text: Our approach encompasses several key areas consisting of threat and vulnerability management that help to identify, prioritize and reduce cybersecurity gaps or weaknesses. Identity and access management serves as an integral part of our strategy and involves access controls and authentication methods. Data protection and privacy practices, including data loss prevention, safeguards sensitive information. We also deploy cybersecurity systems, such as firewalls, intrusion detection systems and continuous monitoring, to provide defenses against unauthorized access. Incident response exercises are regularly performed to ensure readiness for potential cybersecurity incidents. Employee training and awareness programs are conducted to minimize risks associated with human error and foster a culture of security consciousness. Finally, vendor risk management practices are employed and focus on monitoring the posture of our third-party vendors to mitigate risks from external sources. In addition, we perform user access reviews for third-party applications, and for certain applications, obtain and review System and Organization Controls reports to assess our critical vendors' cybersecurity preparedness both at inception and on an ongoing basis.


text: Our cybersecurity program's effectiveness is periodically evaluated against established quantifiable goals and other external benchmarks, including the National Institute of Standards and Technology security framework. This evaluation is carried out through periodic internal and external risk assessments and compliance audits. We regularly engage third parties in order to help conduct these evaluations, assessments and audits, advise us on the effectiveness of our cybersecurity processes and assist the Company in remediating any identified vulnerabilities.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI

secItem: Item 1C


text: To date, the risks from cybersecurity threats, including as a result of any previous immaterial cybersecurity incidents, have not materially affected, or are reasonably likely to materially affect, our strategy, financial condition, liquidity or results of operations.


text: Governance. Our Board of Directors has responsibility for oversight of management's cybersecurity risk program and receives regular updates from our CIO. These updates, provided on a semi-annual basis, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and progress in enhancing the Company's cybersecurity posture.


text: Our CIO holds an advanced degree in Information Technology with over 20 years of experience, including senior leadership roles in technology at various companies. In addition, our CIO leads the Information Security Steering Committee, a group comprised of key information technology employees and business leaders, including our Senior Vice President, Chief Financial Officer and Senior Vice President, General Counsel and Chief Compliance Officer. This committee meets regularly to review and discuss the Company's cybersecurity strategies and developments, ensuring a comprehensive approach to managing cybersecurity risk.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. As part of this program, we have processes in place that are designed to assess, identify and manage material risks from cybersecurity threats, which are part of the Company's overall enterprise risk management process and have been embedded in the Company's operating procedures, internal controls and information systems.

companyName: Pediatrix Medical Group, Inc.

ticker: MD


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") 800-53, including derivatives such as NIST Cybersecurity Framework ("CSF") and HITRUST, as well as NIST 800-66 and the Center for Internet Security ("CIS"). This does not mean that we meet any particular technical standards, specifications, or requirements, but only that we use these standards as a guide to help us design and assess our program.


text: We rely on a multidisciplinary team, including our information security organization, legal department, management, and third-party service providers, as described further below, to assess, identify, and manage cybersecurity threats and risks.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment, including monitoring and evaluating our threat environment and our risk profile; • a security governance council principally responsible for management's oversight of our IT security; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity controls; • a third-party risk management process for service providers, suppliers and vendors covering compliance and technical controls; • cybersecurity awareness training for our employees, incident response personnel and senior management; and • a cybersecurity incident response plan with established procedures for assessing and responding to cybersecurity incidents, and that includes having an experienced incident response firm on retainer.


text: For information on the Company's cybersecurity-related risks, see "Information Systems, Cybersecurity and Data Privacy Risks" in "Risk Factors" on page 46 of this Annual Report on Form 10-K. While to date we have not identified any breaches from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may be insufficient. Accordingly, no matter how well our program is designed or implemented, we will not be able to anticipate all security breaches, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program. Our Board of Directors has elected to exercise direct oversight over this area, rather than acting through one of its committees, given the increasing importance of cybersecurity matters and the cross-functional impacts of technology on our business. Our Board of Directors receives reports at least twice per year from members of senior management, including our Chief Information Security Officer ("CISO") and Chief Compliance Officer, regarding the Company's information systems and technology and associated policies, processes, and practices for managing and mitigating cybersecurity and technology-related risks. Our Board of Directors also meets with external advisors to discuss technology and cybersecurity risks applicable to the Company and obtains perspectives which inform senior management's discussions with our Board of Directors. Our Board of Directors has delegated oversight of the process for determining disclosure required with respect to cybersecurity incidents to its Audit Committee.


text: At the management level, our information security organization is led by our CISO, who is responsible for cybersecurity risk management, with oversight by our Board of Directors. Our CISO has more than 20 years of experience in information security and IT risk management. He has specific experience in the following information security areas: security governance and policy, information security strategy and planning, penetration testing, vulnerability management, cybersecurity threat intelligence, incident response, third party risk management, cloud security, application security, identity and access management, data loss prevention, and security awareness.


text: Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from professionals in the information security organization, many of whom hold cybersecurity certifications such as a Certified Information Systems Security Professional (CISSP), Certified Data Privacy Solutions Engineer (CDPSE), or Security+ and through the use of technological tools and software and results from third-party audits. Our cybersecurity incident response framework is governed by a cybersecurity incident response plan, which sets out our approach for categorizing, responding to, and mitigating cybersecurity incidents. We have an incident response team comprised of our CISO, executive leaders, management and internal and external legal counsel, whose primary responsibilities include: • Evaluating and validating the impact of an incident; • Approving certain incident response countermeasures and remediation actions; • Escalating incidents and response countermeasures for approval; and • Acting in an advisory capacity in support of cybersecurity incident remediation, as appropriate.


text: We have also established a security governance council (the "Council") to further strengthen our cybersecurity risk management activities across the Company. The Council includes our Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, General Counsel and Secretary, Executive Vice President and Chief Operating Officer, Executive Vice President – National and Market Operations, Senior Vice President and Chief Information Officer, Vice President and Chief Information Security Officer, Vice President, Chief Compliance Officer, Vice President, People Services, and Associate Vice President, Internal Audit. The Council plans to meet quarterly beginning in 2024 and is responsible for management's oversight of our IT security in a cohesive and holistic manner that is designed to enable optimal decision-making.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • a documented set of cybersecurity policies and procedures that specifies the manner in which security controls are implemented; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business. Security breaches, loss of data or financial assets, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity, data privacy and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program. The Committee is composed of members of our board of directors with diverse expertise, including risk management, public accounting, biotechnology, chief executive officer roles, and multiple public company directorships, which has prepared them to oversee our cybersecurity risks.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to our full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President ("SVP"), Head of Finance and Investor Relations, Chief Legal Officer, internal security staff and external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our management team, including our SVP, Head of Finance and Investor Relations and Chief Legal Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: A core aspect of the Company's business relies on technology and software; as a result, the security of those technologies and software, as well as the protection of the confidential information entrusted to the Company by its customers, are key components of the Company's business and strategy. DFIN maintains many processes for identifying, assessing and managing material risks from cybersecurity threats. These processes are applied throughout the organization and are monitored, updated and assessed. DFIN has developed cybersecurity risk management processes that are integrated into the Company's overall risk management system and designed to be comprehensive. Risk management committees such as the Enterprise Risk Management Committee and the Ethics and Compliance Committee regularly review the Company's policies and procedures governing cybersecurity. These policies and procedures inform protocols that align cybersecurity risk assessment and mitigation to evolving risks and threat vectors that impact broader enterprise risk categories, promoting a comprehensive approach. These processes include the identification, assessment and management of material risks that are derived from cybersecurity threats.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: DFIN engages assessors, consultants, auditors and specialized third parties to enhance the Company's cybersecurity posture. These collaborations provide evaluations, audits and insights to fortify DFIN's resilience against evolving cyber threats. The DFIN Cybersecurity Program is based upon industry leading frameworks, which include International Standardization Organization ("ISO") 27001, Control Objectives for Information Technology (COBIT). The Company's technologies and software must also comply with domestic and international regulatory and legal requirements. Ensuring that these technologies and software comply with those regulations is a key focus of the Company's efforts. DFIN has cyber incident response partners that conduct penetration testing and other exercises throughout the year whereby cybersecurity controls effectiveness is evaluated and reported to management. DFIN engages a third-party auditor to ascertain its cybersecurity risk management effectiveness as a part of its enterprise ISO 27001 certification process. The ISO 27001 certification process is highly proscribed and covers cyber risk management methodology, risk assessment and risk treatment. DFIN has adopted the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and engages a consultant to periodically assess the Company's NIST CSF profile and maturity.


text: The Company leverages cybersecurity technologies designed to provide for the security of client, employee and business confidential data. The Company's cybersecurity portfolio is inclusive of, but not limited to, data encryption, data masking, leading secure software development methodologies, application and network penetration testing, incident response, digital forensics, least-privileged access controls, anti-malware, end-point detection and response, virtual private networks and cyber threat intelligence. In addition, the Company manages a 24x7 Security Operations capability that monitors and responds to cyber threats in real-time.


text: DFIN manages and continues to mature a comprehensive third-party risk management program, referred to as "Supply Chain Security." The program evaluates critical suppliers for inherent risk and classifies suppliers according to the overall risk they present to the Company. The processes also include evaluating existing suppliers and third parties for ongoing risk. The classification rating determines the frequency in which suppliers are evaluated. For example, those identified as critical suppliers are continuously monitored and assessed. Other supplier reviews occur on an annual basis or other cadence. Generally, these reviews include an evaluation of the effectiveness of a supplier or third party's cybersecurity along with the risks associated with adding and/or integrating this third party into the DFIN ecosystem. New and existing suppliers that were determined to pose a material risk may be rejected or have their contracts terminated. Supply chain and third-party risk continues to be a top cybersecurity threat vector, and DFIN's robust processes continue to oversee and identify cybersecurity risks associated with the Company's use of third-party service providers. The Company believes that its regular assessments and due diligence help mitigate potential vulnerabilities relating to these relationships.


text: DFIN's initiatives and internal goals incorporate cybersecurity, including cyber risk requirements and cyber risk analysis. To deliver upon regulatory, client and Company cybersecurity objectives, the Company made investments to support processes, architectures and system operations models which specifically address cyber risk, including but not limited to threat detection and response capabilities, end point detection, incident response partnerships and other services provided by managed security service providers. The Company leverages cybersecurity technologies designed to ensure security of client, employee and business confidential data. Minimization of cybersecurity risk is also a part of DFIN's overall business strategy and is further evidenced by programmatic endeavors such as adopting a Zero Trust Architecture wherein all users, systems, applications and networks are deemed untrusted and must be verified. Separately, part of DFIN's corporate strategy includes maintaining adequate cybersecurity insurance. During the renewal process underwriters evaluate all aspects of DFIN's cybersecurity posture, providing another annual evaluation of the Company's cyber risk management.


text: Risks from cybersecurity threats, including those described in Part I, Item 1A. Risk Factors, factor into many facets of DFIN's operations and have a direct influence on business strategy. For example, cybersecurity risk considerations may be factored into how DFIN's products are designed and technology is selected. Cybersecurity risk also informs how the Company educates and trains its employees. In 2023, the Company conducted monthly simulations to train employees to detect and respond to various cyber attack vectors like phishing, vishing and smishing attempts and provides enhanced training to employees who fail a simulated cyber attack. DFIN also conducted quarterly IT training on topics such as risk detection and data handling and provided targeted cybersecurity threat awareness and training to executives during 2023. The Company conducts Incident Response tabletop exercises throughout the year at different levels of the organization, including the executive team. These incident response plans and training initiatives are regularly evaluated to adapt to evolving cyber threats and awareness. The Company's goal is to create an ethos of "security first" and "security by design" and to have a culture (and accountability) that security is the responsibility of every DFIN employee.


text: No material cybersecurity incident has been identified nor materially affected the Company's business strategy, results of operations, or financial condition during the periods covered by the Annual Report. The Company's goal is to continually assess potential incidents, enhance protocols, expand cyber risk capabilities to mitigate future risks and safeguard DFIN's intellectual property, operations and client data.


text: DFIN's Board and senior management are engaged in managing and overseeing the Company's cyber risks. Internal Audit periodically reviews enterprise risk management topics as well as the effectiveness of information security controls and other procedures and reports significant findings to executive management and either the Board or the Audit Committee. The Company's Chief Information Security Officer ("CISO") has over 29 years of cybersecurity experience overseeing enterprise cybersecurity risk management and compliance programs and has responsibility for assessing and managing cybersecurity risks. The CISO reports to the Chief Information Officer and leads multiple cybersecurity functions that consist of Cyber Defense and Threat Intelligence, Application Security, Network Security, Identity Governance Administration and IT Governance as well as Risk and Compliance functions. As the front line of defense against cybersecurity risks, these functions employ several tools, processes and procedures to detect attempted cyber attacks, prevent cyber threats and monitor cyber risks. The functions are also engaged in incident response should incidents occur and are accountable for remediating cyber threats, if manifested.


text: The Board maintains oversight of risk from cybersecurity threats and is regularly briefed regarding emerging cyber risks, mitigation strategies and incident response protocols directly from the CISO. The Board includes at least one cybersecurity subject matter expert. The CISO periodically engages with the Board in an executive session to provide updates related to threat landscapes, security initiatives and other cybersecurity awareness within DFIN. The Board participates in tabletop exercises to better understand the Company's incident response planning and the Company maintains processes and procedures so that material risks or events are escalated and addressed appropriately.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Amplitude, Inc.

ticker: AMPL


text: We design and assess our program based on industry-standard frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), SOC2, ISO 27000, and ISO 27018. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise information technology environment; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors who have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For more information, see the section titled "Risk Factor—Risks Related to Our Business Operations and Industry—If our information technology systems are breached or there is otherwise unauthorized disclosure of or access to customer data, our data, or our platform, our platform may be perceived as insecure, we may lose customers or fail to attract new customers, our reputation and brand may be harmed, and we may incur significant liabilities."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and oversees management's implementation of our cybersecurity risk management program.


text: The Board receives periodic reports and presentations from management on our cybersecurity risks and cyber risk management program. In addition, management updates the Board, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes more than 30 years in professional roles supporting and leading cybersecurity and cloud security programs for technology companies, including, (i) our Chief Information Security Officer (CISO), Dustin Pearce, who has previously led the Security and Governance, Risk, and Compliance (GRC) and Infrastructure functions, at Instacart and Slack, respectively, which included responsibility for assessing and managing various aspects of platform security for users, and (ii) our Executive Vice President of Engineering, Shadi Rostami, who has extensive experience in overseeing security for cloud services from an engineering perspective, including at Palo Alto Networks, while serving as Vice President of Engineering with responsibility for overseeing key cloud services, ensuring the security of cloud offerings and developing several cybersecurity solutions. Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Cybersecurity Risk Management and Strategy Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems and our critical information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.

companyName: Claros Mortgage Trust, Inc.

ticker: CMTG


text: Our Manager uses the Center for Internet Security Critical Security Controls as a guide to help identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that our Manager meets any particular technical standards, specifications, or requirements.


text: Our Manager's cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to critical systems, information, services, and our Manager's broader enterprise information technology ("IT") environment; • a team comprised of IT and Legal & Compliance personnel of our Manager principally responsible for directing (1) the cybersecurity risk assessment processes, (2) our Manager's security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes or those of our Manager; • cybersecurity awareness training of employees with access to our Manager's IT systems; • a cybersecurity incident response plan; and • a third-party risk assessment process for key service providers.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Operational risks, including the risk of cyberattacks, may disrupt our businesses, result in losses and limit our growth."


text: Cybersecurity Governance Our Board has generally delegated the cybersecurity risk oversight function to the Audit Committee. The Audit Committee monitors our Manager's design and implementation of its cybersecurity risk management program.


text: Our Manager's Director of Technology periodically reports to the Audit Committee and provides briefings on cybersecurity risks, our Manager's cyber risk management program, and, if applicable, known cybersecurity incidents. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. Audit Committee members also receive presentations on cybersecurity topics from our Manager's Director of Technology or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Manager's Director of Technology leads our Manager's overall cybersecurity function and supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, including alerts and reports produced by security tools deployed in our Manager's IT environment.


text: Our Manager's Director of Technology is responsible for assessing and managing our Manager's material risks from cybersecurity threats and has primary responsibility for leading our Manager's overall cybersecurity risk management program and external IT cybersecurity service providers. Our Manager's Director of Technology has pertinent related experience in managing IT infrastructure and participates in various industry peer groups and organizations.


text: Cybersecurity Risk Management and Strategy We recognize the importance of developing, implementing and maintaining the integrity of our information technology systems and safeguarding the personal data and confidential information we receive and store. We have a cybersecurity risk management program in place designed to assess, identify and manage material risks from cybersecurity threats utilizing a defense-in-depth security strategy that integrates our staff, technology and operations to establish various securities barriers across multiple layers and missions of our operations. Our cybersecurity risk management program is designed to employ industry standard practices across our operations and business functions, including monitoring and analysis of the threat environment, vulnerability assessments, and third-party cybersecurity risks; detecting and responding to cybersecurity incidents, attacks and data breaches; cybersecurity preparedness, incident response plans, and business continuity and disaster recovery capabilities; and investments in cybersecurity infrastructure and program needs. Key aspects of our cybersecurity risk management program include, but are not limited to, the following: • Surveillance controls and technical protective capabilities, including a centralized security incident event management system, or SIEM, and a third-party continuous monitoring engagement, that monitors threat detection and response 24/7/365; • Utilization of third parties to assess our practices related to, and provide expertise and assistance with, various aspects of information security, as further described below; • Annual cybersecurity training for all employees, including social engineering (e.g., phishing, vishing, and smishing), privacy and other related topics; • Established policies and procedures that govern information security and cybersecurity which apply to all employees and information systems we control; • Business continuity, incident response and disaster recovery procedures, including quarterly tabletop incident response exercises, annual disaster recovery tests, annual unannounced penetration tests, annual phishing campaigns, and annual security control assessments; • Database activity monitoring, encryption, secure file transfer protocols and application firewalls; and • Maintaining cybersecurity insurance covering certain security and privacy damages and claim expenses resulting from cybersecurity incidents (we periodically meet with our insurer to discuss trends in cybersecurity).

companyName: CoreCivic, Inc.

ticker: CXW


text: We engage third parties in connection with assessing, identifying and managing our cybersecurity risks, including, but not limited to, the following: • We engage an independent third-party with incident response expertise to provide intelligence-based cybersecurity solutions and services to assist us with preparing for, investigating, and responding to cybersecurity incidents, including attacks that target on premise, cloud, and critical infrastructure environments. • We engage an independent third-party service provider to conduct an annual security program assessment of the controls, maturity and performance of our information security program and the information security risks associated with our technology and business systems. • We engage an independent third-party service provider to annually perform external and internal penetration and intrusion testing using industry standard tools and techniques. • We engage an independent third-party auditor to help ensure compliance with certain information security standards required under some of our federal contracts. • We have an established cadence of reviews, reporting and coordination with government agencies to review cybersecurity metrics, findings and any applicable remediation efforts. These agencies conduct assessments of our controls on a periodic basis using the National Institute of Standards and Technology Cybersecurity Framework. • We engage a third-party auditor to review processes and procedures designed to control access to information systems as part of its Sarbanes-Oxley testing. In addition to the third parties described above, we regularly engage consultants, advisors, service providers and other third parties to help develop and manage our cybersecurity risk management program. Further, our internal audit team conducts annual assessments of our cybersecurity risk management program and controls.


text: To help identify and manage cybersecurity risks associated with our use of third-party service providers, we have implemented processes to assess third-party systems which could be compromised in a manner that adversely impacts us and our technology systems. We conduct diligence of significant third-party service providers who will have access to our data or information technology systems and incorporate certain cybersecurity protections in our engagement contracts with such providers. In addition, we require such third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations.


text: We have a risk assessment program in place to assess, identify and manage material risks from cybersecurity threats. Cybersecurity risks we face include cyberattacks, computer viruses, malicious or destructive code (such as ransomware), social engineering (including phishing, vishing and smishing), denial of service or information or security breach tactics as well as attacks to our website, financial applications, operational technology, telecommunications and human resources data. Our cybersecurity risk management program includes technology and processes designed to maintain active security of our information technology systems. We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. However, we cannot ensure you that future cybersecurity incidents will not materially affect our business strategy, results of operations or financial condition. For more information on the Company's risks associated with cybersecurity threats and incidents, information and security breaches and technology failures, see Part I, Item 1A. Risk Factors - Interruption, delay or failure of the provision of our technology services or information systems, or the compromise of the security thereof, could adversely affect our business, financial condition or results of operations.


text: Our cybersecurity risk management program is integrated into our overall risk management system. Our BOD has a formalized enterprise risk management program, or ERM Program, which the Risk Committee of the BOD, or Risk Committee, on behalf of the BOD and the Audit Committee of the BOD, oversees. Our ERM Program addresses the identification, prioritization and assessment of a broad range of risks (e.g., cybersecurity, financial, operational, business, reputational, governance and managerial), and the formulation of plans to develop and improve controls for managing these risks or mitigating their effects in an integrated effort involving our BOD, relevant committees of the BOD, management, and other personnel. Our ERM Program is led by our General Counsel and is a component of management's strategic planning process. Our BOD and Risk Committee have primary oversight responsibility regarding our cybersecurity risk management program. Our BOD and Risk Committee each receives regular and frequent updates on cybersecurity and information technology matters from management (including our Chief Information Officer, or CIO) and, periodically, from outside experts. For example, the CIO provides reports to our BOD, Technology Steering Committee and Risk Committee regarding cybersecurity risks, as well as plans and strategies to mitigate those risks, on a periodic basis.


text: In addition, our Enterprise Risk Council, or ERC, is a management-level team comprised of a select group of executive officers, vice presidents, and senior managers overseeing risk, which is responsible for managing enterprise risks and planning and organizing the activities of our organization to minimize the effects of risk on our business, operations and financial results. ERC is led by our General Counsel and our Managing Director, Litigation & Risk Management. The ERC coordinates enterprise risk management reports to the Risk Committee and/or our BOD. Further, the Risk Committee reviews management's cybersecurity risk management program controls, including management's assessment of recent cybersecurity incidents meeting certain criteria.


text: We also have a Technology Steering Committee that assists with fulfilling oversight responsibilities of information technology risks, including cybersecurity risks. The Technology Steering Committee is comprised of our executive officers and relevant business leaders from the information security, information technology, legal, human resources, audit, finance, communication and risk functions, and identifies, defines, manages and measures information technology and cybersecurity risks applicable to us on an enterprise level. The Technology Steering Committee meets quarterly, and reviews all cybersecurity risks and incidents meeting certain criteria, and provides oversight with respect to cybersecurity matters at a management level. Further, the Technology Steering Committee reviews management's cybersecurity risk management program controls meeting certain criteria.


text: Our Technology Cybersecurity Committee is comprised of a subset of our Technology Department, including our CIO. The Technology Cybersecurity Committee meets bi-weekly and reviews all cybersecurity risks and incidents meeting certain criteria, provides oversight with respect to cybersecurity matters at a technology management level, and reports through our CIO to the Technology Steering Committee.


text: We also maintain a management governance structure for reviewing and approving changes related to new and existing systems, software and infrastructure design. Any new items that would require a material change must be reviewed and approved by our architecture review board, or ARB. Non-material changes are governed by the change advisory board, or CAB. The ARB and CAB each meet on a weekly basis and take security impacts into consideration during the decision-making process. All changes, whether approved or rejected, are formally documented in our information technology service management system.


text: As mentioned above, our SIEM tool monitors threat detection and response 24/7/365. Identified threats are alerted and addressed by our information technology team in accordance with internal policies, industry standard practices and regulatory requirements. Audit logs of external security threats are reviewed weekly as part of general event threat intelligence monitoring procedures. Other ongoing monitoring includes data from our information services team, which maintains an audit trail to detect risks in areas such as unauthorized local connections, network use and remote connections. Vulnerability scans are performed weekly and are supplemented on an ad-hoc basis for specific threats or to test patch status.


text: Our Director, Information Security Compliance, prepares an incident summary and collaborates with the CIO to conduct an initial assessment of cybersecurity incidents. They perform an impact assessment with respect to cybersecurity incidents meeting certain criteria and elevate the review of any such cybersecurity incidents for review by our executive officers.


text: Cybersecurity incidents meeting a certain criteria are escalated to our Disclosure Committee for SEC disclosure consideration. The materiality of any cybersecurity incident is ultimately evaluated and determined by our Disclosure Committee in collaboration with our CIO. Our Disclosure Committee is comprised of our executive officers, our CIO, our Chief Ethics and Compliance Officer, and relevant business leaders from our finance and legal departments. The Disclosure Committee is presented with a detailed overview of the cybersecurity incident by the CIO. The Disclosure Committee then evaluates the cybersecurity incident and its potential materiality based on SEC guidance and by considering relevant quantitative and qualitative factors.


text: We have also adopted a cybersecurity incident response plan which provides for controls and procedures in connection with cybersecurity incidents, including these escalation procedures.


text: At a management level, our cybersecurity risk management program is led by our CIO, along with our Director, Information Security Compliance. As of the date of this Annual Report, our Technology Department, led by our CIO, along with our Director, Information Security Compliance, is comprised of nearly 100 technology professionals, with currently 11 of such technology professionals exclusively dedicated to cybersecurity. These 11 technology professionals have an average cybersecurity tenure of 13 years and certifications from ISC2, ISACA, CompTIA and other industry certification leaders including CISSP, CISM, CISA, CCNA, CCNP, Network+, Security+, Project+, A+, CEH, CCSP and ITIL, among other advanced Cybersecurity and Technology degrees, tool and process specific certifications and cybersecurity related work experience. Our Technology Department stays current on cybersecurity issues and trends through continuing education activities such as conferences and participating in webinars, maintaining continuous education requirements for certification bodies, as well as through the monitoring of security and vendor feeds on cybersecurity trends and threats.


text: Risk Management and Strategy In the regular course of business, the Registrants handle a range of sensitive security and customer information. The Registrants are subject to numerous laws and rules concerning safeguarding and maintaining the confidentiality of this information. The Registrants utilize a risk-based, comprehensive, systematic and layered approach to cybersecurity risk, which helps them to continually assess, identify and manage enterprise-wide material cybersecurity risks. The Registrants have a comprehensive cybersecurity threat detection and monitoring program for their technology and network infrastructure, which leverages various systems, processes and operational measures to monitor, detect and respond to cyber incidents. The Registrants have established a security incident response plan, a business resiliency and event management framework, as well as disaster recovery mechanisms, which are tested and updated to prepare the Registrants to respond to material cybersecurity threats. The Registrants' cybersecurity processes, including their threat detection, monitoring and response protocols, are subject to periodic internal audits. The Registrants' Enterprise Security team partners with Internal Audit and third-party experts to conduct periodic penetration tests and assessments of the Registrants' cybersecurity processes.

companyName: OGE ENERGY CORP.

ticker: OGE


text: Cybersecurity risks are integrated into the Registrants' Enterprise Risk Management process. The Enterprise Risk Management process engages internal stakeholders, helps identify key internal and external business risks, including cybersecurity risks, and then supports evaluations of those risks, providing consistent assessment. Key risks are then assessed using a methodology that includes a quantification of potential financial and operational impacts. Priority cybersecurity risks are assigned internal risk owners which report to the Vice President of Technology, Data and Security, who is responsible for the Registrants' Enterprise Security including, among other responsibilities, developing and updating risk management plans.


text: The Enterprise Security team utilizes third-party consultants to regularly conduct a review of the Registrants' cybersecurity program that includes assessing their (i) ability to detect and respond to malicious behavior, (ii) configuration of security tools and (iii) security roadmap, training and staffing plans. The Enterprise Security team also utilizes multiple sources of threat intelligence information from real time feeds that come from government, industry and private sources to help stay abreast of emerging threats that could impact the Registrants.


text: The Registrants have third-party vendor risk management processes to oversee and identify risks from cybersecurity threats associated with their use of third-party service providers. Enterprise Security works cross-functionally across the companies to review new vendors and their proposed solutions as they are engaged by the Registrants. The Enterprise Security team's monitoring and assessment of third-party cybersecurity practices is continuous and ongoing throughout the Registrants' relationship with the third party. Based on this process, the Enterprise Security team may require specific security controls on the third-party application, system, hardware or software being deployed. Enterprise Security monitors vendors for disclosed vulnerabilities and change in scores from external risk scoring agencies.


text: The Registrants and their third-party vendors have been subject to, and will likely continue to be subject to, attempts to gain unauthorized access to systems, or confidential data, or to disrupt operations. None of these attempts has individually or in aggregate resulted in a security incident with a material impact on the Registrants financial condition or results of operations. Although prior incidents have not materially affected the Registrants, any future incidents related to the Registrants' information systems due to theft, ransomware, viruses, increased use of artificial intelligence technologies, denial of service, hacking, acts of war or terrorism, or inappropriate release of certain types of information, including confidential customer information or system operating information, could have a materially adverse impact on the Registrants, and affect their business strategy, results of operations or its financial condition. See "Item 1A. Risk Factors" for further discussion.


text: The Board of Directors is responsible for reviewing and overseeing the long-term strategic plans and principal issues facing the Registrants and includes the oversight of the major risk exposures and the risk management activities of the Registrants. As part of its risk oversight role, the Board delegates specific roles to its committees to help ensure risks, mitigations and opportunities are appropriately monitored and managed. The Audit Committee has overall oversight responsibility over the Registrants' major financial risks, while the Nominating, Corporate Governance and Stewardship Committee oversees the Registrants' cybersecurity risk exposure and management. These Committees and the full Board of Directors are updated regularly by the Vice President of Technology, Data and Security and the Director of Enterprise Security on cybersecurity risks and related matters, including results from audits and assessments of the Registrants' cybersecurity practices and systems, as well as the results of their incident response and business resiliency exercises.


text: The Vice President of Technology, Data, and Security leads an information security team responsible for management of cybersecurity risk. The Vice President of Technology, Data and Security has decades of experience relevant to risk management, information systems and enterprise security. The Vice President of Technology, Data and Security serves on the Corporate Risk Oversight Committee where cyber risks are regularly discussed and addressed. The Registrants' Corporate Risk Oversight Committee includes corporate officers and members of management and is responsible for the overall development, implementation and enforcement of strategies and policies for all significant risk management activities of the Registrants.


text: The Registrants' contingency plans, including its security incident response plan and event management framework, set forth the processes through which cybersecurity incidents are managed, including how management is informed of cybersecurity incidents. As part of these plans, incidents are evaluated, classified and elevated, as necessary, to an executive team which includes the Vice President of Technology, Data and Security and other executives on the Registrants' Corporate Risk Oversight Committee. Once elevated, these executives are ultimately responsible for the management, mitigation and remediation of incidents.


text: We recognize the critical importance of maintaining the safety and security of our systems and data and take a holistic approach to overseeing and managing cybersecurity, which is supported by both management and our Board of Directors. The Company's Board, the Audit Committee of the Board and management devote significant resources to cybersecurity and risk management processes to adapt to the changing cybersecurity landscape and respond to emerging threats in a timely and effective manner. Our approach to cybersecurity risk management is multi-layered and includes governance and risk, monitoring and incidence response, data security, application security, endpoint security, network security and perimeter security.

companyName: First American Financial Corp

ticker: FAF


text: The Company's Chief Information Security Officer ("CISO") is responsible for developing and implementing our information security program and manages a team of cybersecurity professionals with broad experience and expertise, including in cybersecurity threat assessments and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats and regulatory compliance. Our CISO has been with the Company for 13 years in various information security roles and has over 20 years of experience in the cybersecurity field.


text: The Company's Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee of the Board. The Audit Committee receives quarterly reports from our CISO regarding cybersecurity matters. The CISO also briefs the full Board of Directors on cybersecurity matters semi-annually.


text: The Company maintains an extensive and structured enterprise risk management (ERM) program encompassing senior executive leaders from all facets of its business, including operations, human resources, finance, accounting, treasury, information security, information technology, legal/regulatory, internal audit, compliance, underwriting, and real estate. As part of our ERM program, the Company maintains an Information Security Oversight Committee ("ISO Committee") that oversees the Company's cybersecurity program from a management perspective. The ISO Committee meets quarterly and is chaired by the Company's Chief Risk Officer and is comprised of the Company's Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Privacy Officer and top leaders of each of the Company's operating units. The Company's CISO, Chief Information Officer and Chief Technology Officer are also participants on the ISO Committee and the Chief Audit Executive, who reports to the Company's Audit Committee, is an observer. The CISO provides regular reports to the ISO Committee which are shared with the Company's Board of Directors.


text: As part of our risk management process, the Company maintains an overall risk management program that encompasses cybersecurity, conducts security audits, annual System and Organization Controls (SOC 2) testing, and ongoing risk assessments using a company-wide risk framework. We also require employees with access to information systems to undertake data protection and cybersecurity training and compliance programs. Compliance with cybersecurity training is tracked and reported to the Company's Compliance Executive Steering Committee and the Audit Committee of the Board. In addition, the Company conducts quarterly employee phishing tests and our CISO provides those results to the Company's executives. The Company has processes in place for assessing, identifying, and managing material risks from potential cybersecurity incidents, including vulnerability identification, intrusion prevention, encryption, endpoint protection, behavior analysis, mitigation and the processes and protocols set forth in the Company's incident response plans. Certain of our subsidiaries manage their own cybersecurity functions and coordinate with the Company's CISO. The Company also employs systems and processes designed to oversee and identify cybersecurity threats associated with third-party vendors, including a risk assessment and rigorous evaluation of each vendor that may access, process or store highly sensitive or proprietary data or that is systematically integrated with the Company's systems or network. In addition to our in-house cybersecurity capabilities, we engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, mitigating and managing cybersecurity risks, including the maintenance of a Security Operations Center that is co-managed between the Company and a managed security service provider (MSSP), which continuously reviews the Company's network using threat intelligence from a variety of sources and reports potential incidents from users.


text: While the Company has experienced cybersecurity threats to its data and systems, such threats have not materially affected the Company, including our business strategy, results of operations or financial condition, with the exception of an incident in the fourth quarter of 2023, as disclosed in a Current Report filed by the Company on Form 8-K on December 22, as amended on December 29, 2023 and January 12, 2024. Prior to the Company's systems being taken offline in connection with this incident, we produced an internal forecast estimating our adjusted earnings per share to be $1.00. Our actual adjusted earnings per share was 69 cents, including a 5 cent tax benefit, implying a 36 cent shortfall relative to our internal estimate. Although the Company believes that most of this difference is related to the incident, the exact impact the incident had on our fourth quarter results is unknowable. Included in this 36 cent shortfall was $11 million of direct expenses related to the incident in our corporate segment including our $5 million insurance retention. We do not believe the incident will have a material impact on the Company's overall financial condition or its ongoing results of operations. For additional information on cybersecurity risks we face, see Item 1A. Risk Factors of this Annual Report, which should be read in conjunction with the foregoing information.


text: The energy sector, including electric and natural gas utility companies, has become the subject of cyberattacks with increased frequency. Our administrative and operating networks are targeted by hackers on a regular basis. Any failure, unexpected, or unauthorized use of technology systems could result in the unavailability of such systems, and could result in a loss of operating revenues, damage to our brand and reputation, and/or an increase in operating expenses and costs to repair or replace damaged assets. See "Risk Factors – Cyber Risk Factors" for further information.

companyName: AVISTA CORP

ticker: AVA


text: We consider the management of cybersecurity risk in our overall enterprise risk management program. See "Item 7. Management's Discussion and Analysis - Enterprise Risk Management" for further discussion of the program.


text: We mitigate cyber risk through trainings and exercises at all levels of the Company. Annual cyber and physical training and testing of employees are included in our enterprise security program. Our enterprise business continuity program facilitates business impact analysis of core functions for development of emergency operating plans and coordinates annual testing and training exercises. In addition, there are independent third party audits of our critical infrastructure security program and our business risk security controls.


text: The technology department, led by the Vice President, Chief Information Officer, and Chief Security Officer, is responsible for our cybersecurity program. The Vice President, Chief Information Officer and Chief Security Officer has over 20 years of experience, including serving in similar roles leading and overseeing cybersecurity programs at other companies. This program includes maintenance of appropriate cybersecurity measures, such as firewalls, anti-virus, patching, and other zero-trust security protocols, monitoring for intrusion and security events that may include a data breach or an attack on our operations, and working with our supply chain department to ensure contracts with third party service providers include appropriate requirements for the mitigation of cybersecurity risk that might impact our business.


text: Our data breach response team is comprised of designated members of the technology department, senior management and other appropriate individuals. The team is tasked with assessing, managing and responding to material cybersecurity incidents involving either our systems or the systems of third party service providers. The data breach response team includes subject matter experts within the Company, as well as outside experts who specialize in cybersecurity response. A subset of this team is also responsible for assessing the materiality of cybersecurity incidents, reporting to the Audit Committee of the Board of Directors as appropriate, and ensuring timeline reporting of cybersecurity incidents deemed material to the Company.


text: The Environmental, Technology and Operations Committee of the Board of Directors oversees our management of cybersecurity risks. This Committee is briefed on security policy, programs and incidents on at least a quarterly basis. The Audit Committee of the Board of Directors provides oversight of required disclosures relating to cybersecurity.


text: Risk Management and Strategy Garmin has a cybersecurity risk management program, generally aligned with the tenets and methodologies of industry standards and best practices such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework, designed to protect the confidentiality, integrity, and availability of the Company's information systems through assessing, identifying, and managing material risks from cybersecurity threats. The management of our information system platforms and the related cybersecurity is tightly integrated with Garmin's product development and technology management teams. Cybersecurity risks are identified, reported, and managed by the Company's in-house cybersecurity experts as well as third-party providers of penetration test reporting, cyber-threat intelligence, and incident forensics services.

companyName: GARMIN LTD

ticker: GRMN


text: Material Risk Identification The Company identifies risks from cybersecurity threats through a variety of methods including, but not limited to, internal and external assessments, security incidents, evaluations of changes to the business environment, systems, or technology, and reporting by associates, vendors, customers, and security researchers. These processes occur during the procurement, development, integration, modification, operation, and maintenance of the Company's information systems and the integration with or introduction, purchase, acquisition, or renewal of any third-party information systems and services. Notable changes to the Company's operating environment are scrutinized to ensure the confidentiality, integrity, and availability of the Company's information systems.


text: Material Risk Assessment The Company evaluates material risks from cybersecurity threats in terms of the potential impact on technology, information, data, and business operations, taking into account applicable laws and regulations, and with a focus on protecting the confidentiality, integrity, and availability of information, data and systems. Associated risk assessments are performed by the Company's risk analysts, subject matter experts, and information technology associates to identify, analyze, and quantify the risks and relevant objectives, and to determine the appropriate management action and priorities for managing the risks and implementing mitigating controls. Additional assessments to evaluate residual risk are performed when there are changes to controls that have the potential to create a material risk. Risk assessments also include appropriate considerations for regulatory and contractual requirements, and involve the Company's legal, data privacy, finance, and risk assurance functions as applicable.


text: Material Risk Management The Company continually analyzes and responds to material risks from cybersecurity threats in order to manage them to acceptable levels. The results of related risk assessments are used to prioritize the risks based on their potential impact to the Company and to inform the necessary actions and the appropriate functions to be involved in responding to those risks. Garmin's cybersecurity risk management processes are integrated into the Company's overall risk management processes. Material risks from cybersecurity threats are communicated to the Company's management and Board of Directors and are evaluated and considered alongside operational, legal, and other risks faced by the Company in determining mitigating actions and the allocation of resources.


text: Risks Related to Third-party Service Providers Garmin operates a third-party risk management program, which is aligned to NIST principles, to oversee and identify material risks from cybersecurity threats, undertake appropriate remediation, and establish and maintain compensating controls when appropriate. We conduct cybersecurity assessments of third-party service providers that will process personal, confidential, or proprietary information. Before proceeding with any such third-party service provider, we require them to remediate or mitigate any material findings from our cybersecurity assessment and to agree contractually to maintain acceptable cybersecurity practices throughout the duration of their service to Garmin and after for so long as they retain any personal, confidential, or proprietary information, and to promptly notify Garmin of any cybersecurity incidents that impact Garmin.


text: Risks from Cybersecurity Threats While the Company has technology and processes in place designed to detect and respond to cybersecurity threats, we are continually at risk from the evolving cybersecurity threat landscape. Management does not believe our business strategy, results of operations, or financial condition have been materially affected by risks from cybersecurity threats, but we cannot provide assurance that they will not be materially affected in the future by such risks. For additional information about risks from cybersecurity threats, see Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: Board of Directors Oversight Garmin's entire Board of Directors performs the risk oversight role, including with respect to risks from cybersecurity threats. Garmin's Chief Executive Officer is a member of the Board, and Garmin's Chief Financial Officer and its General Counsel regularly attend Board meetings, which helps facilitate discussions regarding risk between the Board and Garmin's senior management. In addition, on an annual basis Garmin's head of cybersecurity provides a comprehensive update of the Company's cybersecurity practices, risks and risk mitigation strategies to the Board of Directors. Each member of the Board of Directors actively participates in those discussions and has an opportunity to ask questions or provide direction. Garmin's Chief Executive Officer and head of cybersecurity also have discussions with members of the Board of Directors on an ad hoc basis as appropriate if and when a specific cybersecurity risk arises.


text: Management's Role Managing Risk and Monitoring Incidents Garmin's head of cybersecurity, who has over 30 years of relevant cybersecurity experience, oversees the Company's cybersecurity risk management program and is responsible for assessing and managing the Company's material risks from cybersecurity threats. Garmin's head of cybersecurity regularly meets with the Company's senior management, including the Chief Executive Officer, to discuss the Company's cybersecurity practices, risks, risk mitigation strategies, and whether further investments in internal or external cybersecurity resources are warranted.


text: If the cybersecurity team detects a potentially significant cybersecurity incident it is escalated promptly to the Company's head of cybersecurity, who then activates the Company's incident response plan and convenes the incident response team, which includes leaders of the Company's Legal, Finance, Operations, Communications, Risk Assurance, and other departments and executive leadership as appropriate. The Chief Executive Officer will inform the Company's Board of Directors of any material cybersecurity incidents.


text: Cybersecurity Risk Management In the ordinary course of our business, we use, store and process data including data of our employees, partners, collaborators, and vendors. We also process anonymized information about participants in clinical trials involving certain of our product candidates. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data and our systems.

companyName: CRISPR Therapeutics AG

ticker: CRSP


text: Our cybersecurity risk management program includes a number of components, including information security program assessments and continuous monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments on our systems, including penetration testing and other vulnerability analyses. Our finance department, with the assistance of outside technical advisors, periodically conducts an internal assessment of different systems to assess our risk management processes, including cybersecurity risk management. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. This training is included during the employee onboarding process and periodically thereafter. As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and suppliers. Prior to engaging third-party vendors and key suppliers, we conduct a security assessment and, as appropriate, include security requirements in contracts. We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks. For more information on our cybersecurity related risks, see "Risk Factors—Risks Related to Information Security and Privacy—Our Internal Information Technology Systems, Or Those Of Our Collaborators Or Other Contractors Or Consultants, May Fail Or Suffer Security Breaches, Which Could Result In A Material Disruption Of Our Product Development Programs."


text: Under the ultimate direction of our chief executive officer, or CEO, and our executive management team (including our General Counsel who serves as our Chief Compliance Officer), with oversight from our Audit Committee of the Board of Directors, or Audit Committee, our Head of Information Technology, or Head of IT, has primary responsibility for assessing, operating and managing our cybersecurity threat management program. Our Head of IT meets periodically with our Chief Compliance Officer to discuss current developments in the cybersecurity landscape and our cybersecurity risk management program, including providing updates regarding the sources and nature of critical risks we face and how the IT department assesses those risks, including the likelihood of such risks, the severity of impact, and progress on vulnerability remediation.


text: Our Chief Compliance Officer and Head of IT consult with other members of our information technology department, and with third parties with expertise in cybersecurity, including a virtual Chief Information Security Officer, or vCISO, to develop strategies to assess, address and align cybersecurity efforts with our business objectives and operational requirements. The Head of IT role is currently held by an individual who has over 20 years of experience with information security and business systems, including digital infrastructure and cybersecurity. The individual currently operating as our vCISO has over 15 years of experience in providing services as an enterprise vCISO across various industries, including life sciences and national defense and has advised various agencies of the U.S. federal government.


text: As part of our Board of Directors', or Board's, enterprise risk management program, our Board has responsibility for oversight of cybersecurity risk management. Our Board has delegated to our Audit Committee oversight of our cybersecurity risk management program, including oversight of information security and cybersecurity threats and related compliance and disclosure requirements. On an annual basis, our Head of IT and vCISO provide an update to our Audit Committee regarding our cybersecurity risk management program, including as relates to critical cybersecurity risks, ongoing cybersecurity initiatives and strategies, and applicable regulatory requirements and industry standards. The Audit Committee periodically reports on cybersecurity risk management to the full Board of Directors.


text: Protecting the security of our information systems is of significant importance to Flowers. We follow certain policies, protocols, and practices that address cybersecurity.

companyName: FLOWERS FOODS INC

ticker: FLO


text: Risk Management and Strategy. We have processes in place for assessing, identifying and managing material risks from cybersecurity threats. These processes have been integrated into our enterprise risk management system. These processes also cover third-party service provider incidents that may impact the company.


text: Our cybersecurity program includes employee training and a computer security incident response plan (the "CSIRP") that provides controls and procedures designed to timely and accurately report material cybersecurity incidents. Employees receive regular security training, and we conduct periodic phishing testing to assess whether our employees require additional training. Additionally, we provide our employees with easy-to-use tools to report potential phishing emails. The CSIRP establishes an organizational framework and guidelines to assist the Company in identifying, responding to, and recovering from computer security incidents both at the company and its third-party service providers in connection with incidents that may impact the company, including the security incident management team (the "SIM Team"), a legal team (the "Legal Team") and the computer security incident response team (the "CSIRT"). Each of the SIM Team, the Legal Team, and the CSIRT, often in consultation with the VP of Information Security, has a discrete set of responsibilities and obligations under the CSIRP. The CSIRT is a broad, cross-functional team of management stakeholders assigned with coordinating, developing, and managing the Company's response to computer security incidents when activated.


text: Once the CSIRT has been activated, incidents are reported to a subcommittee of the Company's disclosure committee, which consists of certain senior executives and leaders throughout the company and is charged with making disclosure determinations.


text: The CSIRP provides that, when activated, the CSIRT will lead all aspects of incident response, including the engagement of outside counsel and other third-party resources, such as an external incident response team, forensic resources, a crisis management or public relations firm, or notification service providers. For incidents where the CSIRP is not activated, either the SIM Team or the Legal Team, depending on the circumstances, is expected to lead and manage the incident response.


text: We maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur. The company engages consultants, auditors, and other third parties to identify and manage risk from third parties.


text: No risks from previous cybersecurity threats have materially affected or are reasonably likely to materially affect Flowers' business strategy, results of operations, or financial condition. However, we may incur significant costs in protecting or remediating cyber-attacks or other cyber incidents. If we are unable to prevent physical and electronic break-ins, cyber-attacks and other information security breaches, we may suffer financial and reputational damage, be subject to litigation or incur remediation costs or penalties because of the unauthorized disclosure of confidential information belonging to us or to our partners, customers, suppliers or employees.


text: Governance. The company's board of directors oversees the company's Information Security program, which is approved annually. The audit committee is tasked with oversight of certain risk issues, including cybersecurity. As described in its charter, the audit committee of the Board of Directors oversees risks related to information technology security and regularly reviews and discusses with management the company's information technology security risk exposures, including (a) the potential impact of those exposures on the company's business, financial results, operations and reputation, (b) the steps that management has taken to monitor and mitigate such exposures, (c) the company's information governance policies and programs, and (d) legislative and regulatory developments that could materially impact the company's privacy and data risk exposure.


text: At the management-level, the company's IT systems are overseen by our chief information officer, who has responsibility for information technology strategy and operations. The company's Information Security program is led by the company's VP of Information Security, who has responsibility for information security strategy and operation. This individual has a variety of IT security skills, experiences and professional expertise, obtained through work experience and information security certifications and education.


text: Management tracks cybersecurity incidents through the process described above. Management regularly reports to the audit committee regarding policies and processes for assessing and managing risk associated with information technology and cybersecurity, as well as material cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We maintain a comprehensive cybersecurity program, including policies and procedures designed to protect our systems, operations, and data. We perform risk assessments on a quarterly basis to identify and remediate potential cybersecurity threats and vulnerabilities. In connection with our assessment of potential cybersecurity risks, our Information Technology ("IT") team engages in threat modeling, vulnerability scanning and penetration testing. For each identified risk, our IT team will estimate the likelihood of occurrence and potential impact, which will guide the Company in assessing and prioritizing risks. We have also implemented a process to evaluate and review potential cybersecurity risks arising from our use of third-party vendors. As part of our vendor engagement protocols, we will consider, among other things, each potential vendor's data backup procedures, incident reporting protocols and data privacy and encryption practices. Once a new vendor is onboarded, we monitor their cybersecurity posture utilizing a third-party cybersecurity ratings provider. In addition to our internal exercises to test aspects of our cybersecurity program, we engage independent third parties semi-annually to assess the risks associated with our IT resources and information assets. Among other matters, these third parties analyze information on the interactions of users of our information technology resources, including employees, and conduct penetration tests and scanning exercises to assess the performance of our cybersecurity systems and processes. Annually, we examine our cybersecurity program with these third parties, evaluating its effectiveness in part by considering industry standards and established frameworks, such as the National Institute of Standards and Technology ("NIST"), as guidelines. As a mortgage company, we are also associated with the Federal Financial Institutions Examination Council.

companyName: Taylor Morrison Home Corp

ticker: TMHC


text: For material cybersecurity risks, we've developed mitigation plans to reduce the risk's likelihood of occurrence and/or its expected impact. Such mitigation plans have involved, among other things, implementing additional technology controls or policies, increased training for company personnel or obtaining additional insurance for the identified risk. Our IT team monitors material risks over time and updates the Company's mitigation plans as appropriate. IT also regularly reports to the leadership team on the status of material risks, mitigation plans and incidents related to such risks.


text: We also maintain a data breach response plan, which is intended to be aligned with the NIST framework, and which is reviewed annually and conveyed to our team members through our mandatory cybersecurity training. We also retain experienced cybersecurity consultants that can assist us in the event of a serious breach, and maintain a cyber insurance policy.


text: For a discussion of how risks from cybersecurity threats affect our business, see "Part 1. Item 1A. Risk Factors – Risk Related to our Business – Information technology failures and data security breaches could harm our business" in this Annual Report on Form 10-K.


text: Cybersecurity Governance Management is responsible for ongoing assessment and oversight of cybersecurity risks that could significantly impact our operations, finances or reputation. This includes identifying information assets and data systems that are TAYLOR MORRISON HOME CORPORATION 10-K


text: Cybersecurity represents an important component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards and practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are one of the enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards and practices follow industry trends, which align with frameworks established by the National Institute of Standards and Technology and the International Organization for Standardization. The Company approaches cybersecurity threats through a cross-functional approach which endeavors to: (i) identify, prevent and mitigate cybersecurity threats to the Company; (ii) preserve the confidentiality, security and availability of the information that we collect and store to use in our business; (iii) protect the Company's intellectual property; (iv) maintain the confidence of our customers, clients and business partners; and (v) provide appropriate public disclosure of cybersecurity risks and incidents when required.

companyName: MCGRATH RENTCORP

ticker: MGRC


text: Risk Management and Strategy The Company's cybersecurity program focuses on the following areas: • Vigilance: The Company maintains cybersecurity threat operations with the goal of identifying, preventing and mitigating cybersecurity threats and responding to cybersecurity incidents in accordance with our established incident response and recovery plans. • Systems Safeguards: The Company deploys systems safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through ongoing vulnerability assessments and cybersecurity threat intelligence. • Collaboration: The Company utilizes collaboration mechanisms established with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers, to identify, assess and respond to cybersecurity risks. • Third-Party Risk Management: The Company endeavors to identify and oversee cybersecurity risks presented by third parties as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Training: The Company provides periodic training and testing for personnel regarding cybersecurity threats, which reinforce the Company's information security policies, standards and practices. • Incident Response and Recovery Planning: The Company has established and maintains incident response and recovery plans that address the Company's response to a cybersecurity incident and the recovery from a cybersecurity incident; such plans are tested and evaluated periodically. • Communication, Coordination and Disclosure: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats, involving management personnel from the Company's technology, operations, legal, risk management, and other key business functions, as well as the members of the Board in an ongoing dialogue regarding cybersecurity threats and incidents, while also implementing controls and procedures for the escalation of cybersecurity incidents pursuant to established thresholds so that decisions regarding the disclosure and reporting of such incidents can be made by management in a timely manner. • Governance: The Board's oversight of cybersecurity risk management is supported by the Company's executive leadership team and cybersecurity Steering Committee, which regularly interacts with the Company's Vice President of Information Technology and other members of the cyber team and management.


text: The Company manages risks from cybersecurity threats through the assessment and testing of the Company's processes and practices focused on evaluating the effectiveness of our cybersecurity measures. The Company engages a third-party independent cybersecurity company that provides security testing and monitoring, including penetration testing, auditing, and security assessment, for the Company. The results of such assessments and reviews are reported as part of the technology and cyber security update to the Company's executive leadership team and the Board, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: The Board oversees the management of risks from cybersecurity threats, including the policies, standards, processes and practices that the Company's management implements to address risks from cybersecurity threats. The Board receives reports on the Company's technology and cybersecurity functions, including vulnerability assessments, any third-party and independent reviews, the threat environment, and other information security considerations. The Board also receives prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding such incident until it has been addressed. The cyber security Steering Committee meets multiple times throughout the year to discuss the Company's cyber security programs and practices, risk management related to cyber security and a wide range of other related topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. At least once each year, the Board and the Company's executive leadership team discuss the Company's approach to cybersecurity risk management with the Company's VP of Information Technology.


text: The Company's VP of Information Technology is the member of the Company's management who is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other business leaders across the Company. The VP of Information Technology works in coordination with senior leadership, which includes our Chief Executive Officer and President, Chief Financial Officer and General Counsel. The Company's VP of Information Technology has served in various roles in technology and is supported by a team of information technology and cyber security professionals with decades of relevant experience. Most notably, the Company's Enterprise Manager of Cybersecurity and Network holds a Certified Information Systems Security Professional (CISSP) certification and has over 15 years of experience with managing risks arising from cybersecurity threats.


text: The Company has established a Cybersecurity Steering Committee that includes executives and senior leadership across all divisions and corporate services to implement and manage a program designed to protect the Company's information systems from cybersecurity threats and to respond promptly to any cybersecurity incidents. To facilitate the success of this program, multidisciplinary teams throughout the Company are created and deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's Incident Response Plans (IRP). Through the ongoing communications from these teams, the Steering committee monitors the effectiveness of the prevention, detection, mitigation and remediation within the cybersecurity program. The Company's General Counsel, as part of the Incident Response Team, will report any credible threats or security concerns to the Board when appropriate.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to affect the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy In the ordinary course of our business, we collect and store sensitive data, including intellectual property, proprietary business information of ours and that of our suppliers and partners, and personally identifiable information of persons who use our medicines, clinical trial participants and employees. Our partners and third-party providers also possess certain of our sensitive data. The secure maintenance of all such information and the secure performance of our information technology ("IT") systems are critical to our operations and business strategy. As our dependency on, and the complexity of, our IT systems increases, the confidentiality, integrity and availability of our IT systems and the data that they store is critical to managing our business.

companyName: Alkermes plc.

ticker: ALKS


text: Our Information Security Management System ("ISMS") is a key element of our information security program, and it is designed to identify, assess, help mitigate, and monitor information technology risks across the organization, including information security risks. The ISMS is informed by the structured principles of International Standard- ISO/IEC 27001:2022 (Information security, cybersecurity, and privacy protection), which outlines guidance for the establishment, implementation, maintenance, and improvement of information security management systems. Our ISMS is comprised of processes designed to identify cybersecurity risks, safeguard information assets and preserve the confidentiality, integrity, and availability of information owned, managed and maintained by us. Our ISMS includes formal written policies and procedures, technical security controls, such as automated tools designed to detect and prevent cybersecurity incidents, and programs designed to promote internal and third-party risk management, audit management, incident response and security awareness, including employee security awareness trainings and other initiatives. Our ISMS also includes periodic security audits, vulnerability assessments and penetration testing to proactively identify potential system vulnerabilities. Our ISMS is periodically assessed by third-party assessors and the results of such assessments, including any cybersecurity risks identified and managed thereby, are reported to the audit and risk committee of our board of directors, as described below, and are used by us to improve our ISMS specifically and our information security program generally.


text: As part of our information security program, we also have a program in place for management of cybersecurity risks associated with third-party handling of our confidential information, including their provision of critical services on our behalf. We conduct due diligence of our third-party vendors through an assessment of their security practices and overall risk profile, including through their completion of vendor assessment questionnaires and our application of established mechanisms for ongoing monitoring of such third parties, including tools such as security ratings services and periodic reassessment questionnaires.


text: As of the date of this Annual Report, we have not experienced any information security incidents that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition, and we have not identified any current cybersecurity threats that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Governance and Oversight We have a multi-layered information security governance framework in place to provide oversight of our information security program and strategy, our ISMS, and related risks and opportunities. This governance framework includes procedures for escalation of identified information security risks, threats or incidents through various management levels, including up to our Information Security Governing Body, which is comprised of our Chief Executive Officer, Chief Information Officer, Chief Operating Officer, Chief Financial Officer, Chief Legal Officer and other members of management, and as appropriate, up to our board of directors.


text: Our information security team, led by our Chief Information Officer, is responsible for developing, implementing and overseeing our Company-wide information security strategy and related policies and practices. The information security team is managed on a day-to-day basis by our Director and Executive Director of Information Security and works cross-functionally throughout the organization to assess and prepare the Company for identification and mitigation of, and if necessary response to, information security risks. Our information security team members collectively have extensive IT, IT security and cloud industry experience, as well as certifications pertaining to information security and privacy (such as such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified Information Privacy Technologist, GIAC Security Essentials and GIAC Information Security Professional certifications).