text: We maintain enterprise-wide information security policies, processes and standards that set the requirements around acceptable use of information systems and data, risk assessment and management, identity and access management, data security, security operations, security incident response and threat and vulnerability management. We also perform formal risk assessment activities annually, aligned to the National Institute of Standards and Technology (NIST) 800-171 and Cybersecurity Framework, as its program controls are designed to protect and maintain confidentiality, integrity, and continued availability of our data and information systems. Our team of information security professionals monitors our information systems for cybersecurity threats, breaches, intrusions and other weaknesses, responds to cybersecurity incidents, develops and implements plans to mitigate cybersecurity threats and facilitates training for our employees.


text: We also engage consultants and other third-party advisors to conduct independent assessments of our cybersecurity readiness and control effectiveness. In collaboration with external cybersecurity firms, we seek to gain insights into emerging threats and vulnerabilities, industry trends, and leading practices to inform our cybersecurity response, risk remediation and resilience capabilities, including by working with an external retained incident response team, receiving third-party threat intelligence, participating in incident tabletops, and performing assessments and controls testing on our enterprise environment.

companyName: Avantor, Inc.

ticker: AVTR

secItem: Item 1C


text: Our program includes procedures to oversee and identify cybersecurity risks and threats of our third-party service providers, which include third-party evaluations performed by our team of information security professionals, review of independent assessment documentation, and continuous monitoring of third-party independent posture scoring. We also include security and data protection provisions in our contractual arrangements with third-party service providers where applicable. Additionally, we have purchased a cybersecurity risk insurance policy that would reduce the costs associated with a covered cybersecurity incident if it occurred.


text: Although no cybersecurity incident during the year ended December 31, 2024 resulted in an interruption of our operations, known losses of critical data, or otherwise had a material impact on Avantor's strategy, financial condition or results of operations, the scope and impact of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information on how material cybersecurity attacks may impact our business.


text: Management plays a critical role in assessing and managing material risks from cybersecurity threats. Our Vice President of Information Security & Risk Management and Chief Information Security Officer (CISO), in coordination with our Chief Information Officer, leads a team of information security professionals and manages our cybersecurity risk management program and activities. This involves monitoring our information systems for cybersecurity threats, reviewing cybersecurity incidents, analyzing emerging threats, and the development and implementation of risk mitigation strategies. Our CISO has over 25 years of experience working in the information technology and services industry who is a subject matter expert in a variety of areas including information security, and IT risk.


text: Our CISO reports to our executive leadership team composed of our Chief Executive Officer, Chief Financial Officer, and Chief Information Officer on cybersecurity matters, providing the leadership team with updates on enterprise risks, cybersecurity incidents, the status of ongoing initiatives, key metrics, and additional cybersecurity topics. Our information technology leaders also meet regularly to discuss the progress of ongoing program initiatives, cybersecurity priorities, identified risks and metrics. We have also developed a cross functional disclosure working group to assess elevated cybersecurity incidents and, as appropriate, report on such events to Avantor's standing Disclosure Committee to conclude on the materiality of the incident and any need for regulatory reporting.


text: The Board of Directors exercises direct oversight of strategic risks to the Company. The Board has delegated the responsibility for cybersecurity oversight to the Audit and Finance Committee. The Audit and Finance Committee's responsibilities include reviewing and discussing with management the strategies, process and controls pertaining to the management of Avantor's information technology operations, including cybersecurity risks and information security. The CISO and Chief Information Officer report to the Audit and Finance Committee annually and more frequently, as needed, on cybersecurity matters, including the cybersecurity threat landscape, key metrics demonstrating the overall management of our cybersecurity risk and risk management program, related key initiatives, enterprise program framework alignment, annual risk mitigation strategy, and review of cybersecurity incidents. Our Board is committed to maintaining a well-informed and cybersecurity-aware posture, regularly engaging through regular and requested updates on our strategy and evolving threat landscape.


text: Our cybersecurity program incorporates a robust process for the assessment, identification, and management of material risks from cybersecurity threats. This begins with our threat intelligence program that integrates several methods to identify potential threats to the Company, including paid/unpaid threat feeds, custom threat alerts, keeping abreast of the latest threats to the technologies that exist within our information systems and daily dialogue with industry peers to the threats to the hospitality industry as a whole.

companyName: WYNDHAM HOTELS & RESORTS, INC.

ticker: WH


text: Information regarding these threats is then built into our security tools. This takes the form of hardening systems through vulnerability identification and patching, as well as enabling early detection and response capabilities across our network and endpoints. Any detected threat or potential cybersecurity incident is handled by our hybrid Security Operations Center, or "SOC" which utilizes both internal and external resources for monitoring 24/7 and is responsible for triaging and appropriately handling or escalating the potential incident.


text: Other than the incidents that occurred prior to the Spin-Off, described in more detail in "Item 1A. Risk Factors—Failure to maintain the security of personally identifiable and proprietary information, non-compliance with our contractual obligations regarding such information or a violation of our privacy and security policies or processes with respect to such information could adversely affect us" as of the date of this Annual Report, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operation, or financial condition. There is no guarantee that such risks will not evolve in the future and materially adversely affect the Company or that our processes to manage cybersecurity risks, including those described here, will operate effectively and as designed.


text: Board & Management Cybersecurity Risk Oversight We incorporate all of the Company's cybersecurity processes and assessments into our overall enterprise risk program. This allows us to develop a complete consolidated view of our risk factors across our cybersecurity, information technology, and business functions. As part of the Company's enterprise risk program, the Information Risk Committee ("IRC") is responsible for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. The IRC is chaired by the Chief Information Security Officer ("CISO") and the Senior Vice President – Legal ("SVP – Legal)" responsible for Privacy and Compliance Issues, with the Chief Financial Officer, Chief Information and Distribution Officer, and the General Counsel and Chief Compliance Officer as members. The IRC meets regularly to review operations of the Company's cybersecurity programs and processes, and to discuss emerging legal, technical, or other risks. The Audit Committee of the Board is the Board-level committee with oversight of privacy and security matters. The IRC updates the Audit Committee quarterly to provide risk updates and general education on privacy and information risk trends. The Board is made aware promptly of any cybersecurity incidents that are deemed critical or that could potentially have an impact on the business. The Board also receives periodic privacy and security awareness training from third-party subject matter experts.


text: Our CISO has been with Wyndham since 2012, and has worked in the cybersecurity industry for 19 years. Prior to his time at Wyndham, as a forensic investigator, he performed cyber investigations in both civil and criminal matters and has worked closely with various industries to educate and provide guidance on cybersecurity best practices. The SVP – Legal has been with the Company since 2010, and has served in his current role since 2019. The SVP – Legal leads the legal team responsible for, among other things, corporate secretary matters, SEC reporting, privacy, compliance and legal operations. The SVP – Legal has several years of experience managing risks related to the Company's operations, including data privacy. The IRC also includes our Chief Information and Distribution Officer, Chief Compliance Officer and Chief Financial Officer, each whom has over 15 years of business and senior leadership experience managing risks in their respective fields, collectively covering aspects of cybersecurity, technology strategy, capital allocation and compliance.


text: Cybersecurity Incident Response Plan We have established a Cybersecurity Incident Response Plan ("CIRP"), which details the steps to be followed to properly respond to, contain, and remediate a cybersecurity incident. Within this plan, there are also engagement processes for our external cybersecurity incident response firm, which also assists Wyndham's cybersecurity team by annually testing the CIRP through custom tabletop exercises. The CIRP provides a process for escalating certain cybersecurity incidents to the IRC and to other members of management to facilitate management-level consideration as to whether a cybersecurity incident may be material to the Company and whether public disclosure of the incident is required.


text: Information Security Program Access to our information systems is managed through our Identity and Access Management process, which governs the appropriate level of access for each user on an ongoing basis. Wyndham performs a certification process bi-annually to ensure the accuracy and completeness of each user's access.


text: Tracking and measuring of the above certification processes takes place within our Information Security Program. This program reports on the risks and remediation progress across our information systems, as well as measures them against our own standards and processes, which have been developed in part using the National Institute of Standards and Technology Cybersecurity Framework 2.0. The Information Security Program also measures the overall cybersecurity program against other key regulatory standards such as the Payment Card Industry standard known as PCI 4.0 and the Sarbanes-Oxley Act of 2002.


text: Third Party Risk Program The Company's third-party risk program includes a process for assessing and overseeing the risk profile of third parties we do business with at the time of contract execution and also in the event that the scope of the work done with any third party materially changes.


text: Our teams conduct vendor risk assessments of third-party suppliers that may receive access to personal data or connectivity to Wyndham's systems, for which such vendor risk assessments include information security control assessments and privacy impact assessments, regardless of the sensitivity of personal data potentially involved. The teams conduct similar internal assessments should any process potentially result in a significant change to the Company's data processing practices concerning sensitive data, or have a potentially material impact on individuals' data and respective rights.


text: The data from the threat intelligence program mentioned above also feeds into a third-party risk evaluation to ensure that any impactful event (cyber or otherwise) experienced by a third-party doing business with Wyndham is considered in the risk profile of that organization.


text: Cybersecurity Insurance To help mitigate the financial risks associated with any cyber security incidents, Wyndham Hotels also maintains cyber insurance that is renewed annually and covers both cyber events and business interruption. We closely monitor costs of breaches within the industry in an effort to ensure that our coverage is sufficient to address all reasonably foreseeable threats and levels of risk.


text: Board & Management Cybersecurity Risk Oversight We incorporate all of the Company's cybersecurity processes and assessments into our overall enterprise risk program. This allows us to develop a complete consolidated view of our risk factors across our cybersecurity, information technology, and business functions. As part of the Company's enterprise risk program, the Information Risk Committee ("IRC") is responsible for developing and coordinating the Company's cybersecurity policy and strategy, and for managing the prevention, detection, mitigation and remediation of cybersecurity incidents. The IRC is chaired by the Chief Information Security Officer ("CISO") and the Senior Vice President – Legal ("SVP – Legal)" responsible for Privacy and Compliance Issues, with the Chief Financial Officer and Head of Strategy, Chief Commercial Officer, and the General Counsel and Chief Compliance Officer as members. The IRC meets regularly to review operations of the Company's cybersecurity programs and processes, and to discuss emerging legal, technical, or other risks. The Audit Committee of the Board is the Board-level committee with oversight of privacy and security matters. The IRC updates the Audit Committee quarterly to provide risk updates and general education on privacy and information risk trends. The Board is made aware promptly of any cybersecurity incidents that are deemed critical or that could potentially have an impact on the business. The Board also receives periodic privacy and security awareness training from third-party subject matter experts.


text: Our CISO has been with Wyndham since 2012 and has worked in the cybersecurity industry for over 20 years. Prior to his time at Wyndham, as a forensic investigator, he performed cyber investigations in both civil and criminal matters and has worked closely with various industries to educate and provide guidance on cybersecurity best practices. The SVP – Legal has been with the Company since 2010 and has served in his current role since 2019. The SVP – Legal leads the legal team responsible for, among other things, corporate secretary matters, SEC reporting, privacy, compliance and legal operations. The SVP – Legal has several years of experience managing risks related to the Company's operations, including data privacy. The IRC also includes our Chief Commercial Officer, Chief Compliance Officer and Chief Financial Officer and Head of Strategy, each whom has over 15 years of business and senior leadership experience managing risks in their respective fields, collectively covering aspects of cybersecurity, technology strategy, capital allocation and compliance.


text: Our teams conduct vendor risk assessments of third-party suppliers that may receive access to personal data or connectivity to Wyndham's systems, for which such vendor risk assessments include information security control assessments and privacy impact assessments, regardless of the sensitivity of personal data potentially involved. The teams conduct similar internal assessments should any process potentially result in a significant change to the Company's data processing practices concerning sensitive data or have a potentially material impact on individuals' data and respective rights.


text: Technology is essential to operating and growing our business, serving our customers, and continuing our digital transformation. ChampionX's cybersecurity structure and strategic efforts are designed to protect our assets, information, and reputation, as well as the privacy of employee, customer, and supplier data. Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"), and ChampionX's cybersecurity policies, standards, processes and practices are fully integrated into its ERM program. Our Enterprise Risk Committee, which consists of members from executive management, corporate compliance and internal audit, oversees our ERM program. Our Enterprise Risk Committee is responsible for, among other things, aligning risk decisions with the Company's values, policies and procedures and supports integration of risk assessment and controls into day-to-day business processes, planning and decision making. Our Enterprise Risk Committee has identified cybersecurity as a key enterprise risk.

companyName: ChampionX Corp


text: Our Enterprise Risk Committee has delegated to our Senior Vice President and Chief Information Officer (CIO) primary responsibility for assessing and managing our material risks from cybersecurity threats. The CIO has served in various roles in information technology and information security for over 25 years, including serving as vice president of global infrastructure and operations, infrastructure security, access management, cloud security, disaster recovery and change management, and vice president of enterprise business applications, architecture and operations. The CIO holds a master's degree in technology policy management and a doctorate in information technology management, in addition to serving on multiple advisory boards within academia and industry. The other senior leaders who collaborate with the CIO on reviews of the Company's IT system and cybersecurity risk environment include a senior director of global IT cybersecurity and a senior director of global infrastructure, each of whom have over 20 years of experience managing risks in various roles, including risks arising from cybersecurity threats.


text: We are committed to deploying recognized cybersecurity systems, methods, and best practices. ChampionX uses the National Institute of Standards & Technology Framework (NIST Framework), a toolkit to make an internal assessment of our cybersecurity capabilities and to develop priorities. We take action to assess and manage our technology and cybersecurity environment and to identify material risks from cybersecurity threats directed at our company and those associated with our use of third-party service providers, including the following: • Enterprise cybersecurity maturity assessments performed periodically by a qualified third-party entity which we use to develop a multi-year strategy, investment, and project roadmap focused on improving and enhancing the Company's security posture; • An annual cybersecurity tabletop exercise and assessment, facilitated by an independent third party, focused on testing our incident response processes and capabilities; and • Regular cybersecurity assessments of various components of our technology environment to help ensure we continuously improve and strengthen our cybersecurity posture.


text: Our CIO and other senior leaders regularly review the results of the assessments, tabletop exercise, cybersecurity roadmap progress, and monthly operational metrics to stay informed about risks from cybersecurity threats and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. They report this information to the Audit Committee and ERM Committee as appropriate, together with measures to be implemented to further strengthen our IT environment as the Company grows and evolves. We have a response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident that is led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, our CIO and CEO may escalate notification of the incident to the Audit Committee and to the Board.


text: The Board's Audit Committee oversees our global cybersecurity risk environment, strategy, and priorities. Our CIO, together with other senior leaders, regularly reviews the Company's global information technology (IT) system with the Committee, including reports on risks from cybersecurity threats and the Company's processes to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. In 2023, this review included the CIO's assessment of our IT and cybersecurity capabilities and continuous improvement plan. Our CIO's report to the Audit Committee is provided annually or, if the circumstances warrant, more frequently. In addition, the Board receives periodic reports from the Audit Committee and our CIO relating to risks from cybersecurity threats.


text: Each employee is responsible for taking proper security precautions when using the Company's network and IT systems. ChampionX provides IT and cybersecurity training to employees at least once a year, regularly distributes cybersecurity tips, and conducts regular education campaigns to heighten employee awareness of phishing and other cybersecurity threats.


text: We have not experienced any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the Company, including its business strategy, results of operations or financial condition. However, cybersecurity attacks and other threats to the Company's and our customers', partners', vendors' and other third-parties' systems, networks, products and services could materially affect the Company in the future. See "Risk Factors—Risks Related to our Business—We are subject to information technology, cybersecurity and privacy risks." in Part I, Item 1A.


text: Our Cybersecurity Risk Management Protocols and Strategy Technology is essential to operating and growing our business, serving our customers, and continuing our digital transformation. ChampionX's cybersecurity structure and strategic efforts are designed to protect our assets, information, and reputation, as well as the privacy of employee, customer, and supplier data. Cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"), and ChampionX's cybersecurity policies, standards, processes and practices are fully integrated into its ERM program. Our Enterprise Risk Committee, which consists of members from executive management, corporate compliance and internal audit, oversees our ERM program. Our Enterprise Risk Committee is responsible for, among other things, aligning risk decisions with the Company's values, policies and procedures and supports integration of risk assessment and controls into day-to-day business processes, planning and decision making. Our Enterprise Risk Committee has identified cybersecurity as a key enterprise risk.


text: Our Cybersecurity Governance Our CIO and other senior leaders regularly review the results of the assessments, tabletop exercise, cybersecurity roadmap progress, and monthly operational metrics to stay informed about risks from cybersecurity threats and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. They report this information to the Audit Committee and ERM Committee as appropriate, together with measures to be implemented to further strengthen our IT environment as the Company grows and evolves. We have a response plan governing our assessment, response and notifications internally and externally upon the occurrence of a cybersecurity incident that is led by our CIO, in coordination with other senior leaders. Depending on the nature and severity of an incident, our CIO and CEO may escalate notification of the incident to the Audit Committee and to the Board.


text: The Board 's Audit Committee oversees our global cybersecurity risk environment, strategy, and priorities. Our CIO, together with other senior leaders, regularly reviews the Company's global information technology (IT) system with the Committee, including reports on risks from cybersecurity threats and the Company's processes to monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. In 2024, this review included the CIO's assessment of our IT and cybersecurity capabilities and continuous improvement plan. Our CIO's report to the Audit Committee is provided annually or, if the circumstances warrant, more frequently. In addition, the Board receives periodic reports from the Audit Committee and our CIO relating to risks from cybersecurity threats.


text: Risk Management & Strategy Our cybersecurity program includes policies and procedures designed to protect our systems and operations as well as sensitive information and data from anticipated cybersecurity threats. This program is a key component of our approach to enterprise risk management.

companyName: Amneal Pharmaceuticals, Inc.

ticker: AMRX


text: Our cybersecurity defenses include multiple layers of processes and technologies that can help prevent, detect and respond to cybersecurity threats. We administer multiple cybersecurity-related training and awareness events annually. These include baseline cybersecurity training for all new employees and an annual, mandatory, interactive cybersecurity training for all who are assigned our user accounts, and frequent cybersecurity topic awareness broadcast emails and targeted training to specific user groups. Additionally, we use a variety of detective and preventive technologies, including: • email threat detection; • endpoint detection and response; • a 24 hours a day, 7 days a week security operations center that monitors system log telemetry and threat intelligence via a security incident and event management platform; • vulnerability scanning on both internal and externally-facing infrastructure; • next-generation firewalls with geographic access restriction for sensitive externally-facing systems; • multi factor authentication for remote access and certain internal systems; • domain name service threat detection; and, • internal incident response procedures based on NIST Special Publication 800-61.


text: We also conduct periodic phishing attack simulations to evaluate users' vulnerability to emerging email threats. We conduct remediation training where failures occur. On a quarterly basis, our cybersecurity team also conducts scenario-based tabletop exercises with critical business teams to simulate disasters and cyberattacks. The tabletop exercises test and fine-tune our business continuity plans and incident response procedures.


text: Program Assessments Our cybersecurity processes are evaluated as part of an ongoing assessment of our internal control environment, which are informed by the five pillars of the NIST Cybersecurity Framework ("NIST CSF"). We employ a third-party service provider to conduct periodic penetration tests and scan different parts of our IT environment for potential vulnerabilities. We prioritize critical or high vulnerabilities for swift remediation. Additionally, we employ a third-party service provider for continuous cybersecurity risk and vulnerability monitoring. We make continuous adjustments to system and network configurations to mitigate or remediate identified vulnerabilities.


text: Incident Response Cybersecurity incident response procedures are informed by NIST Special Publication 800-61, and continuously improved following quarterly exercises and live incidents. Incident response emphasizes rapid containment following detection of a range of threats including: • repeated login failures; • suspicious network traffic; • malware detection; and, • other threats as prioritized through a combination of industry threat intelligence via the Healthcare Information Sharing and Analysis Center and the Company's security operation center.


text: Third-party Risk Management We focus on further building cybersecurity resiliency throughout our value chain. We perform risk management via an industry third-party risk management service provider for all critical vendors, partners, and systems (including third-party hosted information systems) meeting our risk management policy criteria, to minimize the likelihood and impact of malicious cybersecurity incidents. During the onboarding phase, our cybersecurity team under the direction of the Sr. Director Information Security, Compliance, and Privacy, performs a technological risk assessment on, and utilizes certain tools to detect external risk posed by, the vendor, partner and/or system. Vendors identified as posing elevated risk are escalated to senior management for informed risk tolerance determination. Following the onboarding phase, the cybersecurity team continuously monitors risks related to the vendor, partner and/or system. All third-party cybersecurity incidents are tracked though the third-party service provider and are communicated to our cybersecurity team upon discovery. We prioritize our mitigation of cybersecurity risks based on relative severity (e.g., critical risk, high risk, low risk) and document a mitigation plan that details a resolution timeline.


text: Identified cybersecurity risks, including third-party risks and internal risks, are documented and managed in a risk register, which is reviewed monthly with leaders of our internal audit, compliance, and IT departments to ensure visibility and consensus in a separation-of-duties structure. Risks are stratified according to a standard calculus of probability, severity and materiality.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. However, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition. Such significant cybersecurity incidents include, but are not limited to: • ransomware infiltrating our critical systems resulting in production delays and/or loss of critical information; • cyber theft of our IP; • cyber theft of customer and/or patient information; • cyberattack on a critical partner that disrupts our supply chain and/or services; and, • cyberattacks that significantly impact our brand perception.


text: As discussed more fully under Part 1, Item 1A, Risk Factors, "We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner Board Oversight and Management's Responsibilities Board Oversight


text: While our Board of Directors is ultimately responsible for risk oversight, committees of the Board of Directors assist in fulfilling oversight responsibilities in certain areas of risk. The Audit Committee of the Board of Directors (the "Audit Committee") is responsible for overseeing risks from cybersecurity threats. The Audit Committee receives cybersecurity updates from IT leadership at least twice a year. When meeting with the Audit Committee, the IT leadership team highlights significant accomplishments and issues related to our IT infrastructure, including cybersecurity incidents, risks, industry trends, notable incidents facing other companies, incident preparedness and other developments. The Audit Committee also receives updates regarding progress on initiatives to further align with the five pillars of the NIST CSF. These briefings are designed to provide visibility to the Audit Committee about the identification, assessment, and management of critical risks, audit findings, and management's risk mitigation strategies.


text: Management Oversight Our IT department, in conjunction with the compliance department, assess and manage risks related to cybersecurity. The Sr. Director of Global Information Security, Compliance, Privacy, is the primary management personnel responsible for our cybersecurity program. He has more than twenty years of experience as an information security specialist and holds various cybersecurity professional certifications, including as a Certified Information Security Manager by the Information Systems Audit and Control Association and a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. In addition, the department heads for IT and internal audit have industry recognized credentials and extensive experience in the area of cybersecurity. Specific cybersecurity incidents are tracked by a third-party service provider through a ticketing system.


text: Should cybersecurity issues arise throughout the quarter, management would determine whether a cybersecurity incident was material and decide on appropriate reporting and mitigation measures. Following this determination, management would promptly schedule a meeting with the Audit Committee.


text: Our cybersecurity defenses include multiple layers of processes and technologies that can help prevent, detect and respond to cybersecurity threats. We administer multiple cybersecurity-related training and awareness events annually. These include baseline cybersecurity training for all new employees and an annual, mandatory, interactive cybersecurity training for all who are assigned our user accounts, and frequent cybersecurity topic awareness broadcast emails and targeted training to specific user groups. Additionally, we use a variety of detective and preventive technologies, including: • email threat detection; • endpoint detection and response; • a 24 hours a day, 7 days a week security operations center that monitors system log telemetry and threat intelligence via a security incident and event management platform; • vulnerability scanning on both internal and externally-facing infrastructure; • next-generation firewalls with geographic access restriction for sensitive externally-facing systems; • multi-factor authentication for remote access and certain internal systems; • data loss prevention for email traffic containing sensitive information; • domain name service threat detection; and • internal incident response procedures based on NIST Special Publication 800-61.


text: Incident Response Cybersecurity incident response procedures are informed by NIST Special Publication 800-61, and continuously improved following periodic exercises and live incidents. Incident response emphasizes rapid containment following detection of a range of threats including: • suspicious repeated login failures; • suspicious network traffic; • malware detection; and • other threats as prioritized through a combination of industry threat intelligence via the Healthcare Information Sharing and Analysis Center and the Company's security operation center.


text: Third-party Risk Management We focus on further building cybersecurity resiliency throughout our value chain. We perform risk management via an industry third-party risk management service provider for all critical vendors, partners, and systems (including third-party hosted information systems) meeting our risk management policy criteria, to minimize the likelihood and impact of malicious cybersecurity incidents. During the onboarding phase, our cybersecurity team under the direction of the Sr. Director Information Security, Compliance, and Privacy, performs a technological risk assessment on, and utilizes certain tools to detect external risk posed by, the vendor, partner and/or system. Vendors identified as posing elevated risk are escalated to senior management for informed risk tolerance determination. Following the onboarding phase, the cybersecurity team continuously monitors risks related to the vendor, partner and/or system. All third-party cybersecurity incidents are tracked though the third-party service provider and are communicated to our cybersecurity team upon discovery. We prioritize our mitigation of cybersecurity risks based on relative likelihood and severity (e.g., critical risk, high risk, low risk) and document a mitigation plan that details a resolution timeline.


text: Identified cybersecurity risks, including third-party risks and internal risks, are documented and managed in a risk register, which is reviewed regularly with leaders of our internal audit, compliance, and IT departments to ensure visibility and consensus in a separation-of-duties structure. Risks are stratified according to a standard calculus of probability, severity and materiality.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, a significant cybersecurity incident may materially impact our business strategy, results of operations and financial condition. Such significant cybersecurity incidents include, but are not limited to: • ransomware infiltrating our critical systems resulting in production delays and/or loss of critical information; • cyber theft of our IP; • cyber theft of employee and family member, customer and/or patient information; • cyberattack on a critical partner that disrupts our supply chain and/or services; and, • cyberattacks that significantly impact our brand perception.


text: As discussed more fully under Part 1, Item 1A, Risk Factors, "We are increasingly dependent on information technology, and our systems and infrastructure face certain risks, including cybersecurity and data leakage risks," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Management Oversight Our IT department, in conjunction with the compliance department, assess and manage risks related to cybersecurity. The Senior Director of Global Information Security, Compliance and Privacy, is the primary management personnel responsible for our cybersecurity program. He has more than twenty years of experience as an information security specialist and holds various cybersecurity professional certifications, including as a Certified Information Security Manager by the Information Systems Audit and Control Association and a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. In addition, the department heads for IT and internal audit have industry recognized credentials and extensive experience in the area of cybersecurity. Specific cybersecurity incidents are tracked by a third-party service provider through a ticketing system.


text: Our operations utilize multiple information systems, including accounting software, human resources management software, back of house systems, supply chain software, our brands' mobile apps, online ordering platforms, in-restaurant kiosks, point-of-sale software, and back-of-house software. In the ordinary course of our business, we collect, process, transmit, disclose, and retain personal information regarding our employees, our franchisees, vendors, contractors, and guests (which can include social security numbers, social insurance numbers, banking and tax identification information, health care information for employees, and credit card information) and our franchisees collect similar information.

companyName: BurgerFi International, Inc.


text: To protect the information that we gather and the availability of our information systems from cybersecurity threats, we have an ongoing cybersecurity risk mitigation program, which includes maintaining up-to-date detection, prevention and monitoring systems and contracting with outside cybersecurity firms to provide continuous monitoring of our systems as well as threat-detection services. We define a cybersecurity threat as any potential unauthorized occurrence on or conducted through our information systems or information systems of a third party that we utilize in our business that may result in adverse effects on the confidentiality, integrity or availability of our information systems or any information residing therein.


text: Risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: A security team led by a Chief Technology Officer ("CTO") principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;


text: The use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; Cybersecurity awareness training of our employees, incident response personnel, and senior management; A cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents;


text: Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding cybersecurity incidents, that we experience. The Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: Our management team, including historically our CTO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises our retained external cybersecurity consultants. Our former CTO who recently left the company had significant experience across digital innovation and technology-enabled growth, information security, infrastructure, operations and compliance, including over 10 years of experience managing enterprise level programs over IT. The Company has identified a candidate that it desires to fill the role.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: We have not encountered any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to affect us, including our business strategy, results of operations or financial condition. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. Risk Factors for potential risks related to our information technology systems that we are subject to and that may materially adversely affect our business ("Security breaches of either confidential guest information in connection with, among other things, our electronic processing of credit and debit card transactions or mobile ordering app, or confidential employee information may adversely affect our business" and "Failure to comply with privacy and cybersecurity laws and regulations could cause us to face litigation and penalties that could adversely affect our business, financial conditions, and results of operations.").


text: The Company's information security program is managed through an effective enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes. The Company is committed to compliance with the International Organization for Standardization's recognized cyber incident and cyber risk management frameworks. We are dedicated to cybersecurity and maintaining the trust and confidence of our customers and stockholders.

companyName: Columbia Financial, Inc.

ticker: CLBK


text: The Company recognizes the increasing threats posed by cyber incidents and is dedicated to implementing robust cybersecurity practices. We have a comprehensive cybersecurity program designed to protect sensitive information, ensure the integrity of financial transactions, and maintain the confidentiality of our customers' data.


text: We have established procedures for timely reporting of significant cybersecurity incidents; our commitment involves promptly notifying regulatory authorities, customers, and other stakeholders in the event of any material cyber incidents that may impact our operations or the security of sensitive information. In particular, we have enhanced disclosure controls and procedures to meet the requirement to report material cybersecurity incidents on Form 8-K within four business days after we determine that an incident is material.


text: Additionally, we maintain a proactive cyber risk management framework to identify, assess, and mitigate potential risks. Our cybersecurity policies and practices are regularly reviewed and updated to address emerging threats. We work closely with industry experts and third-party vendors and leverage advanced technologies to enhance our effort to continually provide adequate cyber defenses.


text: The Company uses a multiple lines of defense management approach to managing cybersecurity. The Company's cybersecurity operations function is headed by the Vice President Information Security Officer ("ISO") who is responsible for managing information security risks by developing and implementing information security strategies, architecture, and procedures and acts as the first line of defense. The ISO leads a team of security professionals in safeguarding the Company's critical data, systems, and assets against threats, breaches, and attacks. The ISO is responsible for ensuring the confidentiality, integrity, and availability of information assets.


text: The information security program, policies, and standards are managed by the Vice President of Enterprise Technology Risk Management ("ETRM"), who leads the Company's enterprise-wide technology risk management function. The ETRM function acts as the second line of defense and provides independent risk oversight for the Company's technology operating infrastructure and Operations. The ETRM function manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Company's internal audit department acts as the third line of defense, providing the independent assurance function.


text: Concerning governance, oversight, and compliance, the Board of Directors plays an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. The Bank provides periodic reports to our Technology Committee and our Board of Directors, as well as to our senior management team as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: We are firm in our commitment to collaborate with regulatory authorities to enhance industry-wide cybersecurity standards. Given the continuously evolving cyber threat landscape, we are committed to continuous improvement in our cybersecurity practices. Regular assessments, testing, audits, and training are conducted to adapt to emerging threats and enhance our ability to safeguard the interests of our customers.


text: The Company remains dedicated in its commitment to cybersecurity and compliance cyber risk management and will continue to invest in and prioritize cybersecurity to protect all critical information.


text: The Company recognizes the increasing threats posed by cyber incidents and is dedicated to implementing robust cybersecurity practices. We have a comprehensive cybersecurity program designed to protect sensitive information, ensure the integrity of financial records and transactions, and maintain the confidentiality of our customers' data.


text: The Company uses a multiple lines of defense management approach to managing cybersecurity. The Company's cybersecurity function is headed by the Senior Vice President Chief Information Security Officer ("CISO") who is responsible for managing information security risks by developing and implementing information security programs, policies, strategies, architecture, standards, and procedures and acts as the first line of defense. The CISO leads a team of security professionals in safeguarding the Company's critical data, systems, and assets against threats, breaches, and attacks. The CISO is responsible for ensuring the confidentiality, integrity, and availability of information assets.


text: The Company's enterprise-wide technology risk management (ETRM) function acts as the second line of defense and provides independent risk oversight for the Company's technology operating infrastructure and operations. The ETRM function manages testing of technology controls, technology risk assessments, risk reporting, information security third-party due diligence, monitoring the implementation of risk mitigation actions, and tracking their effectiveness over time. The Company's internal audit department acts as the third line of defense, providing the independent assurance function.


text: Concerning governance, oversight, and compliance, the Board of Directors plays an active role in overseeing our cybersecurity program. Regular briefings on cyber risk management and incident response activities are conducted, ensuring a high level of governance and accountability in addressing cybersecurity concerns. Management provides periodic reports to our Technology Committee and our Board of Directors, as well as to our senior management team as appropriate. These reports include updates on the Company's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape.


text: We are firm in our commitment to collaborate with regulatory authorities to enhance industry-wide cybersecurity standards. Given the continuously evolving cyber threat landscape, we are committed to continuous improvement in our cybersecurity practices. Regular assessments, testing, audits, and training are conducted to adapt to emerging threats and enhance our ability to safeguard the interests of our customers and stakeholders.


text: Risk management and strategy We have implemented and maintain a cybersecurity program that includes various processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including clinical trial and candidate data, intellectual property, and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Arcus Biosciences, Inc.

ticker: RCUS


text: Our information security function, led by our Vice President of Information Technology ("VP of IT"), helps to identify, assess and manage the Company's cybersecurity threats and risks. This function helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example deploying automated tools in certain environments, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain aspects of the Company's threat environment, evaluating certain threats that are reported to us, conducting internal and external audits and internal threat assessment of certain environments, engaging third parties to conduct threat assessments, and conducting vulnerability assessments.


text: We have engaged third-party providers to periodically assess certain of our internal controls and procedures for information security. We have also taken certain measures to mitigate cybersecurity risks, including, for example, cybersecurity awareness training for employees and management, periodic testing through simulated "phishing" campaigns (and require remedial training based on results) and the adoption of an incident response plan, vulnerability management policy and business recovery plan.


text: Furthermore, our information security function works with a security committee (the "Security Committee") to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business and evaluate material risks from cybersecurity threats against our overall business objectives. We use third-party service providers to perform a variety of functions throughout our business, such as CROs and contract manufacturing organizations (CMOs). Under our information security function, we perform risk and security assessments for certain of our vendors that involves a review of the vendor's written security program. Depending on the nature of the services provided, and the sensitivity of the Information Systems and Data at issue, and the identity or experience of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the vendor.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors" in Part I, Item 1A herein.


text: Our board of directors considers cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our Security Committee is comprised of key management stakeholders and experts, including our General Counsel, Chief Accounting Officer and Vice President of Ethics and Compliance and is chaired by our VP of IT, who has over 20 years of experience in strategic and operational IT/cybersecurity leadership and has received multiple cybersecurity certificates including (ISC)2, Cloud Security Alliance, Cisco Security and Microsoft Security Professional. The Security Committee is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The audit committee receives periodic reports from our VP of IT concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. Under our incident response plan, certain incidents would also be reported to the board.


text: Risk management and strategy We have implemented and maintain a cybersecurity program that includes various processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software (collectively, "Information Systems"), and our critical data, including clinical trial and candidate data, intellectual property, and confidential information that is proprietary, strategic or competitive in nature (collectively with Information Systems, "Information Systems and Data").


text: Our program is designed and assessed using the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which guides our approach to identifying, assessing, and managing material cybersecurity risks relevant to our business. While we use this framework to inform our cybersecurity practices, this does not imply compliance with any particular technical standards, specifications, or requirements.


text: Under this framework, our information security function, led by our Chief Information Officer, helps to identify, assess and manage the Company's cybersecurity threats and risks. This function helps to identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example deploying automated tools in certain environments, subscribing to and analyzing reports and services that identify certain cybersecurity threats, conducting scans of certain aspects of the Company's threat environment, evaluating certain threats that are reported to us, conducting internal and external audits and internal threat assessment of certain environments, engaging third parties to conduct threat assessments, and conducting vulnerability assessments.


text: Furthermore, our information security function works with a security committee (the "Security Committee") to prioritize our risk management processes, mitigate cybersecurity threats that are more likely to lead to a material impact to our business and evaluate material risks from cybersecurity threats against our overall business objectives. We use third-party service providers to perform a variety of functions throughout our business, such as CROs and contract manufacturing organizations ("CMOs"). Under our information security function, we perform risk and security assessments for certain of our vendors that involves a review of the vendor's written security program. Depending on the nature of the services provided, and the sensitivity of the Information Systems and Data at issue, and the identity or experience of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and we may impose contractual obligations related to cybersecurity on the vendor.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, please see "Risk Factors - Our internal information technology systems, and those of our third-party CROs and other third parties upon which we rely, are subject to failure, security breaches and other disruptions, which could result in a material disruption of our investigational products' development programs, jeopardize sensitive information, prevent us from accessing critical information or result in a loss of our assets, and potentially expose us to notification obligations, loss, liability or reputational damage and otherwise adversely affect our business." in Part I, Item 1A herein.


text: Our Security Committee is comprised of key management stakeholders and experts and is chaired by our Chief Information Officer, who has over 20 years of strategic and operational IT/cybersecurity leadership experience and multiple cybersecurity certifications, from leading security organizations such as (ISC)2, Cloud Security Alliance, Cisco Security, Microsoft Security. The Security Committee is responsible for helping to integrate cybersecurity risk considerations into our overall risk management strategy and communicating key priorities to relevant personnel, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: The audit committee receives periodic reports from our Chief Information Officer concerning significant cybersecurity threats and risk and the processes we have implemented to address them. Under our incident response plan, certain incidents would also be reported to the board.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include: briefings from internal personnel; threat intelligence and other information obtained from public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Our cybersecurity program is managed by our Senior Vice President, Digital and Information Technology, or SVP of Digital and IT, whose team is responsible for leading our enterprise-wide cybersecurity policy, strategy, standards, and architecture.

companyName: Zentalis Pharmaceuticals, Inc.

ticker: ZNTL


text: Our cybersecurity program is aligned with industry standards and reasonable security safeguards for comparable companies in our industry. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We may engage consultants from time to time to assist us with assessing and improving our cybersecurity program.


text: The Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity program and receives periodic reports regarding the program. These reports include updates on our information security program and the status of projects to strengthen our information security systems. The Board also receives reports regarding cybersecurity risks.


text: Our management team, including our SVP of Digital and IT and our Chief Legal Officer, is responsible for assessing and managing our risks from cybersecurity threats. Certain members of our management team, including our SVP of Digital and IT and our Chief Legal Officer, are part of our Cyber Incident Response Team and are responsible for executing the processes set forth therein, including with respect to our third party service providers. Cybersecurity events are escalated to our Board as appropriate. Our management team's experience includes developing and overseeing the information technology security program as head of the information technology department and certification from the National Association of Corporate Directors for the Cyber-Risk Oversight Program.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our cybersecurity program is aligned with industry standards and reasonable security safeguards for comparable companies in our industry. We reference various security industry frameworks and other guidance to help us assess, identify and manage cybersecurity risks. We also actively engage with industry participants as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We may engage consultants or other third parties from time to time to assist us with assessing and improving our cybersecurity program.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information. See "Risk Factors—Risks Related to Employee Matters, Managing Our Growth and Other Risks Related to Our Business—Our business and operations may suffer in the event of information technology system failures, cyberattacks or deficiencies in our cybersecurity."


text: The Board considers cybersecurity risk as part of its overall risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and information security risks, including oversight of management's implementation of our cybersecurity risk management program. The Audit Committee receives periodic reports from management regarding our cybersecurity program. These reports include updates on our cybersecurity program and the status of projects to strengthen our information security systems. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team, including our Chief Executive Officer, our Chief Legal Officer and our Executive Director, IT Infrastructure & Information Security, is responsible for assessing and managing our risks from cybersecurity threats. Certain members of our management team are part of our Cyber Incident Response Team and are responsible for executing the processes set forth therein, including with respect to our key third party service providers. Cybersecurity events are escalated to the Audit Committee or to our Board as appropriate. Our Executive Director, IT Infrastructure & Information Security, has close to thirty years of experience in information security, including twenty years of experience building and leading information security teams, and has held Certified Information Systems Security Professional certification from the International Information System Security Certification Consortium since 2002, as well as Qualified Technical Expert certification from the Digital Directors Network. Our Chief Executive Officer has thirty years of experience overseeing information technology, or IT, functions and has eight years of experience serving on the audit committees of companies that had oversight responsibility of the company's cybersecurity risk management program. Our Chief Legal Officer has overseen our IT team since 2023. Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our internal and customer facing information technology systems and confidential information. As part of this program, we prioritize maintaining the highest cybersecurity standards to safeguard information stored within our information technology systems. Our cybersecurity framework and controls are designed to align with key aspects of recognized best practices and standards for cybersecurity and information technology including industry standards based upon guidelines from the Center for Information Security ("CIS") and the National Institute of Standards and Technology Cyber Security Framework ("NIST CSF"). Additionally, we incorporate guidance from the Federal Financial Institutions Examination Council ("FFIEC") to ensure we meet the expectations of our partners and any applicable regulatory requirements.

companyName: BM Technologies, Inc.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas. As part of our enterprise risk assessment function, we have implemented processes to assess, identify, and manage the material risks facing the Company, including from cyber threats. Key elements of our cybersecurity risk management program include, but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our information technology systems and confidential information; • products and services built with security tools; • cybersecurity awareness training, including internal phishing tests of our employees, contractors, consultants, or any third-parties who will have access to our information technology systems and environment; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for key service providers, suppliers, and vendors based on their criticality and risk profile; and • a level of cybersecurity insurance that we believe is appropriate, taking into consideration the material risks from cybersecurity threats.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us. For more information on our cybersecurity-related risks, see Item 1A - "Risk Factors."


text: Cybersecurity Governance The Company's information technology team is responsible for assessing and managing cybersecurity risks and has a depth of experience focused on increasing the Company's resilience to security threats and stays current on new developments through monitoring of the cybersecurity landscape. The Company's information technology environment is actively monitored for potential security threats, and security events are investigated and acted on to minimize potential risk to the environment.


text: Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. The Board of Directors receives periodic reports from management on our cybersecurity risks and program. In addition, management updates the Board of Directors, as necessary, regarding any significant cybersecurity incidents.


text: Our enterprise (the holding company and its operating subsidiaries) is using technology in virtually all aspects of the business. Much like many other businesses, certain of our subsidiaries' information systems have been subject to computer viruses, malicious codes, unauthorized access, and other cyberattacks. We expect to be subject to similar attacks in the future as such attacks become more sophisticated. A significant disruption or failure of our technology systems could result in service interruptions, safety failures, security events, regulatory compliance failures, an inability to protect information and assets against unauthorized users, and other operational difficulties. Attacks perpetrated against our systems could result in loss of assets and critical information and expose us to remediation costs and reputational damage.

companyName: Biglari Holdings Inc.

ticker: BH-A


text: Cyberattacks could compromise confidential customer and employee information. Cyberattacks may result in business interruptions, lost revenues, higher commodity prices, disruption in fuel supplies, lower energy consumption, unstable markets, increased security, repair or other costs, or may materially adversely affect us in ways that cannot be predicted at this time.


text: Our operating businesses are managed on an unusually decentralized basis. There are few centralized or integrated business functions. Consistent with our decentralized management philosophy, our operating businesses individually establish specific practices concerning cybersecurity risks. Although our subsidiaries have taken steps intended to mitigate these risks, including business continuity planning, disaster recovery planning, and business impact analysis, a significant disruption or cyber intrusion at one or more of our significant operations could adversely affect our results of operations, financial condition, and liquidity. Additionally, if we are unable to acquire, develop, implement, adopt, or protect rights around new technology, we may suffer a competitive disadvantage, which could also have an adverse effect on our results of operations and financial condition. Given the wide variations in the nature and size of business activities, specific practices may vary widely among our operating subsidiaries.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity program includes a cybersecurity incident response plan.

companyName: Gossamer Bio, Inc.

ticker: GOSS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity program is integrated into our overall risk management program and includes reporting channels to the executive management team and an internal Cybersecurity Oversight Committee, as well as governance processes which communicate cybersecurity risks to departments across the organization, including legal, strategic, operational, and financial areas. This encourages consideration of cybersecurity oversight, accountability and diligence across the organization.


text: Our cybersecurity program includes: • Processes to assess cybersecurity risk, designed to help identify material cybersecurity risks to critical systems, information, products, services, and the broader enterprise information technology environment; • a security team principally responsible for coordinating and managing (1) cybersecurity risk evaluation processes, (2) implementation of cybersecurity controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the organization's cybersecurity controls; • cybersecurity awareness training of employees, incident response personnel, including third party providers, and senior management; • a cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors that have access to sensitive data or information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected or are reasonably likely to materially affect the organization, including operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factors— Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or potential future collaborators, may fail or suffer security breaches, which could result in a material disruption of our seralutinib development program, which could materially affect our results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee. The Audit Committee oversees management's implementation of the cybersecurity program.


text: The Audit Committee receives formal annual reports from management regarding cybersecurity risks. In addition, management updates the Board and Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team including the Executive Vice President, Technical Operations and Administration is responsible for assessing and managing material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes collective decades of experience working in and overseeing information technology and cybersecurity functions, technical cybersecurity certifications, and active membership in cybersecurity professional organizations, as well as local groups, to support knowledge sharing and ongoing education.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity governance program intended to protect the confidentiality, integrity, and availability of our critical systems and information.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity governance program includes reporting channels to the executive management team and an internal Cybersecurity Oversight Committee, as well as governance processes which communicate cybersecurity risks to departments across the organization, including legal, strategic, operational, and financial areas. This encourages consideration of cybersecurity oversight, accountability and diligence across the organization.


text: Key elements of our cybersecurity governance program includes but are not limited to the following: • Processes to assess cybersecurity risk, designed to help identify material risks from cybersecurity threats to critical systems and information; • a security team principally responsible for coordinating and managing (1) cybersecurity risk evaluation processes, (2) implementation of cybersecurity controls, and (3) response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the organization's cybersecurity processes; • cybersecurity awareness training of employees, including incident response personnel including third party providers, and senior management; • a cybersecurity incident response plan which includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, which have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the organization, including operations, business strategy, results of operations, or financial condition. See "Risk Factors - Our information technology systems, or those of any of our CROs, manufacturers, other contractors or consultants or Chiesi or potential future collaborators, may fail or suffer security breaches, which could result in a material disruption of our seralutinib development program, which could materially affect our results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risks, including oversight of management's implementation of the cybersecurity governance program.


text: The Audit Committee receives formal annual reports from IT management regarding cybersecurity risks. In addition, management would update the Audit Committee and Board, where it deems appropriate, regarding cybersecurity incidents it considers to be significant or potentially significant. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Assessment and management of material risks from cybersecurity threats are performed by the Executive Director, Information Security, Risk & Compliance and the Vice President, IT and Facilities, reporting to the Executive Vice President, Technical Operations and Administration. Our Executive Vice President, Technical Operations and Administration reports to the President and Chief Executive Officer. This group holds primary responsibility for our overall cybersecurity governance program, along with our internal Cybersecurity Oversight Committee, which includes senior personnel from key departments in the organization. The collective experience of the individuals listed above, along with the Cybersecurity Oversight Committee, includes decades of experience working in and overseeing IT and cybersecurity functions and enterprise, IT and cybersecurity risk management functions, in addition to holding active technical cybersecurity certifications and maintaining active membership in cybersecurity professional organizations, as well as local groups, to support knowledge share and ongoing cybersecurity professional development.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in our IT environment.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. As a result, we have integrated cybersecurity risk management into our broader risk management framework to promote a holistic approach toward assessing, identifying, and managing material risks associated with cybersecurity threats. This integration ensures that cybersecurity considerations are an integral part of the decision-making processes at every level of our organization.

companyName: Piedmont Lithium Inc.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we have partnered with third-party cybersecurity agencies to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our cybersecurity partners work to continuously scan and monitor our networks for threats and vulnerabilities and provide access to a 24/7 incident response team. Further, through our partnerships, we conduct annual security risk assessments, which are designed in alignment with the National Institute of Standards and Technology Cybersecurity Framework and perform annual penetration tests and breach and attack simulations to validate security controls. These partnerships are actively managed by members of our management team, together with our information technology department, to ensure effective implementation.


text: Additionally, to best position Piedmont Lithium to avoid cybersecurity incidents, we, among other things, conduct employee trainings and, where appropriate, utilize a coordinated procurement process to bring consistency, compliance, and interoperability to the hardware, software, and services we obtain from vendors and other business partners. This coordinated procurement process includes, in addition to other safeguards, review by our information technology and legal departments to address any security concerns before any vendor or business partner is granted access to our information systems.


text: As of the date of this Annual Report, we have not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. For additional information, refer to Part I, Item 1A, "Risk Factors—Our business is subject to cybersecurity risks."


text: Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management team. Our Audit Committee is responsible for the Board-level oversight of risks from cybersecurity threats. Members of our Audit Committee receive updates from our management team regarding Company practices, programs, and other developments related to cybersecurity throughout the year, including quarterly updates from our Chief Legal Officer on cyber threats and our cybersecurity risk management and strategy program. Our Audit Committee is comprised of Board members with diverse expertise, including risk management and strategy, equipping each member to oversee cybersecurity risks effectively.


text: We maintain a Cybersecurity Incident Response Team composed of professionals across various functions, including information technology, legal, finance, accounting, and risk. This team is trained in managing cybersecurity incidents and is comprised of individuals with experience in various roles involving information technology, including, security, auditing, compliance, systems, and programming.


text: Cyber criminals are becoming more sophisticated and effective every day, and all companies utilizing technology are subject to threats of breaches of their cybersecurity programs. To mitigate the threat to our business, we take a comprehensive approach to cybersecurity risk management and make securing our systems and data a top priority. Our Board and our management are actively involved in our overall enterprise risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, procedures and processes for assessing, identifying, and managing material risks from cybersecurity threats. There can be no guarantee that our policies, procedures and processes will be properly followed in every instance or that those policies, procedures and processes will be effective. We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we can provide no assurance that there will not be incidents in the future or that they will not materially affect us. For more information about risks relating to cybersecurity matters see "Item 1A. Risk-Factors—General Risk Factors—We may be vulnerable to security breaches or cyber attacks which could disrupt our operations and have a material adverse effect on our financial condition and operating results."

companyName: ESSENTIAL PROPERTIES REALTY TRUST, INC.

ticker: EPRT


text: Risk Management and Strategy Our policies, procedures and processes for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall enterprise risk management program. Our cybersecurity program in particular focuses on the following key areas: Collaboration


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Personnel primarily responsible for security, risk and compliance matters meet periodically to develop strategies for preserving the confidentiality, integrity and availability of Company and tenant information, identifying, preventing and mitigating cybersecurity threats, and responding to any cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of material cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Board in a timely manner.


text: At least annually, we, with the assistance of an external cybersecurity consultant, conduct a cybersecurity risk assessment that takes into account information from internal personnel, known potential information security vulnerabilities and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to our Board, its Nominating and Corporate Governance Committee, and members of management.


text: Technical Safeguards We periodically assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are periodically evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Incident Response and Recovery Planning We have established comprehensive incident response and recovery plans and continue to periodically test and evaluate the effectiveness of those plans. Our incident response and recovery plans address—and guide our employees, management and the Board on—our response to a cybersecurity incident.


text: Third-Party Risk Management We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers. Such providers are subject to security risk assessments at the time of engagement, contract renewal and upon detection of an increase in risk profile. We use a variety of inputs in such risk assessments, including information supplied by providers and third parties, and investigate security incidents that have impacted our third-party providers, as appropriate.


text: Education and Awareness Each of our employees is required to comply with our cybersecurity policies. We regularly remind employees of the importance of handling and protecting our data, including through annual privacy and security training to enhance employee awareness of how to detect and respond to cybersecurity threats.


text: External Assessments Our cybersecurity policies and procedures are periodically assessed by our external cybersecurity consultant. These assessments include a variety of activities including information security maturity assessments, penetration tests, and independent reviews of our information security control environment and operating effectiveness. The results of significant assessments are reported to management, the Board and its Nominating and Corporate Governance Committee. Cybersecurity processes are adjusted based on the information provided from these assessments.


text: Our Board, in coordination with its Nominating and Corporate Governance Committee, oversees our management of cybersecurity risk. They receive periodic reports from management and our external cybersecurity consultant about the identification, prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Nominating and Corporate Governance Committee directly oversees our cybersecurity program. The Nominating and Corporate Governance Committee receives periodic updates from management and our external cybersecurity consultant on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Management's Role Our chief financial officer ("CFO") has primary responsibility for assessing and managing material risks from cybersecurity threats. The CFO meets periodically with our external cybersecurity consultant to review security performance metrics and identify security risks. The CFO and our external cybersecurity consultant also consider and make recommendations on security policies and procedures, security service requirements and risk mitigation strategies to the Nominating and Corporate Governance Committee.


text: Our Board, in coordination with its Nominating and Corporate Governance Committee, oversees our management of cybersecurity risk. They receive periodic reports from management and our external cybersecurity consultant about the identification, prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Our Nominating and Corporate Governance Committee oversees risks arising from our cybersecurity program. The Nominating and Corporate Governance Committee receives periodic updates from management and our external cybersecurity consultant on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, external auditor feedback, control maturity assessments, and relevant internal and industry cybersecurity incidents.


text: Management's Role Our Chief Financial Officer has primary responsibility for assessing and managing material risks from cybersecurity threats. The Chief Financial Officer meets periodically with our external cybersecurity consultant to review security performance metrics and identify security risks. The Chief Financial Officer and our external cybersecurity consultant also consider and make recommendations on security policies and procedures, security service requirements and risk mitigation strategies to the Nominating and Corporate Governance Committee.


text: To prevent, detect and respond to information security threats, the Manager maintains a cyber risk management program. The program is supervised by an in-house dedicated Chief Information Security Officer ("CISO") with over 15 years of experience in financial services risk management, whose team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. The Enterprise Risk Committee ("ERC"), which includes members of management of the Manager, receives regular reports from the CISO on, among other things, the Manager's cyber risks and threats, the status of projects to strengthen the Manager's information security systems, assessments of the Manager's security program and the emerging threat landscape.

companyName: Grayscale CoinDesk Crypto 5 ETF

ticker: GDLC


text: The CISO updates the ERC and the Board quarterly. These regular reports include the Manager's performance preparing for, preventing, detecting, responding to, and recovering from, cyber incidents. The CISO also promptly informs and updates the ERC and the Board of the Manager about any information security incidents that may pose a material risk to the Manager. The Manager contracts an independent third party to conduct a full cyber risk assessment annually, and the results of those assessments are reported to the ERC and the Board. Material outcomes from any penetration testing, vulnerability scanning, and business continuity or disaster recovery testing are additionally reported to the ERC and Board.