text: In addition, the CIO provides updates to the full Board upon request or to update the Board of unique developments, such as regulatory updates or unique vulnerability developments. Our Board is composed of members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Managing Material Risks & Integrated Overall Risk Management Arcosa has strategically integrated cybersecurity risk management into its broader risk management framework to promote a company-wide culture of cyber risk awareness. Arcosa's Chief Information Security Officer ("CISO") and Senior Director of Information Security work closely with the IT department to continuously evaluate and address cybersecurity risks in alignment with business objectives, operational needs, and industry-accepted standards, such as the CIS Critical Security Controls and National Institute of Standards and Technology ("NIST") frameworks.

companyName: Arcosa, Inc.

ticker: ACA

secItem: Item 1C


text: The Company has processes and procedures in place to monitor the prevention, detection, mitigation, and remediation of cybersecurity risks. These include but are not limited to: • Maintaining a defined and practiced incident response plan; • Maintaining cyber insurance coverage; • Employing appropriate incident prevention and detection software, such as antivirus, anti-malware, firewall, endpoint detection, and identity and access management; • Maintaining a defined disaster recovery policy and employing backup/disaster recovery software, where appropriate; • Educating, training, and testing employees on information security practices and identification of potential cybersecurity risks and threats; • Ensuring familiarity and compliance with cybersecurity frameworks where appropriate; and • Reviewing and evaluating new developments in the cyber threat landscape.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity risk, the Company engages with a range of external experts, including cybersecurity consultants, in evaluating, monitoring, and testing Arcosa's cyber management systems and related cyber risks. The Company's collaboration with these third parties includes audits, threat and vulnerability assessments, incident response plan testing, company-wide monitoring of cybersecurity risks, and consultation on security enhancements.


text: Managing Third Party Risk Arcosa recognizes the risks associated with the use of vendors, service providers, and other third parties that provide information system services, process information on its behalf, or have access to its information systems, and Arcosa has processes in place to oversee and manage these risks. In addition to the minimum security and control standards, these processes include other quality control measures, such as utilizing a third-party security scoring system to evaluate the security posture of current and potential parties. Arcosa also maintains ongoing monitoring to support continuous compliance with its cybersecurity standards.


text: Risks from Cybersecurity Incidents Arcosa has not been subject to cybersecurity incidents that have materially affected, or are reasonably likely to materially affect the Company, its operations, or financial standing.


text: Risk Management Personnel Arcosa's cybersecurity risk management program is overseen by management at multiple levels. The CISO and Senior Director of Information Security play key roles in assessing, monitoring, and managing the Company's cybersecurity risks with support of dedicated information technology and security personnel. Both the CISO and Senior Director of Information Security have been in their respective roles at Arcosa for over 6 years. The CISO has over 40 years of leadership positions in the high tech and IT industries. He is experienced in detailed product and solution development as well as business process operations providing an understanding of how cybersecurity considerations intersect the business. The Senior Director of Information Security and Compliance at Arcosa has more than 20 years of experience architecting, designing, and deploying security solutions based on industrial frameworks.


text: Monitor Cybersecurity Incidents The CISO and Senior Director of Information Security are continually informed and updated about the latest developments in cybersecurity, including emerging threats and innovative risk management techniques. They implement and oversee processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the Company is equipped with a defined and practiced incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Board of Director Oversight The Board's Audit Committee is responsible for overseeing the Company's cyber risk. The CISO and other experts, as necessary provide the Audit Committee quarterly updates that encompass a broad range of topics, including but not limited to: • Current and emerging cybersecurity threat landscape; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and learnings from unique cybersecurity events, including those of other companies; • Compliance status and efforts with regulatory requirements and industry standards; and • Benchmarked data on the performance of certain aspects of our cybersecurity program relative to our peers.


text: In addition, the CISO provides updates to the full Board upon request and updates the Board on unique developments, such as regulatory updates or unique vulnerability developments. Our Board is composed of members with diverse expertise including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Cybersecurity Risk Management We maintain a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical information technology systems and information.

companyName: Utz Brands, Inc.

ticker: UTZ


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes as those used in our enterprise risk management. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.


text: Our cybersecurity risk management program includes a Security Incident Response Plan ("SIRP"). Our SIRP provides the Company with the capability of planning, identifying, containing, and tracking cybersecurity incidents experienced by us or our third party service providers. Our SIRP was established to reduce or minimize the impact of cybersecurity incidents on our networks, IT systems, users or business processes. The execution of our SIRP is led by the Chief Information Officer ("CIO") in conjunction with our Security Incident Response Team, comprised of network, system administrators and cybersecurity experts, who, in the event of incident, together perform a damage assessment, deliver impact notifications and implement containment procedures depending upon the incident. In addition, we also engage third parties on an as needed basis to assess our cybersecurity practices and procedures.


text: Our cybersecurity risk management program also includes: • a multi-layered approach to cybersecurity in order to protect our assets; • identification of key risk areas through internal reviews and researching trends; • continuous mitigation in the areas of human behavior, data breaches, remote work, third party vendors, removable media and emerging threats; • performance of multiple assessments both internal and external; • quarterly mandatory security training for employees as well as monthly phishing tests; and • multi-factor authentication.


text: For the fiscal year ended December 31, 2023, we did not experience any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Cybersecurity Governance We are committed to protecting our information technology ("IT") assets and data. This commitment includes the protection of IT assets relevant to our operations, employees, customers and suppliers' data, intellectual property and our products, among others.


text: Our Company Board plays a role in overseeing risks associated with cybersecurity threats. The Audit Committee of the Board has been provided specific responsibility for overseeing the Company's risk management of cybersecurity. The Audit Committee has appointed a member of the Audit Committee to receive certified cybersecurity training so he can provide specialized guidance to the Board and Company.


text: Periodically throughout the year, the CIO briefs the Audit Committee and Board on cybersecurity activities and long-term cybersecurity strategies, as well as general cybersecurity trends that could have a material impact on the Company. At any time, the Company Board members may raise concerns regarding the Company's cybersecurity posture and recommend future changes to controls or procedures.


text: Our Audit Committee is also responsible for the oversight of risks from cybersecurity threats. Our CIO, Chief Financial Officer, and Security Incident Response Team provide regular updates to the Audit Committee of the Company Board on cybersecurity risks. Through these updates, the Audit Committee receives information on the status of key cybersecurity activities such as email phishing, event logging and data encryption, among others. Information regarding relevant cybersecurity training is provided as well.


text: Our CIO leads our management team in assessing and managing our response to cybersecurity threats and incidents. Our CIO has a Bachelor of Technology degree in Computer Science with over 30 years of experience in IT, with over five years managing IT Infrastructure and Security. The primary responsibility of the management team with respect to cybersecurity risk is managing our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants, and working with all divisional, manufacturing, and functional teams on cybersecurity issues. The management team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents are enhanced by monthly and quarterly briefings from internal security personnel, by receipt of threat intelligence and other information obtained from governmental, public or private sources, including external consultants, periodic assessments against the NIST CSF and through alerts and reports produced by security tools deployed in our IT environment. In the event a cybersecurity incident rise to the level of a corporate crisis, the management team along with the Security Incident Response Team would engage the Company Board.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, incident reporting channels and governance processes, as those used in our enterprise risk management program. We designed and continue to assess our cybersecurity program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), which we use as a guide to help us identify, prioritize and manage the cybersecurity risks that could materially affect our business, financial condition or results of operations.


text: Our cybersecurity risk management program also includes: • a multi-layered approach to cybersecurity designed to protect our assets; • identification of key risk areas through internal reviews and researching trends; • ongoing mitigation in the areas of human behavior, data breaches, remote work, third party vendors, removable media and emerging threats; • performance of multiple assessments both internally and externally; • quarterly mandatory security training for employees as well as monthly phishing tests; and • multi-factor authentication.


text: For the fiscal year ended December 29, 2024, we are not aware of any cybersecurity incidents or risks from cybersecurity incidents that have materially affected or were reasonably likely to materially affect our business strategy, results of operations or financial condition. We cannot guarantee that we may not experience any cybersecurity incidents or risks related to cybersecurity incidents in the future.


text: Our Company Board plays a role in overseeing risks associated with cybersecurity threats. The Audit Committee of the Board has been delegated specific responsibility for overseeing the Company's risk management of cybersecurity. The Audit Committee has appointed a member of the Audit Committee to receive certified cybersecurity training so he can provide specialized guidance to the Board and Company.


text: Our CIO leads our management team in assessing and managing our response to cybersecurity threats and incidents. Our CIO has a Bachelor of Technology degree in Computer Science with over 30 years of experience in IT, with over five years managing IT Infrastructure and Security. The primary responsibility of the management team with respect to cybersecurity risk is managing our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants, and working with all divisional, manufacturing, and functional teams on cybersecurity issues. The management team's efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents are enhanced by monthly and quarterly briefings from internal security personnel, by receipt of threat intelligence and other information obtained from governmental, public or private sources, including external consultants, periodic assessments against the NIST CSF and through alerts and reports produced by security tools deployed in our IT environment. In the event a cybersecurity incident meets certain predetermined criteria, the management team along with the Security Incident Response Team would engage the Company Board.


text: We recognize the critical importance of maintaining the trust and confidence of our patients, business partners and employees toward our business and are committed to protecting the confidentiality, integrity and availability of our business operations and systems. Our board of directors is actively involved in oversight of our risk management activities, and cybersecurity represents an important element of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices are based on recognized frameworks established by the National Institute of Standards and Technology, or NIST, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Inhibrx, Inc.


text: Cybersecurity Risk Management and Strategy; Effect of Risk We face risks related to cybersecurity such as unauthorized access, cybersecurity attacks and other security incidents, including as perpetrated by hackers and unintentional damage or disruption to hardware and software systems, loss of data, and misappropriation of confidential information. To identify and assess material risks from cybersecurity threats, we maintain a comprehensive cybersecurity program to ensure our systems are effective and prepared for information security risks, including regular oversight of our programs for security monitoring for internal and external threats to ensure the confidentiality and integrity of our information assets. We consider risks from cybersecurity threats alongside other company risks as part of our overall risk assessment process. We employ a range of tools and services, including regular network and endpoint monitoring, audits, vulnerability assessments, penetration testing, threat modeling and tabletop exercises to inform our risk identification and assessment. As discussed in more detail under "Cybersecurity Governance" below, our audit committee provides oversight of our cybersecurity risk management and strategy processes, which are led by our Chief Financial Officer, General Counsel, and Director of Information Technology.


text: We also identify our cybersecurity threat risks by comparing our processes to standards set by NIST and the International Organization for Standardization, as well as by engaging experts to attempt to infiltrate our information systems. To provide for the availability of critical data and systems, maintain regulatory compliance, manage our material risks from cybersecurity threats, and protect against and respond to cybersecurity incidents, we undertake the following activities: a.monitor emerging data protection laws and implement changes to our processes that are designed to comply with such laws;


text: b.through our policies, practices and contracts (as applicable), require employees, as well as third parties that provide services on our behalf, to treat confidential information and data with care;


text: c.employ technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence;


text: d.provide regular, mandatory training for our employees and contractors regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices;


text: e.conduct regular phishing email simulations for all employees and contractors with access to our email systems to enhance awareness and responsiveness to possible threats; f.conduct annual cybersecurity management and incident training for employees involved in our systems and processes that handle sensitive data;


text: g.run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; and h.carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate damage to our business and reputation.


text: As part of the above processes, we regularly engage with consultants, auditors and other third parties, including annually having an independent third-party review our cybersecurity program to help identify areas for continued focus, improvement and compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including our suppliers and manufacturers or who have access to patient and employee data or our systems. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity breaches could expose us to material liability, damage our reputation, compromise our confidential information or otherwise adversely affect our business," which disclosures are incorporated by reference herein.


text: In the last two fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity Governance; Management Cybersecurity is an important part of our risk management processes and an area of focus for our board of directors and management. The audit committee of our board of directors is responsible for the oversight of risks from cybersecurity threats.


text: At least annually, our audit committee receives an update from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, our audit committee generally receives materials discussing current and emerging material cybersecurity threat risks, and describing our ability to mitigate those risks, as well as recent developments, evolving standards, technological developments and information security considerations arising with respect to our peers and third parties, and discusses such matters with our Director of Information Technology. Our audit committee also receives prompt and timely information regarding any cybersecurity incident that meets establishing reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Financial Officer, General Counsel, and Director of Information Technology. Such individuals have collectively several years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs, as well as relevant degrees and certifications. These management team members are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these management team members report to the audit committee of our board of directors about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Cybersecurity Strategy and Risk Management The Cigna Group's comprehensive cybersecurity program is supported by policies and procedures designed to protect our systems and operations as well as the sensitive personal information and data of our clients and customers from foreseeable cybersecurity threats. This program is an integral component of our enterprise risk management program.

companyName: Cigna Group

ticker: CI


text: Core to our security model is our defense-in-depth framework, comprising multiple layers of processes and technologies that help prevent, detect, and respond to threats. Our approach to safeguarding against external threats incorporates a suite of preventive technologies, including malicious email blocking, defenses against automated attacks and multifactor authentication. These strategies act to proactively intercept and neutralize cyber threats to help ensure data remains secure within our environment. Event monitoring technologies run continuously, detecting suspected intrusion attempts and alerting our Cybersecurity Incident Response team. The Cigna Group undertakes a number of critical security processes to mitigate and protect against cybersecurity risks, which include but are not limited to: • Identity and Access Management. Employees are provided with the minimum amount of access required to perform their jobs using role-based access control methodology, which defines access to our information systems based on job function. Privileged or elevated access to our systems is subject to supplemental approval requirements, increased authentication processes, and additional logging and monitoring. • Security Awareness and Training. Events and education activities are hosted throughout the year, such as the Cybersecurity Awareness Month, expos, videos, training programs and frequent phishing simulations. The Cigna Group continuously trains workforce members on the importance of preserving the confidentiality and integrity of customer data. All new hires have mandatory information protection and privacy training as part of their onboarding, and all workforce members complete an annual cybersecurity refresh training. • Security Operations and Monitoring. Our operational monitoring processes provide valuable insight into the effectiveness of our security program. A centralized system collects security logs and performs event correlation that creates an alert if a trigger occurs. We review any deviations from our established targets and implement corrective actions. • Change Management. Changes to hardware, software, network components, and/or processes introduced into any production environments are managed by a formal change control process. These requests include the submission of required documentation as well as the business justification for the change. • Disaster Recovery / Business Continuity. These processes are designed to maintain service to our customers, providers and members through a wide range of adverse circumstances. Methods of recovery include rerouting business functions, relocating to an alternative site, independent "hot sites", mobile recovery and work at home. • Intelligence Feeds. These are used to monitor the security industry for the latest global security threats, exposures and patches to help keep company servers current with the latest security service packs, patches and hot fixes. • Physical Security. Our physical security system is utilized in an effort to properly identify appropriate individuals, authorize entry and define the working areas to which they have access. Additional controls at our data centers includes a combination of guard service, access keys and magnetic card systems.


text: • Third-Party Vendor Security Reviews. Suppliers that have access to, host, or pass sensitive data are subject to a rigorous vendor security review which includes questionnaires, security controls and maturity assessments, inspection of evidence of compliance and remediation or acceptance of items identified during a Risk Assessment. • Vulnerability Management / Patching. Any discovered vulnerability is rated by severity and assigned a timeline for remediation. Patching activities are centrally managed with a focus on the identification, remediation, and analysis and closure of vulnerabilities throughout the vulnerability management lifecycle. • Cybersecurity Incident Reporting. Our incident reporting protocol assists prompt and efficient response to cybersecurity threats. This includes links on our internal site listing globally accessible contact numbers for immediate incident reporting, a user-friendly phishing reporting tool in Outlook, and group email boxes that are monitored 24/7 for incident submissions.


text: We routinely manage cybersecurity risks through a defined framework that includes activities aimed at the identification, assessment, treatment and monitoring of risks. Cybersecurity risk assessment results are used by senior management to make informed decisions about where to allocate resources to reduce cybersecurity risks and improve overall security posture. We examine our entire program annually with third-parties and measure the program against generally accepted industry standards and frameworks, such as an internationally recognized security control framework established by the NIST and used by companies to assess and improve their ability to prevent, detect and respond to cyberattacks. Our cybersecurity policies and standards are reviewed annually and are mainly guided by the NIST 800-53 Cybersecurity Framework. In addition to the NIST framework, we leverage the International Organization for Standardization ("ISO") 27001 and 27002 standards. NIST and ISO standards are internationally accepted and provide best practice recommendations for initiating, implementing, and maintaining information security management systems. Cigna's Information Protection policies and standards are informed by NIST 800-53b, moderate level security control baseline requirements. This includes a myriad of NIST controls/control enhancements which are mapped to Cigna Information Protection policies, standards and control library.


text: To enhance our preparedness and practice our collective cybersecurity response capabilities, we conduct tabletop exercises developed in partnership with external security experts. These events are designed to exercise and engage some of the most critical areas of cybersecurity incident response and preparedness through an interactive/evolving, simulated scenario. This exercise provides an opportunity for us to test our response procedures, escalation and communication protocols, roles and responsibilities, legal/privacy considerations and key decision-making processes, in a safe and controlled environment. The participants in these exercises include leaders, stakeholders, subject matter experts and certain executives. In addition to these internal measures, the effectiveness of components of our overall cybersecurity program is frequently evaluated by external third parties, exclusive to our independent registered public accounting firm and scope of internal control over financial reporting. This includes work performed over various levels of controls assessments for specific business lines and core processes. These include Health Information Trust Alliance ("HITRUST") for health care data security, Payment Card Industry Data Security Standard (PCI DSS) for payment security, and System Organization Controls (SOC) 2 for information security and related controls. We also perform an annual maturity assessment and benchmark our security controls to identify opportunities to strengthen our cybersecurity program.


text: As part of our Global Threat Management Program, a dedicated Incident Handling Team, comprising both technical and management personnel, determines the severity of a validated cybersecurity event across the enterprise and is responsible for the development and ongoing maintenance of our comprehensive Global Incident Response Plan ("GIRP"). The GIRP is reviewed quarterly at a minimum but may be updated as needed based on lessons learned, changes in key teams or processes, or other circumstances as warranted. Within the GIRP, incident handling procedures dictate actions during each phase, which include communications, actions to be performed, methods of operation and contingencies for unanticipated outcomes. Using industry best practices and continuous improvement principles, we validate strategies, document business recovery plans, and test these procedures enterprise-wide annually. Upon the discovery of an incident, a broad cross-functional Computer Security Incident Response Team is assembled, which may include but is not limited to experts from key business, technology, legal, privacy and finance sectors, to collaboratively assess the impact and materiality in order to execute a comprehensive and informed response. After an incident is contained, a thorough review is performed to determine if any existing detective or preventative controls were bypassed, or if there was a delay in detection or response. This review, which includes members from our internal audit team, drives the implementation of corrective actions to enhance and strengthen the effectiveness of our prevention, detection, and incident response controls, as applicable.


text: Cigna Information Protection ("CIP") maintains a risk register that is used to manage cybersecurity risks associated with its business activities, technology assets, and its interaction with business, Information Technology ("IT"), and security parties; internal and external. Cybersecurity risks are also periodically reviewed by Enterprise Risk Management ("ERM") to ensure appropriate oversight of cybersecurity risk management activities.


text: Suppliers that have access to, host, or transmit The Cigna Group data are contractually required to comply with our Security Policies and Standards. Additionally, suppliers may be subject to periodic security audits or risk assessments, which include security questionnaires, security capabilities and maturity assessments, controls evidence reviews, application vulnerability assessments, public internet presence monitoring, and alignment reviews with service-specific industry standards (e.g., NIST, ISO, HIPAA, and Payment Card Industry standards). Follow-up activities are performed as needed to discuss observations, track issues and ensure remediation plans are completed to maintain compliance. Contracts with suppliers also include critical security requirements including right to audit, technology requirements, key performance metrics and service levels, and hiring practices including background checks for those who have access to The Cigna Group's network.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Part 1, Item 1A. "Risk Factors – Strategic and Operational Risks – As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents. If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages," the sophistication of cybersecurity threats continues to increase, and the preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may become insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all attacks of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance The Cigna Group's Board has ultimate oversight over the Company's privacy and cybersecurity programs and strategy and is responsible for ensuring that the Company has risk management policies and processes in place to meet and mitigate evolving risks and threats. Certain members of the Board have cybersecurity expertise, including certifications. The Board executes this oversight directly and through both the Audit Committee, for cybersecurity purposes, and the Compliance Committee, for privacy purposes. In these capacities, these committees are regularly briefed by the Global Chief Information Security Officer ("GCISO") and Chief Privacy Officer on cybersecurity and privacy matters. These briefings are designed to provide visibility about the identification, assessment, and management of critical risks, audit findings, and management's risk mitigation strategies. Additionally, these briefings include information about current trends in the environment, incident preparedness, artificial intelligence and various components of the Company's cybersecurity and privacy programs. Annually, the full Board reviews the Company's cybersecurity program, including the threat landscape and related controls and periodically conducts cybersecurity tabletop exercises.


text: The Cigna Group's dedicated cybersecurity team is led by our GCISO. Our current GCISO joined Cigna in October 2023 and works closely with senior management to develop and innovate the cybersecurity strategy and risk management. Prior to joining the team at The Cigna Group, our GCISO held senior information security roles at other global organizations where this individual defined information security strategies, built global information security programs, implemented cybersecurity capabilities that protect consumers, wholesale partners and brand, and oversaw the security of a global payment network, a corporate network and digital assets.


text: Cybersecurity Strategy and Risk Management Our comprehensive cybersecurity program is supported by policies and procedures designed to protect our systems and operations as well as the sensitive personal information and data of our clients and customers from foreseeable cybersecurity threats. This program is an integral component of our enterprise risk management program.


text: Core to our security model is our defense-in-depth framework, comprising multiple layers of processes and technologies that help prevent, detect and respond to threats. Our approach to safeguarding against external threats incorporates a suite of preventive technologies, including malicious email blocking, defenses against automated attacks and multifactor authentication. Event monitoring technologies run continuously, detecting suspected intrusion attempts and alerting our Cybersecurity Incident Response Team. We undertake a number of critical security processes to mitigate and protect against cybersecurity risks, which include but are not limited to (i) identity and access management; (ii) security awareness and training; (iii) security operations and monitoring; (iv) change management; (v) disaster recovery/business continuity; (vi) intelligence feeds; (vii) physical security; (viii) third-party vendor security reviews; (ix) vulnerability management/patching; and (x) cybersecurity incident reporting.


text: We routinely manage cybersecurity risks through a defined framework that includes activities aimed at the identification, assessment, treatment and monitoring of risks. Cybersecurity risk assessment results are used by senior management to make informed decisions about where to allocate resources to reduce cybersecurity risks and improve overall security posture. We examine our entire program annually with third parties and measure the program against generally accepted industry standards and frameworks, such as an internationally recognized security control framework established by the NIST and used by companies to assess and improve their ability to prevent, detect and respond to cyberattacks. Our cybersecurity policies and standards are reviewed annually and are mainly guided by the NIST 800-53 Cybersecurity Framework. In addition to the NIST framework, we leverage the International Organization for Standardization 27001 and 27002 standards. Our information protection policies and standards are informed by NIST 800-53b, moderate-level security control baseline requirements.


text: To enhance our preparedness and practice our collective cybersecurity response capabilities, we conduct tabletop exercises with leaders, stakeholders, subject matter experts and certain executives that are developed in partnership with external security experts. These events are designed to exercise and engage some of the most critical areas of cybersecurity incident response and preparedness through an interactive/evolving, simulated scenario. In addition to these internal measures, the effectiveness of components of our overall cybersecurity program is frequently evaluated by external third parties, which includes work performed over various levels of control assessments for specific business lines and core processes. These include Health Information Trust Alliance for health care data security, PCI DSS for payment security and System Organization Controls 2 for information security and related controls for specific business lines and core processes. We also perform an annual maturity assessment and benchmark our security controls to identify opportunities to strengthen our cybersecurity program.


text: As part of our Global Threat Management Program, a dedicated Incident Handling Team, comprising both technical and management personnel, determines the severity of a validated cybersecurity event across the enterprise and is responsible for the development and ongoing maintenance of our comprehensive Global Incident Response Plan ("GIRP"). The GIRP is reviewed quarterly at a minimum but may be updated as needed based on lessons learned, changes in key teams or processes or other circumstances as warranted, and the procedures therein are tested annually. The GIRP's incident handling procedures dictate our actions during each phase of an incident, including the assembly of a broad, cross-functional Computer Security Incident Response Team, the formulation of a response, and post-incident reviews and corrective actions.


text: Our information protection department maintains a risk register that is used to manage cybersecurity risks associated with its business activities, technology assets and its interaction with business, information technology and security parties, internal and external. Cybersecurity risks are also periodically reviewed by Enterprise Risk Management to ensure appropriate oversight of cybersecurity risk management activities.


text: Suppliers that have access to, host or transmit our data are contractually required to comply with our Security Policies and Standards. Additionally, suppliers may be subject to periodic security audits or risk assessments, which include security questionnaires, security capabilities and maturity assessments, controls evidence reviews, application vulnerability assessments, public internet presence monitoring, and alignment reviews with service-specific industry standards. Follow-up activities are performed as needed. Contracts with suppliers also include critical security requirements, such as right to audit, technology requirements and hiring practices, including background checks for those who have access to our network. To further ensure supplier resilience and continuity, we regularly evaluate and assess our critical supplier relationships and business continuity plans, enabling us to quickly adapt and maintain operations in the event of prolonged disruption.


text: As of the date of this report, we do not believe that any risks from any cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. That said, as discussed more fully under Part I, Item 1A "Risk Factors – Strategic and Operational Risks – As a large global health company, we and our vendors are subject to cyberattacks or other privacy or data security incidents. If we are unable to prevent or contain the effects of any such attacks, or fail to ensure vendors do the same, we may suffer exposure to substantial liability, reputational harm, loss of revenue or other damages," the sophistication of cybersecurity threats continues to increase, and the preventive actions we take to reduce the risk of cybersecurity incidents and protect our systems and information may become insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all attacks of these types, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Cybersecurity Governance Our Board has ultimate oversight over our privacy and cybersecurity programs and strategy and is responsible for ensuring that we have risk management policies and processes in place to meet and mitigate evolving risks and threats. Certain members of the Board have cybersecurity certifications. The Board executes this oversight directly and through both the Audit Committee, for cybersecurity purposes, and the Compliance Committee, for privacy purposes. In these capacities, these committees are regularly briefed by the Global Chief Information Security Officer ("GCISO") and Chief Privacy Officer on cybersecurity and privacy matters. These briefings are designed to provide visibility about the identification, assessment and management of critical risks, audit findings, and management's risk mitigation strategies. Additionally, these briefings include information about current trends in the environment, incident preparedness, artificial intelligence and various components of our cybersecurity and privacy programs. On an annual basis, the Board reviews our cybersecurity program, including the threat landscape and related controls, and periodically conducts cybersecurity tabletop exercises.


text: Our dedicated cybersecurity team is led by our GCISO. Our current GCISO joined the Company in October 2023 and works closely with senior management to develop and innovate the cybersecurity strategy and risk management. Prior to joining the team, our GCISO held senior information security roles at other global organizations where this individual defined information security strategies, built global information security programs, implemented cybersecurity capabilities that protect consumers, wholesale partners and brands, and oversaw the security of a global payment network, a corporate network and digital assets.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: SolarWinds Corp


text: We use, among other frameworks, the NIST Cybersecurity Framework and CIS Critical Security Controls as guides to help us identify, assess, and manage cybersecurity risks relevant to our business. Although we refer to such frameworks in developing our cybersecurity risk management approaches, our use of them as guides is not intended to suggest that we meet any particular technical standards, specifications, or requirements set forth therein.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan, incident response policy and Security Operations Center (SOC) to respond to cybersecurity incidents; and • a third-party risk management process for key service providers, suppliers, and vendors to assess for cyber risks and to assist the business in making risk-informed technology product and services decisions. We perform due diligence, including risk assessments, as appropriate, on third parties who maintain material data or information to help us evaluate and verify third party information security capabilities.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology, Cybersecurity and the Cyber Incident" of this Annual Report on Form 10-K.


text: Other than with respect to the Cyber Incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology, Cybersecurity and the Cyber Incident" of this Annual Report on Form 10-K.


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Board's Technology and Cybersecurity Committee (the "Technology and Cybersecurity Committee"). The Technology and Cybersecurity Committee oversees management's design, implementation and enforcement of our information technology systems and cybersecurity risk management program. Our Technology and Cybersecurity Committee meets and reports to the full Board at least quarterly.


text: Our Chief Information Security Officer, or CISO, regularly reports to the Technology and Cybersecurity Committee on an at least quarterly basis and leads the Company's overall cybersecurity function. The Technology and Cybersecurity Committee receives regular reports from our CISO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Technology and Cybersecurity Committee members also receive regular presentations on cybersecurity topics from our CISO, supported by our internal security staff, as part of the Board's continuing education on topics that impact public companies.


text: Our CISO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in our IT environment.


text: While our Board and Technology and Cybersecurity Committee oversee cybersecurity risk, our senior leadership is responsible for identifying, assessing and managing our material risks from cybersecurity threats. Our IT organization, which is led by our Chief Information Officer, is accountable for our overall cybersecurity risk management program. Reporting to our Chief Information Officer is the individual who provides day-to-day oversight of our cybersecurity program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers, our Chief Information Security Officer ("CISO"). Our CISO has an undergraduate degree in computer science and 30 years of experience in the IT, engineering and cybersecurity space. He has been with the Company since 2017, and previously served in management roles overseeing cybersecurity and security architecture at both publicly traded and private companies in the technology and software development industries. Our CISO is a recognized leader in the cybersecurity industry and often speaks at notable events throughout the world. The team that runs our cybersecurity risk management program comprises IT security, IT infrastructure and IT compliance personnel, who have prior work experience in various roles involving information technology (such as security, auditing, compliance, systems or programming) and/or relevant education or certifications.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems and our solutions. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology and Cybersecurity" of this Annual Report on Form 10-K.


text: Other than with respect to the Cyber Incident, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See Part I, Item 1A. "Risk Factors – Risks Related to Our Technology and Cybersecurity" of this Annual Report on Form 10-K.


text: While our Board and Technology and Cybersecurity Committee oversee cybersecurity risk, our senior leadership is responsible for identifying, assessing and managing our material risks from cybersecurity threats. Our IT organization, which is led by our Chief Information Officer, is accountable for our overall cybersecurity risk management program. Reporting to our Chief Information Officer is the individual who provides day-to-day oversight of our cybersecurity program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers, our CISO. Our CISO has an undergraduate degree in computer science and 30 years of experience in the IT, engineering and cybersecurity space. He has been with the Company since 2017, and previously served in management roles overseeing cybersecurity and security architecture at both publicly traded and private companies in the technology and software development industries. Our CISO is a recognized leader in the cybersecurity industry and often speaks at notable events throughout the world. The team that runs our cybersecurity risk management program comprises IT security, IT infrastructure and IT compliance personnel, who have prior work experience in various roles involving information technology (such as security, auditing, compliance, systems or programming) and/or relevant education or certifications.


text: We have implemented an Enterprise Risk Management ("ERM") program, managed by members of senior management, to identify, assess and monitor key risks that are aligned with our strategic and business objectives. Our policies and processes are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. We apply NIST best practices in how we implement security and privacy controls. We use NIST to define our practice in conducting risk assessments as well as to define our approach in managing internet of things ("IOT") device security. We have identified various cybersecurity risks that could adversely affect our business, results of operations and financial condition, including violation of privacy laws; intellectual property theft; fraud; business interruption or ransomware; harm to customers or employees; and other legal and reputational risks.

companyName: RESIDEO TECHNOLOGIES, INC.

ticker: REZI


text: Our Chief Information Security Officer ("CISO") oversees our information security program, leading a team responsible for enterprise-wide cybersecurity strategy, policy, process, standards, and architecture. Our CISO holds an MBA in technology management and has over twenty-five years of technology leadership experience, along with other certifications in efficiency and project management. Beyond the CISO, the security team in charge of incident management has a strong bench of experienced information security practitioners holding diverse degrees in science, technology, computer science and mathematics. Members of the operations team have certifications such as the Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Offensive Security Certified Professional ("OSCP"), Certified Ethical Hacker and many more. They all come from backgrounds that complement professions in security and all of them have at least several years of industry experience.


text: Internal and external experts regularly evaluate our information security program, with results reported to senior management and our Board of Directors. We actively collaborate with vendors, industry experts, and intelligence and law enforcement communities to continually assess and enhance the effectiveness of our information security policies and procedures.


text: We follow a structured framework linked to specific security standards and the procedural practices that the security team employs in supporting associated activities. Our information security team works closely with our managed security service provider to triage identified anomalies and alerts that are raised as risks and work across the company to validate the risk and act as deemed appropriate. The global security operations center ("SOC") within the CISO's organization is responsible for incident management including identification, assessment of initial threat, notification of key stakeholders, containment, remediation, and recovery. We have a cross-functional team prepared to respond in a timely manner to the incident and assess our obligations when incidents occur.


text: We use technical safeguards to protect our systems from cybersecurity threats, including firewalls and access controls. As part of our risk management practice, and given the rapidly changing regulatory landscape, we focus on making relevant privacy and cybersecurity training available to all employees, this includes mandatory training for all users on privacy and security best practices, as well as awareness training tied to our phishing campaigns. Topics included in our yearly training include best practices in password hygiene, phishing awareness, data privacy and other focus areas. We periodically test our policies and practices to guard against cybersecurity threats and engage in audits, threat modeling, vulnerability testing and table top exercises.


text: We have an established practice to oversee and manage third-party service providers in order to protect our interests related to cybersecurity threats. The Contract and Procurement Security Services ("CPSS") process has several key requirements of third-party vendors who manage or control our electronic information resources to ensure they protect our interests in cybersecurity, including: adherence to cybersecurity best practices, such as the NIST Cybersecurity Framework; completion of a security assessment questionnaire prior to any contract execution; and through application of our GRC (Governance, Risk, and Compliance) Tool, which triggers automatic annual security reviews of vendors. The security compliance team within the CISO's organization actively reviews and assesses the third party's responses and takes appropriate actions based on the responses.


text: We continue to evaluate and enhance our systems, controls, and processes where possible, including in response to actual or perceived threats specific to us or experienced by other companies.


text: The Board and the committees of the Board oversee our risk profile and exposures relating to matters within the scope of their authority. Among other matters, the Audit Committee is charged with oversight of Resideo's risks relating to enterprise-wide cybersecurity, including review of the state of the Company's cybersecurity policies and programs and steps management has taken to monitor and control such exposures. Cybersecurity review with the CISO is a regular standing calendar item of the Audit Committee in connection with its overall ERM program oversight. In addition, our Information and Technology Committee coordinates with Audit Committee on the oversight of our product technology and software cybersecurity program. The Audit Committee and Information and Technology Committee, together with the CISO, provide the full Board with visibility into the risks that impact us and the plans to mitigate them. The CISO's reports to the committees and the Board include insights on operations, business cyber risks, emerging threats and key strategic initiatives driving improved security capabilities, and special topics around what the Company is doing to strengthen Resideo's security posture.


text: We have implemented an Enterprise Risk Management ("ERM") program, managed by members of senior management, to identify, assess, and monitor key risks that are aligned with our strategic and business objectives. Our policies and processes are based on recognized frameworks established by the National Institute of Standards and Technology ("NIST"), the International Organization for Standardization and other applicable industry standards. We apply NIST best practices in how we implement security and privacy controls. We use NIST to define our practice in conducting risk assessments as well as to define our approach in managing internet of things ("IOT") device security. We have identified various cybersecurity risks that could adversely affect our business, results of operations, and financial condition, including violation of privacy laws; intellectual property theft; fraud; business interruption or ransomware; harm to customers or employees; and other legal and reputational risks. Resideo Technologies, Inc.


text: Our Chief Information Security Officer ("CISO") oversees our information security program, leading a team responsible for enterprise-wide cybersecurity strategy, policy, process, standards, and architecture. Our CISO holds an MBA in technology management and has over twenty-five years of technology leadership experience, along with other certifications in efficiency and project management. Beyond the CISO, the security team in charge of incident management has a strong bench of experienced information security practitioners holding diverse degrees in science, technology, computer science, and mathematics. Members of the operations team have certifications such as the Certified Information Systems Security Professional ("CISSP"), Certified Information Security Manager ("CISM"), Offensive Security Certified Professional ("OSCP"), Certified Ethical Hacker, and many more. They all come from backgrounds that complement professions in security and all of them have at least several years of industry experience.


text: We use technical safeguards to protect our systems from cybersecurity threats, including firewalls and access controls. As part of our risk management practice, and given the rapidly changing regulatory landscape, we focus on making relevant privacy and cybersecurity training available to all employees, this includes mandatory training for all users on privacy and security best practices, as well as awareness training tied to our phishing campaigns. Topics included in our yearly training include best practices in password hygiene, phishing awareness, data privacy, and other focus areas. We periodically test our policies and practices to guard against cybersecurity threats and engage in audits, threat modeling, vulnerability testing, and table top exercises.


text: The Board and the committees of the Board oversee our risk profile and exposures relating to matters within the scope of their authority. Among other matters, the Audit Committee is charged with oversight of Resideo's risks relating to enterprise-wide cybersecurity, including review of the state of the Company's cybersecurity policies and programs and steps management has taken to monitor and control such exposures. Cybersecurity review with the CISO is a regular standing calendar item of the Audit Committee in connection with its overall ERM program oversight. In addition, our Audit Committee provides oversight of our product technology and software cybersecurity program. The Audit Committee, together with the CISO, provide the full Board with visibility into the risks that impact us and the plans to mitigate them. The CISO's reports to the committees and the Board include insights on operations, business cyber risks, emerging threats and key strategic initiatives driving improved security capabilities, and special topics around what the Company is doing to strengthen Resideo's security posture. Resideo Technologies, Inc.


text: Cybersecurity and Data Privacy Risks We are subject to cybersecurity and data privacy risks. Cyberattacks and security vulnerabilities could lead to increased costs, liability claims, or harm to our competitive position.

companyName: AVAI BIO, INC.

ticker: AVAI


text: Cybersecurity Risks Our operations and the operations of our and partners involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse, disclosure, modification, or destruction of this data.


text: We are committed to protecting our third parties' and our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.


text: Data privacy issues are becoming increasingly significant due to the rapidly changing legal and regulatory landscape. Compliance with global and local data privacy laws requires ongoing investment in our information technology and employee training, and will continue to impact our business.


text: Governance and Oversight We should have a formal risk management program that addresses cybersecurity and data privacy risks. This program should include regular reporting to our senior management and Board of Directors, who provide oversight and direction. We have not established an enterprise risk management framework to assess and prioritize these risks.


text: Incident Response We maintain an incident response plan that includes policies and procedures for notifying affected third parties and complying with applicable laws.


text: Investments in Cybersecurity We will continually invest in our cybersecurity capabilities to protect our assets and those of our third parties. This potentially will include investment in advanced threat detection, encryption, and other security measures. Recent Cybersecurity Incidents During the last fiscal year, we did not experienced cybersecurity incidents.


text: Cybersecurity Risks Our operations and the operations of our and partners involve the storage, transmission, and processing of third parties' and our data, including personal, confidential, or proprietary information. This data is subject to privacy and security laws, regulations, and customer-imposed controls. Cybercriminals use a variety of methods to exploit potential vulnerabilities in our systems, products, and services. Sophisticated attacks could result in unauthorized access, loss, misuse, disclosure, modification, or destruction of this data. We are committed to protecting our third parties' and our data. Despite efforts, our systems, products, and services remain vulnerable to attacks.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, clinical trial data, and other confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: Kronos Bio, Inc.


text: Our Director of Information Technology and Associate Director, Infrastructure Operations, help identify, assess and manage the Company's cybersecurity threats and risks. Along with our Director of Information Technology and Associate Director, Infrastructure Operations, our Senior Vice President, Corporate Operations and Legal and third-party service providers help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting vulnerability assessments to identify vulnerabilities and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining an incident response plan, engaging in incident detection and response, encrypting certain of our data, maintaining network security and access controls, maintaining physical security, utilizing asset management, tracking and disposal, engaging in systems monitoring, training employees, engaging in penetration testing and maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program; the Director of Information Technology and Associate Director, Infrastructure Operations work with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our senior management, with input from an external strategic advisor, evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which together with our board of directors evaluates our overall enterprise risk.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including, for example, professional services firms, including outside legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity software providers, managed cybersecurity service providers, penetration testing firms, and in the case of a realized threat, forensic investigators.


text: We use third-party service providers to perform a variety of functions throughout our business, such as providing applications and hosting.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of the third parties upon which we rely, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, interruptions to our operations such as our clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of future customers or sales and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Senior Vice President, Corporate Operations and Legal and our Director of Information Technology. Our Senior Vice President, Corporate Operations and Legal has oversight of cybersecurity and risk management, has management and oversight experience, and reports to the Chief Executive Officer. Our Director of Information Technology has high-level knowledge of cybersecurity tools and provides oversight of cybersecurity strategy and cybersecurity vendor management, and reports to our Senior Vice President, Corporate Operations and Legal.


text: Our Senior Vice President, Corporate Operations and Legal is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. Our Senior Vice President, Corporate Operations and Legal is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the Senior Vice President, Corporate Operations and Legal. The Senior Vice President, Corporate Operations and Legal works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from the Director of Information Technology and Senior Vice President, Corporate Operations and Legal, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our Associate Director, Infrastructure Operations, helps identify, assess and manage the Company's cybersecurity threats and risks. Along with our Associate Director, Infrastructure Operations, third-party service providers help identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting vulnerability assessments to identify vulnerabilities and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program; the Associate Director, Infrastructure Operations works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our management, with input from an external strategic advisor, evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which together with our board of directors evaluates our overall enterprise risk.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems or data, or those of the third parties with whom we work, are or were compromised, we could experience adverse impacts resulting from such compromise, including, but not limited to, regulatory investigations or actions, litigation, fines and penalties, interruptions to our operations such as any future clinical trials, claims that we breached our data protection obligations, harm to our reputation, and a loss of future customers or sales and other adverse consequences."


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our Associate Director, Infrastructure Operations. Our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer has oversight of cybersecurity and risk management. Our Associate Director, Infrastructure Operations has high-level knowledge of cybersecurity tools and provides oversight of cybersecurity strategy and cybersecurity vendor management, and reports to our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer.


text: Our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer is responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel, for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response and vulnerability management processes are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. Our President, Interim Chief Executive Officer, Chief Financial Officer and Chief Operating Officer works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's incident response and vulnerability management processes include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic reports from our President, Interim Chief Executive Officer, Chief Financial Officer, and Chief Operating Officer, concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives and has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: We rely on the cybersecurity strategy and policies implemented by Monroe Capital, the parent of both MC Advisors and MC Management that also apply to the Company. Monroe Capital's cybersecurity strategy prioritizes detection and analysis of and response to known, anticipated or unexpected threats, effective management of security risks and resilience against cyber incidents. Monroe Capital's enterprise-wide cybersecurity program is aligned to the National Institute of Standards and Technology Cybersecurity Framework. Monroe Capital's cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, tools and related services, which include tools and services from third-party providers, and management oversight to assess, identify and manage risks from cybersecurity threats. Monroe Capital has implemented and continues to implement risk-based controls designed to prevent, detect and respond to information security threats and we rely on those controls to help us protect our information, our information systems, and the information of our investors and other third parties who entrust us with their sensitive information.

companyName: Monroe Capital Income Plus Corp


text: Monroe Capital's cybersecurity program includes physical, administrative, and technical safeguards, as well as plans and procedures designed to help Monroe Capital prevent and timely and effectively respond to cybersecurity threats and incidents, including threats or incidents that may impact us, MC Advisors or MC Management. Monroe Capital's cybersecurity risk management process seeks to monitor cybersecurity vulnerabilities and potential attack vectors, evaluate the potential operational and financial effects of any threat and mitigate such threats. The assessment of cybersecurity risks, including those which may impact us, our investment adviser, or our administrator, is disclosed into Monroe Capital's enterprise risk management program, which is overseen by the Monroe Capital Operations and Risk Committee ("ORC"), as discussed below. In addition, Monroe Capital periodically engages with third-party consultants and key vendors to assist it in assessing, enhancing, implementing and monitoring its cybersecurity risk management programs and responding to incidents.


text: The Monroe Capital cybersecurity risk management and awareness programs include periodic identification and testing of vulnerabilities, regular phishing simulations and annual general cybersecurity awareness and data protection training including for employees of MC Advisors and MC Management. Monroe Capital also has annual certification requirements for employees, including employees who provide services to us pursuant to our Investment Advisory Agreement and our Administration Agreement with respect to certain policies supporting the cybersecurity program. Monroe Capital undertakes periodic internal security reviews of our information systems and related controls, including systems affecting personal data and the cybersecurity risks of Monroe Capital's and our critical third-party vendors and other partners. Monroe Capital also completes periodic external reviews of its cybersecurity program and practices, which include assessments of relevant data protection practices and targeted attack simulations.


text: In the event of a cybersecurity incident impacting us, MC Advisors or MC Management, Monroe Capital has developed an incident response plan that provides guidelines for responding to such an incident and facilitates coordination across multiple operational functions of Monroe Capital, including coordinating with the relevant employees of MC Advisors and MC Management. The incident response plan includes notification to the applicable members of cybersecurity leadership, including Monroe Capital's Head of Information Technology, and the Computer Security Incident Response Team ("CSIRT"), as appropriate, escalation to the full ORC and/or an internal ad hoc group of senior employees, tasked with helping to manage the cybersecurity incident. Depending on their nature, incidents may also be reported to the audit committee or full board of directors of Monroe Capital, as well as to the Audit Committee (the "Audit Committee") of our Board and to our full Board, if appropriate.


text: Risk Management and Strategy In the ordinary course of business, we rely on electronic communications and information systems to conduct our operations and store sensitive data. "Information systems" means electronic information resources that we own or use, including physical or virtual infrastructure controlled by these information resources, or components thereof, organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of the information necessary to maintain or support our operations. Because cybersecurity threats continue to evolve, we have been required and may continue to be required to expend significant resources to continue to implement, modify or enhance our protective measures or to investigate and remediate any information security vulnerabilities. Financial expenditures may also be required to meet regulatory changes in the information security and cybersecurity domains. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. For additional discussion of the risks posed by cybersecurity threats, see "Item 1A. Risk Factors—General Risk Factors—The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: To address cybersecurity threats (defined as potential unauthorized occurrences on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of those systems or any information residing in those systems therein), we have a implemented an incident and event response program. That program is a component of our overall enterprise risk management and business continuity frameworks. We employ an in-depth, layered, defensive approach that leverages people, processes and technology to manage and maintain cybersecurity controls. We also employ a variety of preventative and detective tools to monitor, block, and provide alerts regarding suspicious activity relative to our information systems, as well as to report on any suspected advanced persistent threats. The program is designed to allow for the detection and timely and efficient recovery from cybersecurity incidents (defined as a violation or imminent threat of violation of information security policies, acceptable use policies, or standard computer security practices) and events by providing a well-defined, organized approach for handling any potential threats to the confidentiality, integrity, and/or availability of our information systems.


text: The CSIRT maintains overall responsibility for addressing and resolving incidents that occur at Monroe Capital. The CSIRT: (i) coordinates efforts in response to incidents; (ii) manages the assessment, recovery, and remediation efforts related to incidents; (iii) manages communication, both internal and external, regarding incidents; and (iv) manages notification of regulatory bodies as required by law in response to incidents.


text: We contract with a third-party vendor (oversight for which is outlined in our Vendor Risk Management Policy) who monitors our information systems for suspicious activity, such as unauthorized intrusions. Suspected or confirmed threats, incidents, or events, however, also may be reported by employees, intrusion detection systems, third-party servicers or government entities. Once reported, cybersecurity incidents are to be brought to the attention of the Head of Information Technology, the ORC and the CSIRT, which provides status updates to the Information Security Committee ("ISC"), with the frequency of such updates depending upon the perceived threat level of the reported incident.


text: After receiving notice of a cybersecurity threat, such threats are investigated to determine whether an actual incident has occurred and, if so, whether a more thorough assessment by the entire ISC is appropriate. During these assessments, steps may be taken to isolate affected systems. Outside advisors may be employed regarding the cybersecurity threat, including to conduct legal and forensic investigations and work with other third parties who might be engaged to assist in any response and associated publicity.


text: During or at the conclusion of an assessment of a cybersecurity incident, we will respond to the incident. The response will vary based upon the severity of the incident or event. The Head of Information Technology will note the classification of the information potentially impacted, paying close attention to information classified as personally identifiable information and sensitive. The Head of Information Technology and appropriate personnel will determine whether the incident is likely to affect ongoing business operations. If such is the case (e.g., contamination is widespread across production systems), the Monroe Capital's Incident Response Plan and Business Continuity Plan shall be invoked as necessary. In determining the level of response, we have identified three criticality levels of incidents and events based upon the following criteria: • Risk to confidential data • Risk to business continuity • Risk to critical systems • Revenue impact • Client impact


text: Incident and risk event levels each vary from level 3 (or low) risk to level 1 (high) risk. The determination of the incident and risk level will dictate the level of personnel that will be responsible for addressing the incident, controlling the effects of the incident and formulating the response to the incident. Responses may include, when appropriate and/or required, notification to regulatory agencies (e.g., SEC), authorities (e.g., F.B.I., Department of Justice), clients, third parties or internal personnel.


text: The CSIRT is responsible for incident reporting and response. The action steps taken, beyond notification, are typically accomplished with the assistance of the IT department. The Head of Information Technology or CSIRT team member will work with the appropriate personnel to respond to the incident (following written guidelines) and to ensure concurrent documentation of the same. Should a breach occur at a third party that has a material impact on Monroe Capital, the CSIRT must be notified.


text: Following a cybersecurity incident, and during its investigation and the formulation of a response, our processes also envision measures designed to contain and/or eradicate the incident and prevent further effects. Once it is determined that the incident has been resolved, we then work to establish appropriate controls (if applicable) to address similar future events and/or prevent another similar event from occurring in the future. To date, we have not experienced any previous cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 12 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its President, Chief Compliance Officer, Chief Operating Officer, who acts as chairperson of the ORC, Chief Credit Officer, Chief Financial Officer - Investment Funds and Chief Financial Officer - Management Company. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.


text: As part of its oversight responsibilities over risks and controls, the Board is ultimately responsible for overseeing our cyber and information security risks. The Audit Committee has primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. Members of the ORC and other Monroe Capital personnel periodically report to our Audit Committee as well as our full Board, as appropriate, on cybersecurity matters. Such reporting includes updates on Monroe Capital's cybersecurity program as it impacts us, the external threat environment, and Monroe Capital's programs to address and mitigate the risks associated with the evolving cybersecurity threat environment. These reports also include updates on Monroe Capital's preparedness, prevention, detection, responsiveness and recovery with respect to cybersecurity incidents.


text: Material Impact of Cybersecurity Risks As of the date of this annual report on Form 10-K, we are not aware of any material risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, the Company, including our business strategy, results of operations, or financial condition. However, future incidents could have a material impact on our business. Additional information about the cybersecurity risks that we face is discussed in Item 1A of Part I, "Risk Factors" in this annual report on Form 10-K under the heading "The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning, could impair our ability to conduct business effectively."


text: Our cybersecurity program is managed by Monroe Capital's dedicated internal cybersecurity team, which is responsible for enterprise-wide cybersecurity strategy, policies, standards, engineering, architecture and processes. The team is led by Monroe Capital's Head of Information Technology, who has a bachelor's degree in systems engineering and over 13 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity policies and procedures. The CSIRT includes members of Monroe Capital's senior executive management, including its Chief Operating Officer, Chief Compliance Officer and the Head of Information Technology, who acts as chairperson of the ISC. The ISC is comprised of Monroe Capital's Head of Information Technology, Chief Operating Officer and Chief Compliance Officer. The purpose of the ISC is to protect Monroe Capital's technology, data and information, and the ISC is tasked with responding to technology and data security incidents. The ORC is a cross-functional committee that governs and oversees the Monroe Capital enterprise risk management program, including cybersecurity. The ORC includes members of Monroe Capital's senior executive management, including its President, Chief Compliance Officer, Chief Operating Officer, who acts as chairperson of the ORC, Chief Credit Officer, Chief Financial Officer - Investment Funds and Chief Financial Officer - Management Company. The ORC, through regular consultation with the Monroe Capital internal cybersecurity team and employees of MC Advisors and MC Management, assesses, discusses and prioritizes Monroe Capital's approach to high-level risks, mitigative controls and ongoing cybersecurity efforts.


text: Risk Management and Strategy We have implemented processes for assessing, identifying and managing material risks from cybersecurity threats as part of our overall risk management program. Our cybersecurity program is informed by the National Institute of Standards and Technology Cybersecurity Framework as well as other globally recognized standards. We use a layered defense model, incorporating a wide range of technologies and practices in an effort to prevent, detect and mitigate threats. These measures include intrusion detection and prevention systems, multi-factor authentication, encryption and endpoint protection tools. We also implement threat detection and response solutions. To address emerging threats, we employ automated monitoring, vulnerability scans and patch management processes. Regular assessments, such as penetration tests, security audits and table-top exercises, are conducted to identify vulnerabilities and promote incident response and risk mitigation. We also provide privacy and information security trainings for our employees on a recurring basis. From time to time, we engage assessors, consultants and other third parties to assist with assessing, identifying and managing cybersecurity risks, including assisting us to conduct some of the foregoing assessments. Our cybersecurity risk management processes also are informed by intelligence received from recognized cybersecurity industry experts and other third-party sources, and as appropriate we engage outside counsel to advise on regulatory compliance and other cybersecurity risk management efforts.

companyName: Walt Disney Co

ticker: DIS


text: In addition, we have processes designed to oversee and identify cybersecurity risks associated with our use of third-party service providers. Where appropriate based on the data and intellectual property to which these providers are reasonably expected to have access, we conduct security assessments and due diligence reviews of third-party systems for compliance with our security standards, and we include data protection language in our agreements with these third parties.