that the Company may underappreciate or not recognize a specific risk. Moreover, even the best designed and implemented security controls may not eliminate cybersecurity incidents.


text: Cybersecurity Incident Management The CDR organization uses a variety of prevention and detection tools and other resources to identify potential cybersecurity incidents. When a cybersecurity incident is identified, CDR's incident response team engages with the appropriate subject matter experts, the relevant management of impacted organization(s) and others to analyze, contain, eradicate, mitigate, and recover from the incident as applicable. Throughout the incident response process, CDR leadership, the CISO and the Company's Chief Legal Officer are informed and consulted. As appropriate, incidents are escalated for review by the Senior Leader Crisis Team (the "SLCT"), which consists of cross-functional leaders of the Company. A subgroup of the Company's Disclosure Council assesses the information reviewed by the SLCT and makes a recommendation regarding the cybersecurity incident's materiality to the full Disclosure Council and subsequently to the Audit Committee. Additionally, the CDR organization has frequent operating rhythms to, among other things, review cybersecurity incidents and track the progress of cybersecurity initiatives. The SLCT also meets according to regular operating rhythms to review cybersecurity incidents and stay informed of evolving cybersecurity risks.


text: The Company faces risks from cybersecurity threats, including as a result of any cybersecurity incidents, that could have materially affected or are reasonably likely to materially affect its business strategy, results of operations, and financial condition, cash flows or reputation. Although to our knowledge such risks have not materially affected us in the last three fiscal years, from time to time the Company has experienced and will continue to experience cybersecurity incidents, whether directly or through our supply chain or other channels, in the normal course of its business. For more information about the cybersecurity-related risks that the Company faces, see the risks detailed under the headings "The Company relies heavily on technology and automated systems to operate its business and any significant failure or disruption of, or failure to effectively integrate and implement, these technologies or systems could materially harm its business" and "Increasing privacy and data security obligations or a significant data breach may adversely affect the Company's business" included as part of our risk factor disclosures in Part I, Item 1A. of this Form 10-K.


text: Board and Management Oversight of Cybersecurity Risks The Company considers management of cybersecurity and digital risk as essential for enabling success. The Audit Committee (the "Audit Committee") of the Board provides oversight of the Company's risk assessment and risk management policies and strategies with respect to significant business risks, including cybersecurity and digital risk. On a regular basis, the Audit Committee reviews reports from the Company's Chief Information Security Officer ("CISO") or her representative(s) regarding the identification and management of cybersecurity risks, including when applicable, notable cybersecurity threats or incidents impacting the aviation sector and the Company; results of independent third-party assessments of the Company's cybersecurity program; key metrics, capabilities, resourcing and strategy regarding the Company's cybersecurity program; and updates related to cybersecurity regulatory developments.


text: The CISO leads the Company's Cybersecurity and Digital Risk ("CDR") organization, which oversees the Company's approach to identifying and managing cybersecurity and digital risk. The Company's current CISO has extensive technology and risk management experience in critical infrastructure sectors and is qualified as a boardroom certified technology expert by the Digital Directors Network. She has served on the U.S. President's National Infrastructure Advisory Council, examining and providing recommendations related to cross-sector critical infrastructure security and resilience. She serves on the board of directors of the Internet Security Alliance, is currently a member of the Cybersecurity Council at Airlines for America (and has served as Chair) and is currently a member of the board of directors of the Aviation Information Sharing and Analysis Center (A-ISAC). The CDR organization includes teams focusing on cyber defense, identity & digital trust, secure product solutions & aircraft cybersecurity operations. The teams include individuals with a variety of cybersecurity expertise, including expertise in penetration testing; application cybersecurity; product cybersecurity; cloud cybersecurity; infrastructure cybersecurity; cybersecurity engineering and architecture; identity and access management; vulnerability and asset management; cybersecurity threat intelligence; cybersecurity regulatory compliance; digital fraud; digital trust; incident response; insider threat assessment; and aircraft cybersecurity.


text: The Company's senior leadership, including across the functions of the Company's safety, legal, government affairs, operations, aviation security, finance, communications and digital technology as well as others when appropriate, support CDR and contribute to the management of cybersecurity and digital risk by attending regular cybersecurity risk reviews and participating in cybersecurity exercises.


text: Cybersecurity Risk Management and Strategy The Company established a risk-based strategy informed by guiding principles from industry standard cybersecurity and risk management frameworks, such as those published by the National Institute of Standards and Technology. The Company's cybersecurity risk management framework is integrated with the Company's Enterprise Risk Management ("ERM") process that is subject to oversight by the Board. Cybersecurity risks are one of the key risks regularly evaluated, assessed and monitored as part of the Company's overall ERM process.


text: As part of its risk-based strategy, the Company maintains appropriate technical and organizational measures and regularly reviews the appropriateness of those controls based on changes to the technical or regulatory environment. The Company also regularly incorporates cybersecurity awareness training into employee communications, engagement and training activities. The Company participates in various information-sharing organizations to timely share and receive threat information, thereby improving the collective defense of the aviation, retail and hospitality and other critical infrastructure sectors. The Company regularly seeks opportunities to improve its capabilities, including through cybersecurity trainings and skill development programs for its CDR members.


text: The Company utilizes a variety of third parties in connection with its cybersecurity risk management. The Company also employs third-party cybersecurity companies to add capacity or expertise when necessary. Additionally, assessments of the Company's cybersecurity program are periodically conducted by independent third-party assessors.


text: The Company is subject to cybersecurity risks related to its business partners and third-party service providers, as further detailed under the heading "Increasing privacy, data security and cybersecurity obligations or a significant data breach may adversely affect the Company's business" included as part of the risk factor disclosures in Part I, Item 1A. of this report. To manage these risks, the Company considers the impact of third-party incidents as part of its cybersecurity incident response processes. The Company also conducts evaluations of key suppliers based on risk and seeks to incorporate appropriate security standards to manage the risk. The Company also regularly monitors the external cybersecurity posture of select third parties through various service providers.


text: Crucially, the Company and its suppliers strive to design and implement technical and organizational controls comprehensively, consistently and effectively as intended to protect the confidentiality, integrity or availability of systems and data. However, because the Company utilizes a risk-based strategy, based on professional judgment and analysis of the risks, it is possible that the Company may underappreciate or not recognize a specific risk. Moreover, even the best designed and implemented security controls may not eliminate the occurrence of cybersecurity incidents.


text: Cybersecurity Incident Management The CDR organization uses a variety of prevention and detection tools and other resources to identify potential cybersecurity incidents. When a cybersecurity incident is identified, CDR's incident response team engages with the appropriate subject matter experts, the relevant management of impacted organization(s) and others to analyze, contain, eradicate, mitigate and recover from the incident as applicable. When appropriate, during the incident response process, the CISO, CDR leadership and the Company's Chief Legal Officer may be informed and consulted and if deemed necessary, incidents may be escalated for review by the Senior Leader Crisis Team, which consists of cross-functional leaders of the Company. The Company maintains a process in which a subgroup of the Company's Disclosure Council would make a recommendation regarding the materiality of a cybersecurity incident to the full Disclosure Council and subsequently to the Audit Committee. Additionally, the CDR organization has frequent operating rhythms to, among other things, review cybersecurity incidents and track the progress of cybersecurity initiatives.


text: The Company faces risks from cybersecurity threats, including as a result of any cybersecurity incidents, that could have materially affected or are reasonably likely to materially affect its business strategy, results of operations, and financial condition, cash flows or reputation. Although to our knowledge such risks have not materially affected us in the last three fiscal years, from time to time the Company has experienced and will continue to experience cybersecurity incidents, whether directly or through our supply chain or other channels, in the normal course of its business. For more information about the cybersecurity-related risks that the Company faces, see the risks detailed under the headings "The Company relies heavily on technology and automated systems to operate its business and any significant failure or disruption of, or failure to effectively integrate and implement, these technologies or systems could materially harm its business or business strategy" and "Increasing privacy, data security and cybersecurity obligations or a significant data breach may adversely affect the Company's business" included as part of our risk factor disclosures in Part I, Item 1A. of this Form 10-K.


text: Risk Management and Strategy The Company is subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition, and liquidity. See also our discussion in the Risk Factors in Item 1A of this report. As a component of our Company-wide enterprise risk management framework, we implemented a cybersecurity program whose objective is to assess, identify, and manage risks from cybersecurity threats that may result in adverse effects on the confidentiality, integrity, and availability of the electronic information systems that we own. We regularly perform internal security assessments, engage third-party consultants to conduct external security assessments, and participate in, conduct, and/or administer exercises, drills, and recovery tests as part of this program. We also maintain training programs and policies and procedures designed to safeguard employee handling and use of data, internet usage, controlled access measures, and physical protections. We consult with industry groups, monitor threat intelligence reports, and communicate with various government agencies in an effort to stay up-to-date on changes in the cybersecurity threat landscape. This program, in addition to addressing our own information systems, is also designed to oversee, identify, and reduce the potential impact of a security incident at a third-party service provider or that otherwise impacts third-party technology and systems we use.

companyName: UNION PACIFIC CORP

ticker: UNP


text: Internal Cybersecurity Team The Company's internal information security organization (Internal Cybersecurity Team), led by our Executive Vice President and Chief Information Officer (CIO) as well as the Assistant Vice President and Chief Information Security Officer (CISO), is responsible for coordinating all aspects of the Company's electronic information security systems, including prevention, detection, mitigation, and remediation of cybersecurity incidents, as well as implementing, monitoring, and maintaining our enterprise-wide security strategy, standards, architecture, policies, and processes. Our CIO reports directly to our Chief Executive Officer, our CISO reports to our CIO, and reporting to our CISO are our Deputy Chief Information Security Officer (Deputy CISO) and other experienced information security personnel responsible for various parts of our business. In addition to our internal cybersecurity capabilities, we also periodically engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks. When the Company learns of a cybersecurity incident at a third-party service provider, the Company's respective department contacts maintain communication with the third-party service provider and communicate any cybersecurity incidents to the CISO.


text: Security Policy and Requirements As part of the Company's Crisis Management Plan, the Company's cybersecurity Incident Response Plan (the IRP) provides a framework for responding to cybersecurity incidents. The IRP sets out a coordinated approach to discovering, investigating, containing, tracking, mitigating, and remediating cybersecurity incidents, including a framework for elevating and reporting findings and keeping senior management and other key stakeholders informed and involved, based on assessments regarding the scope or significance of incidents. The IRP applies to the Company's extended computing environment, including electronic information resources that are owned or used by the Company and are routinely relied on to support our operations.


text: The Internal Cybersecurity Team has robust processes and redundancies in place designed with the objective of deterring, detecting, mitigating, and responding to potential cybersecurity threats, which includes a vulnerability assessment, prioritization, and remediation program. The Internal Cybersecurity Team also performs regular system penetration testing to validate our security controls and assess our infrastructure and applications. All management employees take mandatory security awareness training on the Company's data security policies and procedures, which is supplemented by Company-wide testing initiatives, including periodic phishing tests.


text: Our information security program is designed to align our defenses and resources to identify, assess, and address more likely and more damaging cyber events, to provide support for our organizational mission and operational objectives, and to position us to deter, detect, mitigate, and respond to a wide variety of potential attacks in a timely fashion. Our information security program employs quantitative and qualitative approaches to evaluate the effectiveness of controls and assess the resiliency of critical computing resources. This data is combined with knowledge of common attack techniques to assess the likelihood of components being compromised and assess potential financial implications under different scenarios. The results are used to help identify potentially material risks and provide insights which are taken into account when prioritizing our security initiatives.


text: Material Cybersecurity Risks, Threats, and Incidents Due to the evolving nature of cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. While we are not aware of having experienced any material effects or reasonably likely material effects on our Company, its business strategy, results of operations, or financial condition resulting from cybersecurity threats or incidents to date, as a critical infrastructure provider, we may be a target of well-funded and sophisticated adverse actors. There can be no guarantee that we will not be the subject of future risks or incidents that have such an effect, or that we are not currently the subject of an undetected risk or incident that may have such an effect.