text: Cyber Incident Response Plan We maintain a cross-functional cyber incident response plan with defined roles and responsibilities and reporting protocols. This plan focuses on responding to, identifying the severity of, and recovering from a breach as well as mitigating any impact to our business. Generally, when a suspected breach is identified, the ITSS team will escalate the issue to the personnel identified in the plan for initial analysis and guidance. In the event of an actual breach, the CISO will prepare an initial assessment and consult with our general counsel (GC) and our Chief Financial Officer (CFO). Together, our GC, CFO and CISO will consult with other executives, including our Chief Executive Officer and our Chief Operating Officer, to determine the incident's impact to our business. This management group (in consultation with outside experts) will be responsible for determining whether a particular incident (alone or in combination with other factors) triggers any public reporting or third-party notification requirements.


text: Regular Evaluation of Initiatives, Results and Priorities The ITSS team, in consultation with members of senior management, updates its strategy at least annually to account for changes in our business strategy, legal and regulatory developments across our geographic footprint, results of recent ITSS initiatives, and developments in the cybersecurity threat landscape. On an annual basis the CISO updates the Audit Committee (generally with all other Board members in attendance) on the performance of cyber risk key performance indicators (KPIs), cyber risks, staffing and key ITSS initiatives. On a quarterly basis the CISO updates the Audit Committee (generally with all other Board members in attendance) on the KPIs and any changes to our cyber risk mitigation efforts, and any cyber breaches that may have occurred. Feedback from the Audit Committee and senior management assists us in determining whether any further changes to our existing policies and practices are warranted. We expect that our cybersecurity risk management processes and strategy will continue to adapt as the cybersecurity threat landscape evolves. We engage third parties to assist us with our cybersecurity risk management and strategy. Some of these third parties provide us with ongoing assistance (such as threat monitoring, mitigation strategies, updates on emerging trends and developments and policy guidance) while others provide targeted assistance (such as security and forensic expertise) as needed.

companyName: MICROCHIP TECHNOLOGY INC

ticker: MCHP

secItem: Item 1C


text: Review of Third Parties There are risks associated with sharing information with third parties, and with allowing third parties to access our systems. Therefore, prior to integrating any third-party provider's information into our systems, we assess their security maturity against our standards, assess business risks associated with integration and request changes as we deem necessary.


text: Consistent with our overall risk management governance structure, management is responsible for the day-to-day management of cybersecurity risk while our Board and its Audit Committee play an active, ongoing oversight role.


text: Our Board has delegated to its Audit Committee specific, first-line responsibility for overseeing major cybersecurity risk exposures in addition to our broader enterprise risk management program. Specifically, under its charter, the Audit Committee is responsible for overseeing and monitoring enterprise risk management, privacy, cybersecurity and data security matters, including the potential impact of those exposures on Microchip's business, financial results, operations and reputation, and the steps management has taken to monitor and mitigate such exposures. The CISO reports at least quarterly to the Audit Committee on information security and data privacy and protection. These presentations address a wide range of topics, including trends in cyber threats and the status of initiatives designed to bolster our security systems. Our full Board is typically in attendance at these presentations made to the Audit Committee. At least annually, the Board meets with members of our senior management team to review and discuss our enterprise risk management program, including areas of material risk and how these risks, which may include cybersecurity risk, are being managed and reported to the Board and its committees.


text: Management's Role Our ITSS team is led by our CISO, who reports to our Executive Vice President and Chief Financial Officer. Our CISO is a former CPA that has 34 years of experience in leading global accounting and business information systems groups including strategy, applications, infrastructure, information security, support, and execution.


text: Digital security at Microchip is the primary responsibility of our ITSS team. Our ITSS team is responsible for infrastructure services and business continuity as it relates to digital information. The ITSS team oversees compliance with our cybersecurity framework within our Company and facilitates cybersecurity risk management activities. The ITSS team also assists with the review and approval of policies, completes benchmarking against applicable standards and oversees the security awareness training program. ITSS works to address and respond to cyber risk, including cyber risks related to security architecture and engineering, identity and access management and security operations. Collectively, ITSS has decades of relevant education and experience and maintain a wide range of industry certifications. We invest in regular, ongoing cybersecurity and architecture training for our team members.


text: As of March 31, 2024, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents that have materially affected Microchip, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "We continue to be the target of attacks on our IT systems. Interruptions in and unauthorized access to our IT systems, and security breaches or incidents impacting our systems or data that we or our service providers maintain or otherwise process, could adversely affect our business", in this Annual Report on Form 10-K.


text: Risk Management and Strategy We define cyber risk governance as a program of measures designed to protect our IT assets and information from unauthorized access, attacks or service disruptions. Our risk governance processes were designed by our IT Shared Services (ITSS) team, which maintains knowledge about the types of high-profile security breaches being reported more frequently across the globe. The secure processing, maintenance, and transmission of sensitive data, including confidential and other proprietary information about our business and our employees, and information belonging to our customers, suppliers, and business partners, is important to our operations and business strategy. As a result, cybersecurity and data protection are key components of our long-term business strategies.


text: We use various processes to inform our assessment, identification and management of risk from cybersecurity threats. Key areas of our cybersecurity risk management processes and strategy currently include:


text: Processes and Coordination We manage cyber security and assess associated risks in these ways: • ITSS, led by our Chief Information Security Officer (CISO), has first-line responsibility for our cybersecurity risk management processes, and works to coordinate efforts, priorities and oversight of cybersecurity risk; • ITSS works with functional groups such as manufacturing, business operations, engineering, human resources, legal, and finance and is responsible for evaluating and assessing overall cybersecurity risk, and advising senior management and the Audit Committee regarding our cybersecurity risk profile and priorities as they evolve • we have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes; and • our Internal Audit group monitors certain IT systems controls that are integrated into our larger Sarbanes-Oxley control environment.


text: Ongoing Evaluation and Assessment of Systems and Processes We take steps to monitor evolving regulatory, industry and legal requirements and best practices relating to cyber risk mitigation, and we employ standards and frameworks that we deem appropriate to address identified risks. In addition to periodic in-depth evaluations of our applicable systems and processes, we monitor our IT systems and processes on an ongoing basis with the goal of identifying and remediating real and potential threats as they arise. We adjust our systems, procedures, and policies as we deem necessary and in response to identified threats and risks. For example, ITSS has implemented improvements to our protective measures that have included, but have not been limited to: endpoint intrusion detection and response software, vulnerability scans, regular patching of vulnerabilities, evaluating and reviewing log monitors, event correlation tools, network segmentation, system audits, data partitioning, privileged account segregation and monitoring, and tabletop exercises.


text: Security Awareness Program to Train and Test Personnel We sponsor a multi-faceted security awareness program that includes regular, mandatory trainings for our personnel on best practices for cyber-hygiene including: multifactor authentication and single sign-on use for cloud applications; ways to identify social engineering techniques, policy and process awareness, periodic phishing simulations and other preparedness testing.


text: Management's Role Our ITSS team is led by our CISO, who reports to our Executive Vice President and Chief Financial Officer. Our CISO is a former CPA that has 35 years of experience in leading global accounting and business information systems groups including strategy, applications, infrastructure, information security, support, and execution.


text: As of March 31, 2025, we have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents that have materially affected Microchip, our business strategy, our results of operations or our financial condition. For a discussion of risks from cybersecurity threats that could be reasonably likely to materially affect us, please see our Risk Factors discussion under the heading, "We continue to be the target of attacks on our IT systems. Interruptions in and unauthorized access to our IT systems, and security breaches or incidents impacting our systems or data that we or our service providers maintain or otherwise process, could adversely affect our business", in this Annual Report on Form 10-K.


text: Sleep Number uses a "defense in depth" approach for its cybersecurity risk management program leveraging the National Institute of Standards and Technology (NIST) framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond and recover. The Company regularly assesses the threat landscape for cybersecurity risks, with a strategy based on prevention, detection and mitigation. The Company's information technology (IT) security team--led by the VP of Information Security and Architecture and Chief Information Officer--reviews cybersecurity risks on an ongoing basis. IT security team members who support its information security program have relevant educational and industry experience. The VP of Information Security and Architecture, and their team, provide regular reports to senior management, the Audit Committee, and other relevant teams on various cybersecurity threats, assessments and findings. The IT Security team has established policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats, which are also identified and assessed through the Company's overall risk management program, including quarterly assessments of IT systems, cybersecurity and related risks.

companyName: Sleep Number Corp

ticker: SNBR


text: The Company maintains controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Audit Committee in a timely manner.


text: The Company assesses cybersecurity risks on an ongoing basis, including assessing and deploying technical safeguards designed to protect its information systems from cybersecurity threats. The Company has established comprehensive incident response and recovery plans, regularly tests and evaluates the effectiveness of those plans, and maintains cybersecurity risk insurance.


text: The Company implements processes to identify, prioritize, assess, mitigate and remediate risks associated with third-party service providers. It conducts security assessments of critical third-party providers before engagement and maintains ongoing monitoring to ensure compliance with the Company's cybersecurity standards. The monitoring includes ongoing assessments by the IT security team. This approach is designed to mitigate risks related to data breaches or other security incidents originating from third parties. The Company also contractually requires the key third parties it engages to implement security programs commensurate with their risk.


text: The Company regularly reminds its team members and contractors of the importance of handling and protecting customer and employee data. The Company provides all its team members with dedicated cybersecurity awareness training annually and, conducts monthly phishing simulation testing and other cybersecurity awareness campaigns (e.g., intranet articles, cybersecurity awareness month).


text: The Company engages with a range of external experts, including cybersecurity assessors, consultants, auditors, and legal counsel, in evaluating and testing its cybersecurity risk management systems. This enables the Company to leverage specialized knowledge, experience and insights, to help ensure its cybersecurity strategies and processes remain current.


text: • The Company has cybersecurity operations and engineering capabilities that provide comprehensive monitoring to detect and respond to cyber threats and alerts and execute cyber incident response playbooks. This includes a vulnerability management program which identifies and drives remediation of risks. The Company employs a wide array of industry-leading security platforms and tools. • The Company has retained data security and data privacy legal counsel whose practices focus on data breach response, information security compliance, and compliance with the data privacy laws in the various jurisdictions in which the Company operates. • In addition, the Company engages specialized consultants and third-party managed service providers on a project-specific basis to assist it with projects that will improve the Company's IT infrastructure, strengthen its security posture and cyber incident investigations, and improve its cyber readiness.


text: Management's Role The Chief Information Officer (CIO) has primary operational responsibility for the Company's cybersecurity function. The CIO has served in various roles in information technology and information security for over 28 years with nine years' experience specifically in cybersecurity. The CIO, together with the Vice President of Information Security and Architecture – who has 20 years of cybersecurity experience and has maintained a Certified Information Systems Security Professional (CISSP) certification since 2008 – and the Chief Legal and Risk Officer have primary responsibility for assessing and managing material cybersecurity risks. This group, and their supporting teams, meets quarterly to review security performance metrics, identify security risks, and assess the status of approved security enhancements. This group also considers and makes recommendations on security policies and procedures, security service requirements, and risk mitigation strategies.


text: At the Board level, the Audit Committee is formally tasked with assisting the full Board in overseeing information security systems, including cybersecurity, and reporting to the Board with respect to significant and material developments or proposed changes to the Company's cybersecurity framework. The Audit Committee receives regular reports from the CIO and the Vice President of Information Security and Architecture about the prevention, detection, mitigation, and remediation of cybersecurity incidents, including material security risks and information security threats and risks. The Audit Committee also receives regular updates from management on cybersecurity risk resulting from risk assessments, progress of risk reduction initiatives, and relevant internal and industry cybersecurity incidents and emerging threats.


text: The Company has not experienced any material security incidents or data breaches as a result of a compromise of its information systems and is not aware of any cybersecurity incidents that have had a material impact, or are reasonably likely to materially effect, on its business strategy, operating results, or financial condition.


text: Risk Management and Strategy Starbucks has implemented a cybersecurity program that leverages industry-standard cybersecurity frameworks to assess, identify, and manage cybersecurity risk. Our cybersecurity program is integrated with the Enterprise Risk Management ("ERM") framework and governance processes utilized by management and our Board to oversee our various top enterprise risks. Our internal audit function periodically evaluates our cybersecurity program and selected aspects of it.

companyName: STARBUCKS CORP

ticker: SBUX


text: We have implemented various processes and tools to identify cybersecurity threats, detect potential attacks, and protect our data and information technology. We periodically evaluate evolving cybersecurity risks and legal and compliance requirements, and we make ongoing strategic investments to address those evolving risks and requirements.


text: Starbucks assesses, measures, and reports on cybersecurity risk at operational, program or management, and strategic or executive oversight levels. We maintain and periodically update written cybersecurity policies, standards, and controls, which are reviewed by a cross-functional management-level committee and designed to align with business objectives, regulatory requirements, and industry best practices. We train our employees through annual cybersecurity awareness training, phishing simulations, and periodic communications about timely cybersecurity topics and threats. We also implement a variety of tools to monitor our systems and network activity, and we conduct various simulated attacks and penetration tests to assess the effectiveness of these tools.


text: We maintain an incident response plan that guides us in identifying, evaluating, responding to, and recovering from cybersecurity incidents. The plan provides for the creation of a cross-functional, tailored incident response team, led by dedicated incident responders, that may include both Company personnel and third-party service providers, as appropriate. The incident response plan includes incident classification and escalation protocols, as well as processes to assess and comply with applicable legal obligations. We periodically test the effectiveness of the plan, and review and update it as appropriate.


text: We also maintain insurance coverage that, subject to its terms and conditions, is intended to help us mitigate certain costs associated with cybersecurity incidents.


text: We engage third-party security experts, as appropriate, to support our processes for assessing, identifying, and managing cybersecurity risks, including, for example, periodic evaluations of our cybersecurity program from a design and effectiveness perspective, penetration testing, vulnerability scanning, employee awareness training, phishing simulations, and incident monitoring and response.


text: To address cybersecurity risk arising from our relationships with our third-party business partners and service providers, we maintain a third-party risk management program, which takes a risk-based approach and includes elements such as conducting cybersecurity assessments, including cybersecurity-related obligations in agreements, and utilizing external monitoring sources.


text: In addition, we maintain a global privacy program to identify, assess, and manage privacy risks related to how we are collecting, using, sharing, storing, and otherwise processing personal data.


text: As of the date of this filing, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that we, or our third-party business partners or service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Risks Related to Cybersecurity and Data Privacy" in our Risk Factors in Item 1A of this Form 10-K.


text: Our cybersecurity program is led by our senior vice president, chief information security officer ("ciso"), who is responsible for identifying, assessing, and managing our collective information security and technology risks. Our ciso has more than 20 years of experience in the information security and technology fields. The ciso reports to our executive vice president, chief technology officer, who has spent more than 25 years of service in various leadership roles in information technology across multiple Fortune 500 companies.


text: The ciso is informed about the prevention, detection, mitigation, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity program described above, including through reports prepared by our internal cybersecurity team and the operation of our incident response plan. The ciso meets regularly with leaders of our various information technology management teams and with the Risk Management Committee (a management-level committee, which is co-managed by our cfo and chief legal officer), to review and discuss our cybersecurity and other information technology risks and opportunities.


text: Our Board has ultimate cybersecurity and data privacy risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from the Audit and Compliance Committee ("Audit Committee") and the Environmental, Partner, and Community Impact Committee (the "Impact Committee"). The Audit Committee oversees our cybersecurity and technology risks, and the Impact Committee oversees our data privacy risks, all of which are integrated into our overall ERM program. The Audit Committee actively reviews and discusses our cybersecurity and technology risk management programs and regularly reports out to the full Board on our relevant strengths and opportunities. The Impact Committee reviews our data privacy risk management programs and reports out to the full Board on our relevant strengths and opportunities.


text: The Audit Committee receives quarterly updates from the ciso or other members of the ciso's team with responsibility for oversight of our key cybersecurity program components. These updates include, as appropriate, ongoing changes in our external and internal cybersecurity threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cybersecurity and technology-related risks, cybersecurity incidents and our response to them, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness. The Impact Committee receives annual updates from our vice president, data privacy, on our data privacy practices, emerging risks, and evolving global privacy laws and regulations.


text: Risk Management and Strategy Starbucks has implemented a cybersecurity program that leverages industry-standard cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework, to assess, identify, and manage cybersecurity risk. Our cybersecurity program is integrated with the Enterprise Risk Management ("ERM") framework and governance processes utilized by management and our Board to oversee our various top enterprise risks. Our internal audit function periodically evaluates our cybersecurity program and selected aspects of it.


text: We have implemented various processes and tools to identify cybersecurity threats, detect potential attacks, and protect our data and information technology. We periodically evaluate evolving cybersecurity risks and legal and compliance requirements, and we make ongoing strategic investments to address those evolving risks and requirements. We also participate in multiple cybersecurity forums that share threat intelligence and best practices.


text: Starbucks assesses, measures, and reports on cybersecurity risk at operational, program or management, and strategic or executive oversight levels. We maintain and periodically update written cybersecurity policies, standards, and controls, which are reviewed by a cross-functional management-level committee and designed to align with business objectives, regulatory requirements, and industry best practices. We train our employees through annual cybersecurity awareness training, which includes information about how to report cybersecurity concerns and incidents, as well as phishing simulations and periodic communications about timely cybersecurity topics and threats. We also implement a variety of tools to monitor our systems and network activity, and we conduct various simulated attacks and penetration tests to assess the effectiveness of these tools.


text: We maintain an incident response plan that guides us in identifying, evaluating, responding to, and recovering from cybersecurity incidents. The plan provides for the creation of a cross-functional, tailored incident response team, led by dedicated incident responders, that may include both Company personnel and third-party service providers, as appropriate. The incident response plan includes incident classification and escalation protocols, including a process for informing senior management and the Board, as appropriate, as well as processes to assess and comply with applicable legal obligations. We periodically test the effectiveness of the plan, and review and update it, as appropriate.


text: As of the date of this filing, we have not identified any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, there can be no assurance that we, or our third-party business partners or service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect our business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under "Risks Related to Cybersecurity, Data Privacy, and Information Technology" in our Risk Factors in Item 1A of this Form 10-K.


text: Our cybersecurity program is led by our senior vice president, chief information security officer ("ciso"), who is responsible for identifying, assessing, and managing our collective information security and technology risks. Our ciso has more than 20 years of experience in the information security and technology fields, including various leadership roles in several large companies across multiple industries. Those roles have included leading various cybersecurity capabilities and managing information security, business intelligence, and data analytics teams.


text: The ciso is informed about the prevention, detection, mitigation, and remediation of cybersecurity incidents through management of, and participation in, the cybersecurity program described above, including through reports prepared by our internal cybersecurity team and the operation of our incident response plan. The ciso meets regularly with leaders of our various information technology management teams and with the Risk Management Committee (a cross-functional management-level committee, which is co-managed by our cfo and chief legal officer and meets at least quarterly), to review and discuss our cybersecurity and other information technology risks and opportunities.


text: Our Board has ultimate cybersecurity and data privacy risk oversight responsibility for the Company and administers this responsibility both directly and with assistance from the Audit and Compliance Committee ("Audit Committee"). The Audit Committee oversees our cybersecurity and technology risks, along with our data privacy risks, all of which are integrated into our overall ERM program. The Audit Committee actively reviews and discusses our cybersecurity and technology risk management programs and regularly reports out to the full Board on our relevant strengths and opportunities. The Audit Committee also reviews our data privacy risk management programs and reports out to the full Board on our relevant strengths and opportunities.


text: The Audit Committee receives quarterly updates from the ciso or other members of the ciso's team with responsibility for oversight of our key cybersecurity program components. These updates include, as appropriate, ongoing changes in our external and internal cybersecurity threat landscape, new technology trends and regulatory developments, evolving internal policies and practices used to manage and mitigate cybersecurity and technology-related risks, cybersecurity incidents and our response to them, and trends in various metrics that are used to help assess our overall cybersecurity program effectiveness.


text: Risk Management and Strategy We maintain a cyber risk management program designed to assess, identify, manage, mitigate and respond to cybersecurity threats and incidents. We seek to address material risks from cybersecurity threats through a cross-functional approach, and we utilize various processes to inform our identification, assessment and management of material risks from cybersecurity threats. Our cyber risk management program is integrated into our overall enterprise risk management (ERM) program. Cybersecurity risks are identified and assessed through our ERM program, which is designed to provide cross-functional executive insight across the business to identify and monitor risks, opportunities and emerging trends that can impact our strategic business objectives. The underlying controls of our cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework.

companyName: FREEPORT-MCMORAN INC

ticker: FCX


text: We utilize dedicated internal and external cybersecurity personnel to focus on assessing, detecting, identifying, managing, preventing and responding to cybersecurity threats and incidents. Our approach to cybersecurity incorporates a layered portfolio of technology controls, including strategic partnerships for our cybersecurity platforms, documented policies and procedures, end user training and dedicated resources to manage and monitor the evolving threat landscape, including through the gathering of actionable threat intelligence. We maintain and periodically evaluate and, as needed, update our information security policy and an incident response plan, which describes the processes we use to prepare for, detect, respond to and recover from a cybersecurity incident, including processes to assess severity, escalate, contain, investigate and remediate an incident, as well as to comply with potentially applicable legal obligations.


text: We regularly evaluate and assess the threat landscape and our security controls, including through audits and assessments, regular network and endpoint monitoring, vulnerability testing, penetration testing and tabletop exercises that include senior management. To assess the design and effectiveness of our cybersecurity controls, we engage with assessors, consultants, auditors and other third parties, including through independent third-party reviews of our information technology security program conducted on at least an annual basis. We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers, including performing diligence on certain third parties that have access to our systems, data or facilities that store such systems or data, continually monitoring cybersecurity threat risks identified through such diligence and contracting to manage cybersecurity risks in specified ways such as agreements to be subject to periodic cybersecurity audits.


text: We have experienced targeted and non-targeted cybersecurity incidents in the past, including an incident in August 2023 that affected certain of our information systems and resulted in temporary disruptions to parts of our operations. However, prior cybersecurity incidents, including the August 2023 incident, have not materially affected us. Notwithstanding our cyber risk management program, we may not be successful in preventing or mitigating a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition. Refer to Item 1A. "Risk Factors" for further information on the risks we face from cybersecurity threats.


text: Our cybersecurity risk management and strategy processes are led by our Chief Information Officer (CIO) and our Chief Information Security Officer (CISO). Our CIO and CISO are responsible for assessing and managing our material risks from cybersecurity threats and are informed about and oversee the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of, and participation in, our cybersecurity risk management and strategy processes described in "Risk Management and Strategy" above. These individuals collectively have over 55 years of prior work experience in various roles involving managing information and operational technology security, cybersecurity and operational technology risk management, developing cybersecurity strategy, implementing effective information technology and cybersecurity processes and procedures, and experience in managing regulatory compliance, as well as several relevant degrees and certifications, including one individual with the Certified Information Systems Security Professional certification.


text: Our ERM management committee is responsible for providing input and oversight on our ERM program, including cybersecurity risks. Our ERM management committee is comprised of senior leaders, including our CIO, with responsibility across operations and core business functions, and with a breadth of knowledge, influence and experience covering the risks we face. An annual report on our enterprise risks, including cybersecurity risks, is presented to the Audit Committee and/or the full Board of Directors (Board).


text: While management is responsible for the day-to-day management of cybersecurity risks, our Board and Audit Committee have ongoing oversight roles. Our Audit Committee has responsibility for, among other things, oversight of our information technology and cybersecurity processes and procedures, including oversight of risks from cybersecurity threats. The Audit Committee reviews and discusses with management, including reports from our CIO, at least annually: • the adequacy and effectiveness of our information technology security processes and procedures, • the assessment of risks and threats to our information technology systems, • the internal controls regarding information technology security and cybersecurity, and • the steps management has taken to monitor and mitigate information technology security and cybersecurity risks.


text: The Audit Committee also periodically receives reports on notable cybersecurity incidents. The Audit Committee periodically briefs the full Board on these matters.


text: We utilize dedicated internal and external cybersecurity personnel to focus on assessing, detecting, identifying, managing, preventing and responding to cybersecurity threats and incidents. Our approach to cybersecurity incorporates a layered portfolio of technology controls, including strategic partnerships for our cybersecurity platforms, documented policies and procedures, periodic end user training, including cybersecurity awareness training for employees and certain contractors, and dedicated resources to manage and monitor the evolving threat landscape, including through the gathering of actionable threat intelligence. We maintain and periodically evaluate and, as needed, update our information security policy and an incident response plan, which describes the processes we use to prepare for, detect, respond to and recover from a cybersecurity incident, including processes to assess severity, escalate, contain, investigate and remediate an incident, as well as to comply with potentially applicable legal and disclosure obligations.


text: We regularly evaluate and assess the threat landscape and our security controls, including through audits and assessments, regular network and endpoint monitoring, vulnerability testing, penetration testing and tabletop exercises that include senior management. To assess the design and effectiveness of our cybersecurity controls, we engage with assessors, consultants, auditors and other third parties, including through independent third-party reviews of our information technology security program conducted on at least an annual basis. We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers, including utilizing safeguards to protect sensitive data, performing diligence on certain third parties that have access to our systems, data or facilities that store such systems or data, continually monitoring cybersecurity threat risks identified through such diligence and contracting to manage cybersecurity risks in specified ways such as requiring agreements to be subject to periodic cybersecurity audits.


text: Our Senior Vice President and Chief Innovation Officer, who has served in various senior leadership roles in operational improvement and technology during his nearly 30-year tenure with us, leads our innovation and technology initiatives, corporate information systems and financial shared services. Our cybersecurity risk management and strategy processes described in "Risk Management and Strategy" above are led by our Chief Information Officer (CIO) and our Chief Information Security Officer (CISO). Our CIO and CISO each report to our Chief Innovation Officer. Our CIO is responsible for the strategy, deployment, operational effectiveness and risk management of our technology systems and operations. Our CIO has over 30 years of experience in technology, cybersecurity and risk management, including leading information and technology initiatives for companies in the mining and energy sectors as a partner and senior managing director at a global professional services public company specializing in information technology services and management consulting. Our CISO is responsible for protecting our global technology systems from cybersecurity incidents, which includes overseeing the deployment of cybersecurity controls, managing a team of cybersecurity professionals and reporting on cybersecurity matters to management and the Audit Committee of our Board. Our CISO has 30 years of experience in the technology and cybersecurity industries, including 15 years serving as CISO for public companies. Our CISO is also a Certified Information Systems Security Professional.


text: Our ERM management committee is responsible for providing input and oversight on our ERM program, including cybersecurity risks. Our ERM management committee is comprised of senior leaders, including our Chief Innovation Officer, with responsibility across operations and core business functions, and with a breadth of knowledge, influence and experience covering the risks we face. An annual report on our enterprise risks, including cybersecurity risks, is presented to the Audit Committee and/or the full Board of Directors (Board).


text: While management is responsible for the day-to-day management of cybersecurity risks, our Board and its Audit Committee have ongoing oversight roles. The Audit Committee reviews and discusses with management, including reports from our Chief Innovation Officer, at least annually: • the adequacy and effectiveness of our information technology security processes and procedures, • the assessment of risks and threats to our information technology systems, • the internal controls regarding information technology security and cybersecurity, and • the steps management has taken to monitor and mitigate information technology security and cybersecurity risks. The Audit Committee also periodically receives reports on notable cybersecurity incidents and briefs the full Board on these matters.


text: Risk management and strategy We have in place certain infrastructure, systems, policies, and procedures that are designed to proactively and reactively address circumstances that arise when unexpected events such as a cybersecurity incident occur. These include processes for assessing, identifying, managing, and reporting material risks from cybersecurity threats and incidents. Our information security management program generally follows processes outlined in frameworks such as the National Institute of Standards and Technology Cyber Security Framework and ISO 27001 international standard for Information Security. Due to the nature and location of the work that we perform, we are often required to obtain certifications required by our clients and regulators. We evaluate and evolve our security measures as appropriate. We consult with external parties, such as cybersecurity firms and risk management and governance experts, on risk management and strategy.

companyName: TETRA TECH INC

ticker: TTEK


text: Identifying, assessing, and managing cybersecurity risk is integrated into our overall risk management program which includes cybersecurity and data privacy training and policies and procedures designed to (a) respond to new requirements in global privacy and cybersecurity laws and (b) prevent, detect, respond to, mitigate and recover from identified and significant cybersecurity threats.


text: We also have a vendor risk assessment process consisting of, depending on the nature and sensitivity of the supplier and data they process on our behalf, the distribution and review of supplier questionnaires designed to help us evaluate cybersecurity risks that we may encounter when working with third parties that have access to confidential and other sensitive company information. We routinely assess our high-risk suppliers' conformance to industry cybersecurity standards and evaluate them for additional information as circumstances change. Refer to Item 1A. "Risk Factors" in this annual report on Form 10-K for additional information about cybersecurity-related risks.


text: The Board of Directors reviews the adequacy and effectiveness of the Company's information security policies and practices and the internal controls regarding information security risks and is informed immediately of any material cybersecurity incident or threat. Additionally, our Board of Directors receives regular updates on important information security matters from our Chief Information Officer and our Head of our Risk Management Program.


text: Management oversight of information security matters, including managing and assessing risks from cybersecurity threats fall under the oversight of our Executive Management Team which includes representation of senior leadership from Operations, Legal and Risk Management, Finance and Administration. The Executive Management Team receives regular security updates from our Chief Information Officer. Our Executive Management team participates in cybersecurity incident response efforts by engaging with the incident response team and helping direct our response to and assessment of certain cybersecurity incidents and subsequent reporting and disclosure requirements.


text: We have designated our Chief Information Officer who reports to our Chief Executive Officer and Chairman of the Board to manage the assessment and response to material risks from cybersecurity threats. Our Chief Information Officer's cybersecurity expertise includes over 18 years of experience in information security and technology.


text: The Company's cybersecurity program is designed to be aligned to the Cybersecurity Framework published by the National Institute of Standards and Technology ("NIST CSF"). While we use the NIST CSF as a guide, this does not imply that we meet any particular standards, specifications or requirements. We conduct regular internal and external assessments of our information security and cybersecurity programs, including periodic external audits for company-wide compliance with our program as well as specific business unit alignment, as required, with U.S. federal acquisition regulations and UK Cyber Essentials certifications. An external penetration test is performed annually against the Company's network, in addition to our regular internal vulnerability scans.

companyName: IDEX CORP /DE/

ticker: IEX


text: The Company's internal Incident Response Policy sets forth specific protocols for cyber or data incident identification, detection, response and recovery. This process includes the assembly of a response team consisting of internal and external technical and legal experts immediately upon the event of a cyberattack or incident. The Company reviews and updates this process regularly, including by engaging in tabletop exercises to simulate cybersecurity and data breach incidents. The Company maintains global cybersecurity insurance coverage that is reviewed annually for adequacy against operations and information systems.


text: The Company has implemented a number of measures to mitigate cybersecurity risk in its operations, including annual cybersecurity awareness training for employees, regular internal phishing exercises, technical security controls, maintenance of certain backup and protective systems, physical and system securities measures, and data security protocols. Once fully integrated, all of our businesses have access to a "cyber risk dashboard" that monitors various risk indicators. The cyber risk dashboard is monitored by our business units. The Company's internal auditors periodically review and audit various processes and controls throughout the organization related to cybersecurity readiness.


text: The Company also has certain processes in place to manage cyber risks associated with third-party service providers which include various technical as well as contractual measures. For more information on cybersecurity risks and how they affect our business, operating results and financial condition, please refer to Item 1A., "Risk Factors – The Company's Business Operations May Be Materially Adversely Affected by Information Systems Interruptions or Intrusion, Including those Arising From Cybersecurity Attacks or Incidents or Violations of Laws Regulating Privacy and Data Security." Based on our analysis at this time, we have not identified any risks from a cybersecurity threat or incident that we believe has or is reasonably likely to materially affect the Company. Governance, Oversight and Leadership.


text: The Board and the Audit Committee oversee management's efforts to address cybersecurity and information security risks. Senior management provides the Board updates on the Company's cybersecurity program at least once a year, including as part of the Company's enterprise risk management assessment, and the Audit Committee reviews the cybersecurity program at least twice a year and on an as-needed basis. Such reviews, among other things, include the results of internal and/or external assessments, a review of cybersecurity governance at the management level, and a review of the Company's cybersecurity program and progress toward various initiatives.


text: The Company also maintains an Executive Cybersecurity Steering Committee (the "Cybersecurity Committee"), made up of key members of senior leadership, to oversee and monitor progress of various cybersecurity initiatives throughout the organization. The Cybersecurity Committee meets quarterly. In addition, the Company asks each business unit to designate an employee as the local Information Security Officer responsible for monitoring the business unit's cyber risk dashboard and coordinating with local leadership to respond to identified risks accordingly. Each local Information Security Officer completes an annual certification process and receives regular updates with respect to the Company's cybersecurity program.


text: The Chief Information Officer ("CIO"), who reports to the Chief Financial Officer, along with members of the corporate and business unit information technology teams, are generally responsible for developing and managing the Company's cybersecurity programs. Our CIO has over 20 years of experience in various information technology and information security roles, and our information security team is comprised of employees with broad knowledge of cybersecurity issues gained through experience and through training and certifications. These individuals, along with other internal and external personnel as needed, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and applicable personnel are informed of known cybersecurity incidents to form the appropriate incident response team and respond accordingly.


text: The Company's internal Incident Response Policy sets forth specific protocols for cyber or data incident detection, response and recovery. This process includes the assembly of a response team consisting of internal and, as required, external technical and legal experts upon the event of a cyberattack or incident. The Company reviews and updates this process regularly, including by engaging in tabletop exercises to simulate cybersecurity and data breach incidents. The Company maintains global cybersecurity insurance coverage that is reviewed annually for adequacy against operations and information systems.


text: The Board of Directors and the Audit Committee oversee management's efforts to address cybersecurity and information security risks. Senior management provides the Board of Directors updates on the Company's cybersecurity program at least once a year, including as part of the Company's enterprise risk management assessment, and the Audit Committee reviews the cybersecurity program at least twice a year and on an as-needed basis. Such reviews, among other things, include the results of internal and/or external assessments, a review of cybersecurity governance at the management level, and a review of the Company's cybersecurity program and progress toward various initiatives.


text: The Chief Information Officer ("CIO"), who reports to the Chief Financial Officer, along with members of the corporate and business unit information technology teams, are generally responsible for developing and managing the Company's cybersecurity programs. Our CIO has over 20 years of experience in various information technology and information security roles, and our information security team is comprised of employees with broad knowledge of cybersecurity issues gained through experience and through training and certifications and includes our Director of Information Security, who has over 20 years of experience leading and managing cybersecurity programs. These individuals, along with other internal and external personnel as needed, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and applicable personnel are informed of known cybersecurity incidents to form the appropriate incident response team and respond accordingly.


text: Protecting our systems and data from cyberthreats is important for ensuring the continuity of operations and maintaining the trust of our customers and stakeholders. Scripps is committed to respecting the privacy of the personal data in its care and complying with applicable privacy-related regulations.

companyName: E.W. SCRIPPS Co

ticker: SSP


text: To date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected our business, our business strategy, our results of operations or financial condition. For further information, see "We will continue to face cybersecurity and similar risks, which could result in the disclosure of confidential information, disruption of operations, damage to our brands and reputation, legal exposure and financial losses" in Item 1A, Risk Factors of this Annual Report. In the event an attack or other intrusion were to be successful, we have a trained response team of internal and external resources that are prepared to respond.


text: Cybersecurity Program Scripps is committed to having a strong cybersecurity program and employs a chief information security officer ("CISO") to oversee the cybersecurity leadership team. The team manages governance, risk and compliance, security operations, and identity and access management. Scripps routinely identifies and considers potential improvements to its cybersecurity program based on the threat landscape. Improvements may include adjustments to staffing or processes or the acquisition of new technology. When such potential improvements are identified, the Company weighs the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.


text: Scripps has implemented certain physical, administrative and technical controls to help secure its enterprise environment and products. Cybersecurity controls include, but are not limited to, the following measures: • Enforce controls that limit access based on job responsibilities and enforcing authentication measures, including strong password policies and multifactor authentication where appropriate. • Conduct exercises to ensure the company is prepared to respond to cyber incidents. • Align the cybersecurity program with NIST cybersecurity framework. • Scan our systems for vulnerabilities that may potentially impact our enterprise or products, categorize them based on severity and where possible, proactively address them to prevent exploitation by threat actors. • Employ a trained incident response team and a managed security service provider to identify and mitigate incidents that bypass our cybersecurity controls to minimize impact to operations.


text: Incident Response Plan The Integrated Incident Response Program is reviewed at least annually to ensure alignment with any changes in notification laws, company structure and operations, service providers and the risk landscape. Most recently, we updated the Cyber Incident Response Plan to include materiality assessments in accordance with the new U.S. Securities and Exchange Commission ("SEC") cybersecurity rules. Tabletop exercises are conducted to assess readiness for plan execution.


text: Any actual or suspected security incident is reported to the CISO. Cybersecurity incidents are evaluated under the Integrated Incident Response Program and flow to the Enterprise Response Team according to clearly defined escalation criteria.


text: Cybersecurity is a key risk included in risk management discussions on the Governance, Risk and Compliance committee that meets quarterly before board meetings. The Board of Directors oversees cybersecurity and technology risks through the Audit Committee, which receives quarterly updates from the CISO. Intermittent updates are provided to the full Board for educational purposes or when special needs arise.


text: Our chief privacy officer oversees an enterprise wide privacy program that includes annual training; a "privacy by design" ethos within development teams; privacy-specific contract reviews; and an enterprise wide privacy platform to manage rights, requests and consent management.


text: We understand the importance of protecting data. Our Privacy Policy defines "personal data" and, among other things, explains its coverage, how personal data is collected and stored, and a user's rights to restrict its usage or opt out. Our privacy policies are updated annually and are conspicuously displayed on all applicable digital properties. For more information, please see the Privacy Policy on our website.


text: Employee Training Programs We launch separate, annual web-based learning modules on cybersecurity, privacy, and various security topics such as phishing, password hygiene and data governance to all employees. The annual security awareness training is reinforced through regular phishing simulations across the enterprise to provide employees with practical exposure to phishing campaigns. Employees who fail phishing simulations must complete additional training.


text: Protecting our systems and data from cyber threats is important for ensuring the continuity of operations and maintaining the trust of our customers and stakeholders. Scripps is committed to the transparent and ethical use of the personal data in its care and complying with applicable privacy-related regulations.


text: Cybersecurity Program Scripps is committed to having a strong cybersecurity program and employs a chief information security officer ("CISO") to oversee the cybersecurity leadership team. The team manages governance, risk and compliance, security operations, and identity and access management. Scripps routinely identifies and considers potential improvements to its cybersecurity program based on the threat landscape. Improvements may include adjustments to staffing, processes or the acquisition of new technology. When such potential improvements are identified, the Company weighs the costs and benefits of such improvements (including against other potential improvements) and, if selected, the improvements are added to a roadmap for possible implementation.


text: Scripps has implemented certain physical, administrative and technical controls to help secure its enterprise environment and products. Cybersecurity controls include, but are not limited to, the following measures: • Enforce controls that limit access based on job responsibilities and enforcing authentication measures, including strong password policies and multifactor authentication where appropriate. • Conduct exercises to ensure the company is prepared to respond to cyber incidents. • Align the cybersecurity program with the National Institute of Standards and Technology cybersecurity framework. • Scan our systems for vulnerabilities that may potentially impact our enterprise or products, categorize them based on severity and where possible, proactively address them to prevent exploitation by threat actors. • Employ a trained incident response team and a managed security service provider to identify and mitigate incidents that bypass our cybersecurity controls to minimize impact to operations.


text: Incident Response Plan The Integrated Incident Response Program is reviewed at least annually to ensure alignment with any changes in notification laws, company structure and operations, service providers and the risk landscape. The Cyber Incident Response Plan includes materiality assessments in accordance with the new U.S. Securities and Exchange Commission ("SEC") cybersecurity rules. This same process is also used to address materiality as it relates to non-cyber events, should they occur. Tabletop exercises are conducted periodically to assess readiness for plan execution.


text: Scripps is committed to data governance and protection. We recognize the importance of safeguarding personal information in today's digital landscape. Our comprehensive Privacy Policy provides a clear definition of "personal data" and outlines where and how the policy applies. The policy details our methods for collecting and storing personal data, explains users' rights and addresses additional privacy-related matters. We maintain transparency by keeping our Privacy Policy updated and making it available across all relevant digital platforms.


text: Employee Training Programs We launch separate, annual web-based learning modules on cybersecurity, privacy and various security topics such as phishing, password hygiene and data governance to all employees. The annual security awareness training is reinforced through regular phishing simulations across the enterprise to provide employees with practical exposure to phishing campaigns. Employees who fail phishing simulations must complete additional training.


text: Risk management and strategy Signet recognizes the importance cybersecurity has to the success of our business. We also recognize the need to continually assess cybersecurity risk and evolve our response in the face of a rapidly and ever-changing environment. Accordingly, we aim to protect our business operations, including customer records and information, against known and evolving cybersecurity threats.

companyName: SIGNET JEWELERS LTD

ticker: SIG


text: Signet manages cybersecurity risk using a cross-functional approach, which is overseen by the Company's Board. The Company's cyber risk management program is designed to anticipate, identify, assess, manage, mitigate, and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management processes and addresses the store and corporate information technology environments, as well as third-party vendors, software, and applications upon which we rely.


text: The underlying controls of the cyber risk management program are based on recognized best practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). Signet conducts periodic assessments against the NIST CSF and reviews key cybersecurity risks, utilizing a third party to perform this assessment of the Company's cyber risk management program. The risk assessments, together with risk-based analysis and judgment, are used to determine security controls to address identified risks. Signet has strategically integrated cybersecurity risk management into the Company's policies and broader enterprise risk management framework to promote a company-wide culture of cybersecurity. Signet considers the following factors, among others, during the process of determining how to address risks and which controls to implement: likelihood and severity of the risk; the impact on the Company, the Company's customers, employees, and shareholders; and if a risk materializes, the feasibility and cost of controls and the impact of controls on operations.


text: Signet has a cybersecurity operations program that monitors its global cybersecurity environment and coordinates the investigation and remediation of cybersecurity alerts. In the event of a cybersecurity incident, the Chief Information Security Officer ("CISO") is equipped with an incident response plan that includes immediate actions designed to mitigate the impact and long-term strategies for remediation and prevention of future incidents. We frequently stage incident response drills to prepare support teams to respond to a significant incident. The Company's information security program includes the following specific controls that are used to some extent: endpoint threat detection and response; identity and access management; privileged access management; logging and monitoring involving the use of security information and event management; multi-factor authentication; firewalls and intrusion detection and prevention; and vulnerability and patch management, as well as policy and technical controls governing the use of AI.


text: Signet partners with leading cybersecurity companies and organizations, leveraging third-party technology and expertise. Signet engages with these partners to provide or operate technical controls and technology systems, monitor, and maintain the performance and effectiveness of products and services deployed in Signet's environment, and conduct vulnerability scans and penetration testing.


text: Signet also maintains a risk-based approach for assessing, identifying, and managing risks from cybersecurity threats associated with third-party service providers, third-party software, third-party applications and other companies with whom we do business (such as our outsourced credit card partners). Signet utilizes industry standard tools to assess the criticality of software, data assets, and operational technology. We conduct security assessments of high-risk third-party service providers before engagement to ensure compliance with our cybersecurity standards, including review of the service providers' System and Organization Controls (SOC) report to assess their cybersecurity controls and risk assessment. This approach is designed to mitigate risks related to data breaches or other security incidents originating from or otherwise due to reliance on third parties.


text: Signet faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows or reputation. Signet does not believe that risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our overall business strategy, results of operations, or financial condition. However, Signet (or third parties on which Signet relies) may not be able to implement security controls fully, continuously and effectively as designed or intended. As described above, the Company utilizes a risk-based approach and judgment to determine the security controls to implement, and it is possible that Signet may not implement appropriate controls if management does not recognize, or underestimates, a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate, but not fully eliminate, risks. Security events, when detected by security tools or third parties, may not always be immediately understood or acted upon by the Company (or by third parties on which Signet relies). See the "Risk Factors" section in Item 1A of this Annual Report on Form 10-K for additional discussion of our cybersecurity risks.


text: Signet's cybersecurity program is run by our CISO, who is the head of the Company's cybersecurity team, and who reports to Signet's Chief Information Officer ("CIO"). The CISO is responsible for assessing and managing Signet's cybersecurity risk management program, regularly informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position with Signet since 2018, was previously CISO at multiple Fortune 500 retail and hospitality organizations, and held senior cybersecurity management roles in the financial services industry. The Signet cybersecurity team supporting the CISO has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Signet. In addition, a cross-functional management committee has been established to assess cybersecurity breaches, should they occur, to determine whether a breach is material and requires disclosure.


text: The Governance and Technology Committee of the Board ("GTC") oversees Signet's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Two of the members of our GTC are technology executives employed at their respective organizations who are highly technology-fluent and well-versed on cyber risks. The CISO and CIO regularly brief the GTC on the effectiveness of Signet's cyber risk management program and risk status. In addition, cybersecurity risks are reviewed by the Board, at least annually, as part of the Company's corporate risk-mapping exercise. In addition to scheduled meetings, the GTC, CISO and CIO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.


text: Signet's cybersecurity program is run by our CISO, who is the head of the Company's cybersecurity team, and who reports to Signet's Chief Information Officer ("CIO"). The CISO is responsible for assessing and managing Signet's cybersecurity risk management program, regularly informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. Our CISO has served in this position with Signet since 2018, was previously CISO at multiple Fortune 500 retail and hospitality organizations and held senior cybersecurity management roles in the financial services industry. The Signet cybersecurity team supporting the CISO has experience selecting, deploying, and operating cybersecurity technologies, initiatives, and processes around the world, and relies on threat intelligence as well as other information obtained from governmental, public, or private sources, including external consultants engaged by Signet. In addition, a cross-functional management committee has been established to assess cybersecurity breaches, should they occur, to determine whether a breach is material and requires disclosure.


text: The Governance and Technology Committee of the Board (" GTC ") oversees Signet's cybersecurity risk exposures and the steps taken by management to monitor and mitigate cybersecurity risks. Two of the members of our GTC are technology executives employed at their respective organizations who are highly technology-fluent and well-versed on cyber risks. The CISO and CIO regularly brief the GTC on the effectiveness of Signet's cyber risk management program and risk status. In addition, cybersecurity risks are reviewed by the Board, at least annually, as part of the Company's corporate risk-mapping exercise. In addition to scheduled meetings, the GTC, CISO and CIO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the Board's oversight is proactive and responsive.


text: Risk Management and Strategy Our ability to conduct our business may be impaired, or our customer and employee personal information may be vulnerable, if our IT resources are compromised, degraded, damaged or fail. Such events may include, but are not limited to: a virus or other harmful circumstance; intentional penetration or disruption of our information technology resources by a third party; natural disaster; hardware or software corruption or failure or telecommunications system failure; service provider error or failure; intentional or unintentional personnel actions (including the failure to follow our security protocols); or lost connectivity to our networked resources. We prioritize cybersecurity and consumer data privacy. Our IT department is responsible for coordinating the protection of our information systems and the data they maintain.

companyName: Meritage Homes CORP

ticker: MTH


text: In order to manage technology risk and secure technology ecosystems, our information security framework is based on the National Institute of Standards and Technology ("NIST") principles, which we execute through our adherence to the Center for Internet Security ("CIS18") control framework. The CIS18 framework provides us the ability to align measurable controls to actions and benchmark against recognized standards. Using these recognized industry standards, we approach cyber risk management utilizing multiple layers of policies and technology to detect, protect against, and respond to cyberattacks. Following our multi-pronged approach to protecting our systems and data, we: • administer monthly mandatory ongoing information security training for all employees throughout the year; • maintain privacy policy, security protocols and internal security controls; • use a zero trust network that verifies the device and user identity while restricting network access to only what is needed; • limit access to network resources to only devices that are owned and administered by the Company; • require multi-factor authentication for all employee user accounts; • maintain application-aware firewalls to limit cyberattack access to data; • use data breach detection software and a cybersecurity operations center that actively monitors our systems; • conduct internal technical cyber incident exercises with the information security team and our third-party cybersecurity service providers; and • conduct an annual independent comprehensive security assessment, including penetration and vulnerability testing along with ransomware simulation, to evaluate the security of our environment and provide us the opportunity to understand and address any deficiencies in our security program.


text: We review all technology third party vendors and technology service providers for the following: access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, incident response procedures, and periodic independent testing of the vendor capabilities. In addition, we review annually the System and Organization Controls ("SOC") Type 1 and SOC Type 2 reports of all of our third-party vendors hosting our data to ensure they conform to those requirements.


text: We also have response and recovery protocols in place to address potential cyberattacks, including a disaster recovery plan and an incident response plan that includes defined incident severities and response matrices. These plans are reviewed and updated at least annually and we maintain third-party cybersecurity insurance. We did not have any material cybersecurity incidents during the fiscal years covered by this report. For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A - " Risk Factors – Operational Risks – Information technology failures and data security breaches could harm our business" in this Annual Report on Form 10-K.


text: Cybersecurity and affiliated risks related to our information technology are a key component of our Board of Director's ("Board") risk oversight. The Audit Committee assists the Board in evaluating our information and cybersecurity risks and overseeing our efforts to mitigate these risks. Our Audit Committee is also responsible for reviewing and analyzing significant financial and operational risks and how management is managing and mitigating such risks through its internal controls and financial risk management processes and is regularly engaged in discussions with management regarding business risks, operational risks, transactional risks, cybersecurity and financial risks. Our Chief Information Officer provides a formal update to our Audit Committee at least twice per year, reviewing cybersecurity risks, trends, plans for future actions and measurements against recognized external cybersecurity frameworks and benchmarks.


text: Our cybersecurity program is led and managed by experienced technology leadership that drives the creation of our security strategy, policies, and procedures as well as possesses expert knowledge in the execution of the related controls and safeguards. Our Chief Information Officer (CIO) has more than 30 years of experience working in information technology including chief information officer roles in the financial services, banking, healthcare, and hospitality sectors. While in those roles, the CIO has led governance, risk, and compliance technology programs and information security programs. Supporting the CIO is a dedicated cybersecurity team that designs and monitors cybersecurity control framework as well as implements cybersecurity control systems and solutions. This cybersecurity team collectively holds the following degrees and certifications: Master's in Cybersecurity, Certified Information Systems Security Professional, Certified Information Security Manager, Microsoft Certified Cybersecurity Architect Expert, Graduate Certificates in Enterprise Cybersecurity and Data Science, Security+ and Certified Information Systems Auditor.


text: Risk Management and Strategy Our ability to conduct our business may be impaired, or our customer and employee personal information may be vulnerable, if our IT resources are compromised, degraded, damaged or fail. Such events may include, but are not limited to: a virus or other harmful circumstance; intentional penetration or disruption of our information technology resources by a third party; natural disaster; hardware or software corruption or failure or telecommunications system failure; service provider error or failure; intentional or unintentional personnel actions (including the failure to follow our security protocols); or lost connectivity to our networked resources.


text: We prioritize cybersecurity and data privacy. Our IT department is responsible for coordinating the protection of our information systems and the data they maintain.


text: Cybersecurity is an integral part of the Company's Enterprise Risk Management ("ERM"). In order to manage technology risk and secure technology ecosystems, our information security framework is based on the National Institute of Standards and Technology ("NIST") principles, which we execute through our adherence to the Center for Internet Security ("CIS18") control framework. The CIS18 framework provides us the ability to align measurable controls to actions and benchmark against recognized standards. Using these recognized industry standards, we approach cyber risk management utilizing multiple layers of policies and technology to detect, protect against, and respond to cyberattacks. Following our multi-pronged approach to protecting our systems and data, we: • administer monthly mandatory ongoing information security training for all employees throughout the year; • maintain security protocols and internal security controls; • maintain a privacy policy that governs our collection, processing, and securing of personal information; • limit collection and storage of information regarding our customers, suppliers and employees; • use a zero trust network that verifies the device and user identity while restricting network access to only what is needed; • limit access to network resources to only devices that are owned and administered by the Company; • require multi-factor authentication for all employee user accounts; • maintain application-aware firewalls to limit cyberattack access to data; • use data breach detection software and a cybersecurity operations center that actively monitors our systems; • conduct internal technical cyber incident exercises with our information security team and our third-party cybersecurity service providers; and • conduct an annual independent comprehensive security assessment, including penetration and vulnerability testing along with ransomware simulation, to evaluate the security of our environment and provide us the opportunity to understand and address identified deficiencies in our security program.


text: We review all technology third party vendors and service providers for the following: access management controls including physical safeguards, disaster recovery capabilities, data privacy and notification processes, onboarding processes, and incident response procedures. In addition, we perform periodic independent testing of vendor capabilities and review the annual System and Organization Controls ("SOC") Type 1 and/or SOC II Type 2 reports of all of our third-party vendors hosting our data to ensure they conform to those requirements.


text: Our IT department, lead by our Chief Information Officer ("CIO"), maintains and is responsible for our cybersecurity incident response plans. Our cybersecurity incident response plans include processes for evaluating and escalating our response to cybersecurity incidents across our organization, up to and including our senior executive management and Board, and, where required, making public disclosures. Cybersecurity threats and incidents (including potential cybersecurity threats and incidents) are identified through our cybersecurity detection, prevention, and mitigation tools and procedures. These plans are reviewed and updated at least annually and we maintain third-party cybersecur ity insurance. We have not identified any material cybersecurity incidents during the fiscal years covered by this report. For a discussion of how risks from cybersecurity threats affect our business, see Part I, Item 1A - " Risk Factors – Operational Risks – Information technology failures and data security breaches could harm our business" in this Annual Report on Form 10-K.


text: Cybersecurity and data privacy risks related to our information technology resources are a key component of our Board's risk oversight. The Audit Committee assists the Board in evaluating our cybersecurity and data privacy risks and overseeing our efforts to mitigate these risks. Our Audit Committee is also responsible for reviewing and analyzing significant financial and operational risks and how management is managing and mitigating such risks through its internal controls and financial risk management processes and is regularly engaged in discussions with management regarding business risks, operational risks, transactional risks, cybersecurity, enterprise-level and financial risks. Our CIO provides a formal update to our Audit Committee at least twice per year, reviewing cybersecurity risks, trends, plans for future actions and measurements against recognized external cybersecurity frameworks and benchmarks and our Vice President of Internal Audit/Compliance conducts an annual ERM survey, which includes cybersecurity risk, and provides the findings to the Board.


text: Our cybersecurity program is led and managed by experienced technology leadership that drives the creation of our cybersecurity and data privacy strategy, policies, and procedures and consists of experts in the execution of the related controls and safeguards. Our CIO has more than 30 years of experience working in information technology including chief information officer roles in the financial services, banking, healthcare, and hospitality sectors. While in those roles, the CIO has led governance, risk, and compliance technology programs and information security programs. Supporting the CIO is a dedicated cybersecurity team that designs and monitors cybersecurity control framework and data privacy procedures, as well as implements cybersecurity control systems and solutions. This cybersecurity team collectively has experience in: cybersecurity, information systems management and security, and related fields of focus.


text: Cybersecurity Strategy and Risk Management The Company faces a wide variety of cybersecurity threats ranging from uncoordinated individual attempts to gain unauthorized access to information technology ("IT") systems to sophisticated and targeted measures known as advanced persistent threats directed at the Company, its products, its customers, supply chain and/or its third-party service providers, including cloud providers. These threats and incidents originate from many sources globally.

companyName: Johnson Controls International plc

ticker: JCI


text: The Company's cybersecurity policies, standards, and procedures apply to all users, creating awareness of threats and the importance of information security and cybersecurity across the Company's workforce. The policies and standards were created using elements of recognized standards such as ISO 27001 and the NIST Cybersecurity Framework for the overall enterprise and ISA/IEC 62443 for automation and control system products. The Company has implemented cybersecurity policies throughout its operations, including designing and incorporating cybersecurity into the development process for its products and services. The Company's enterprise risk management ("ERM") process considers cybersecurity threat risks alongside other significant risks as part of the Company's overall risk assessment process.


text: The Company leverages multiple channels to promote cybersecurity topics, deliver targeted initial and refresher training for all users, and conduct an annual mandatory global information security training campaign with certification, which is translated into 20 languages, and ongoing awareness campaigns. These elements are designed to maintain a risk aware culture.


text: The Company maintains a 24 x 7 operations center that monitors the Company's IT environment, and coordinates the investigation and remediation of alerts. As cybersecurity events occur, the cybersecurity team focuses on responding to and containing the threat and minimizing impact. In the event of an incident, the cybersecurity team assesses, among other factors, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with participation from technical, legal and law enforcement support, as appropriate.


text: The Company's vulnerability management program conducts assessments with specified frequencies for specific asset types to validate system health against known threats. The Company leverages multiple tools, which are routinely updated with new threat signatures, to continually respond to evolving threats identified as part of its threat detection capability. The Company also maintains a cybersecurity insurance policy.


text: The Company engages with third parties to perform security assessments of its technology environment to perform penetration testing and maturity assessment as well as providing services to support threat analysis and incident detection and response.


text: Cybersecurity considerations affect the selection and oversight of the Company's third-party product and service providers. The Company performs due diligence on third parties that have access to its critical systems and data and whose products and services are integrated into the Company's products. Contractual undertakings and oversight are put in place, based on the results of the risk assessment to manage and reduce the cybersecurity risk associated with such third-party providers. Such undertakings may include requirements to comply with administrative, technical and physical safeguards to provide notification of cyber incidents involving the Company's systems or data and agreements to be subject to cybersecurity audits, which the Company conducts as appropriate. The Company requires compliance with appropriate certifications (e.g., SOC 2, ISO 27001, etc.) depending on the offering, region of use, and other factors.


text: During the weekend of September 23, 2023, the Company experienced a cybersecurity incident impacting its internal IT infrastructure and applications. The incident caused disruptions and limitation of access to portions of the Company's business applications supporting aspects of the Company's operations and corporate functions. The impact of the incident included lost and deferred revenues, primarily attributable to order processing and logistics disruptions and delays, and expenses associated with the response to, and remediation of, the incident. Further, the cybersecurity incident caused disruptions to certain of the Company's billing systems, which negatively impacted cash provided from continuing operations primarily during the first quarter of fiscal 2024. The overall impact of the cybersecurity incident did not have a material impact on net income, net of insurance recoveries, or cash flows from operations for the full year fiscal 2024.


text: Cybersecurity Governance The Company's Board of Directors (the "Board") has oversight of the management of the most significant risks facing the Company, including cybersecurity. The Board receives information technology and cybersecurity updates from senior management, including the Chief Information Officer, Chief Information Security Officer ("CISO") and Chief Technology Officer, several times per year. These updates cover the cybersecurity risks facing the Company's enterprise information technology environment, as well as the Company's digital products and services. Regular oversight of cybersecurity matters is further delegated by the Board to the Governance and Sustainability Committee. The Governance and Sustainability Committee provides a deeper level of oversight through quarterly engagements with senior management, including the Chief Information Officer and CISO, to review the Company's cybersecurity program, including the highest risk areas and key mitigation strategies.


text: The Company maintains a Cybersecurity Steering Committee ("CSC") designed to ensure effective governance of risks associated with the Company's use of information and technology assets and demonstrate effective governance of cybersecurity risk. The CSC is chaired by the CISO, and includes the Company's Chief Financial Officer, General Counsel, Chief Information Officer, and other senior representatives from the Company's business segments and functions. The CSC meets quarterly to monitor the current risk landscape and active risk reduction efforts. Through this review and monitoring activity, the CSC oversees effective governance of IT Risk Management in the Enterprise IT Portfolio, drives accountability and transparency of control effectiveness, and facilitates risk remediation and mitigation in a coordinated and comprehensive manner.


text: The CISO is appointed by the Chief Information Officer and is responsible for cybersecurity risk management across the Company. The CISO leads a global enterprise security team responsible for enterprise-wide security strategy, architecture, engineering, and operations. The Cybersecurity Steering Committee has granted authority to the CISO to pause or stop business processes during the execution of cybersecurity incident response duties if they deem it necessary. The CSC maintains approval authority for the Company's Enterprise Information Security Policy. The CISO has over 20 years of technology experience including cybersecurity, infrastructure, architecture, and data and analytics in highly regulated industries including healthcare and aviation and defense. The CISO has an undergraduate degree in Computer Information Systems.


text: The Company's cybersecurity policies, standards, and procedures apply to all users, creating awareness of threats and the importance of information security and cybersecurity across the Company's workforce. These policies and standards are reviewed annually to reflect emerging threats and evolving industry practices, including elements of recognized standards such as ISO 27001 and the NIST Cybersecurity Framework for the overall enterprise and ISA/IEC 62443 for automation and control system products. The Company has implemented cybersecurity policies throughout its operations, including designing and incorporating cybersecurity into the development process for its products and services. The Company's enterprise risk management ("ERM") process considers cybersecurity threat risks alongside other significant risks as part of the Company's overall risk assessment process.


text: The Company maintains a 24 x 7 operations center that monitors the Company's IT environment and coordinates the investigation and remediation of alerts. As cybersecurity events occur, the cybersecurity team focuses on responding to and containing the threat and minimizing impact. In the event of an incident, the cybersecurity team assesses, among other factors, supply chain and manufacturing disruption, data and personal information loss, business operations disruption, projected cost and potential for reputational harm, with participation from technical, legal and law enforcement support, as appropriate.


text: The Company engages with third parties to perform security assessments of its technology environment, including penetration testing and maturity assessments, in addition to providing services to support threat analysis and incident detection and response.


text: Cybersecurity considerations affect the selection and oversight of the Company's third-party product and service providers. The Company performs due diligence on third parties that have access to its critical systems and data and whose products and services are integrated into the Company's products. Contractual undertakings and oversight are put in place, based on the results of the risk assessment to manage and reduce the cybersecurity risk associated with such third-party providers. Such undertakings may include requirements to comply with administrative, technical and physical safeguards to provide notification of cyber incidents involving the Company's systems or data and agreements to be subject to cybersecurity audits, which the Company conducts as appropriate. The Company requires compliance with appropriate certifications (e.g., SOC 2, ISO 27001, etc.) or appropriate alternative requirements, depending on the offering, region of use, and other factors.


text: The Company's results of operations, and financial condition were adversely affected by its previously disclosed September 2023 cybersecurity incident due to lost and deferred revenues, remediation expenses and billing and cash collection. However, the overall impact of the cybersecurity incident did not have a material impact on net income, net of insurance recoveries, or cash flows from operations for fiscal year 2024. The Company is regularly subject to cybersecurity threats. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats.


text: Cybersecurity Governance The Company's Board of Directors (the "Board") has oversight of the management of the most significant risks facing the Company, including cybersecurity. The Board receives information technology and cybersecurity updates from senior management, including the Chief Digital and Information Officer ("CDIO") and Chief Information Security Officer ("CISO") several times per year. These updates cover the cybersecurity risks facing the Company's enterprise information technology environment, as well as the Company's digital products and services. Regular oversight of cybersecurity matters is further delegated by the Board to the Governance and Sustainability Committee. The Governance and Sustainability Committee provides a deeper level of oversight through quarterly engagements with senior management, including the Chief Digital and Information Officer and CISO, to review the Company's cybersecurity program, including the highest risk areas and key mitigation strategies.


text: The Company maintains a Cybersecurity Steering Committee ("CSC") designed to ensure effective governance of risks associated with the Company's use of information and technology assets and demonstrate effective governance of cybersecurity risk. The CSC is chaired by the CISO, and includes the Company's Chief Financial Officer, General Counsel, CDIO, and other senior representatives from the Company's business segments and functions. The CSC meets quarterly to monitor the current risk landscape and active risk reduction efforts. Through this review and monitoring activity, the CSC oversees effective governance of IT Risk Management in the Enterprise IT Portfolio, drives accountability and transparency of control effectiveness, and facilitates risk remediation and mitigation in a coordinated and comprehensive manner.


text: The CISO has been appointed by the Chief Digital and Information Officer and is responsible for cybersecurity risk management across the Company. The CISO leads a global enterprise security team responsible for enterprise-wide security strategy, architecture, engineering, and operations. The CSC has granted authority to the CISO to pause or stop business processes during the execution of cybersecurity incident response duties if they deem it necessary. The CSC maintains approval authority for the Company's Enterprise Information Security Policy.


text: The CISO has over 20 years of technology experience including cybersecurity, infrastructure, architecture, and data and analytics in highly regulated industries including healthcare and aviation and defense. The CISO has an undergraduate degree in Computer Information Systems.


text: Cybersecurity Risk Assessment, Identification and Management We are committed to protecting our information technology ("IT") infrastructure, including computers, systems, corporate networks and sensitive data, from unauthorized access or attack. We have established global IT policies as well as IT security management control procedures designed to assess, identify, and manage material risks from cybersecurity threats by: Creating information security awareness among our employees and business partners and defining responsibilities among them; Implementing controls to identify IT risks and monitor the use of our systems and information resources; Establishing key policies and processes to adequately and timely respond to security threats;

companyName: POWER INTEGRATIONS INC

ticker: POWI