text: Incident Response and Recovery Plan: The Company has an incident response and recovery plan, which details the steps to be taken from the initial internal reporting of a potential cybersecurity incident.


text: Third-Party Risk Management: The Company is developing processes and procedures to identify and oversee cybersecurity risks presented by third parties, including service providers, vendors and other users of the Company's systems.

companyName: BORGWARNER INC

ticker: BWA

secItem: Item 1C


text: Education and Awareness: The Company provides regular, mandatory training for applicable personnel on cybersecurity threats to help them identify, avoid and address cybersecurity threats and to communicate the Company's Cybersecurity Program, including applicable policies, standards, processes and practices.


text: The Board and the Audit Committee actively discuss cybersecurity risks with management and among themselves. The CIO reports on the Company's Cybersecurity Program and the Company's approach to cybersecurity risk management to the Audit Committee of the Board of Directors two times a year and to the full Board periodically, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the information security program, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the emerging threat landscape, technological trends and information security considerations arising with respect to the Company's peers and third parties.


text: The Audit Committee and Board receive prompt and timely information regarding cybersecurity threats and incidents that meet specified thresholds, as well as ongoing updates regarding any such threats or incidents until they have been addressed.


text: The Cybersecurity Program and related initiatives are managed by the CIO, and the Company's IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices. The current CIO has over two decades of experience in various roles in information technology and information security. The CIO and the IT team work with the business to implement the Cybersecurity Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Response Plan. The CIO and the IT team use detection tools to monitor for cybersecurity threats and incidents in real time, apply mitigation and remediation steps and then report such threats to the Audit Committee and the Board, as appropriate.


text: The Company's efforts include a wide range of actions, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating and improving the effectiveness of the Company's cybersecurity measures and planning. The Company engages in periodic assessment and testing of the Cybersecurity Program and may periodically engage a third-party expert to conduct the assessment, audits and testing. The results of such assessments, audits and testing are reported to the CIO and the Audit Committee or full Board, as applicable, and the Company makes adjustments as appropriate.


text: As of the date of this report, the Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Despite the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on the Company or its stakeholders. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: BorgWarner's Board of Directors acknowledges the importance of upholding the trust and confidence of BorgWarner's customers, business partners, employees and other stakeholders. The Board, in conjunction with the Audit Committee, is involved in the oversight of the Company's risk management program, including its Cybersecurity Program. The Cybersecurity Program is managed by the Chief Information Officer ("CIO"), whose information technology ("IT") team is responsible for enterprise-wide information technology, including cybersecurity strategy, policy, standards, architecture and processes. The Company benchmarks the Cybersecurity Program, including its standards, processes and practices, against recognized cybersecurity frameworks. The Cybersecurity Program continually enhances the enterprise security structure and contingency plans with the goal of preventing cybersecurity incidents to the extent feasible and minimizing the business impact should an incident occur.


text: Risk Management and Strategy Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents. The Cybersecurity Program has various tools and programs in place to monitor and address potential threats and incidents impacting the Company's operations and to determine the materiality of and ensure timely public disclosure of such threat or incident, if appropriate.


text: Technical Safeguards: The Company deploys technical safeguards designed to protect the Company's information systems from cybersecurity threats. The Company deploys tools in an effort to detect vulnerabilities, and when a weakness is identified, the Company seeks to assess the significance of the impact and mitigate before the weakness is exploited by an unauthorized actor.


text: Third-Party Risk Management: The Company continues to review processes and procedures that identify and oversee cybersecurity risks presented by third parties, including service providers, vendors and other users of the Company's systems. In December 2024, the Company updated its indirect Purchase Order Terms and Conditions, effective January 1, 2025, to address (i) supplier cybersecurity incident notification requirements and (ii) the Company's right to audit supplier IT systems.


text: Education and Awareness: The Company provides regular, mandatory training for applicable personnel on cybersecurity threats to help them identify, avoid and address cybersecurity threats and to communicate the Cybersecurity Program, including applicable policies, standards, processes and practices.


text: The Board and the Audit Committee actively discuss cybersecurity risks with management and among themselves. The CIO reports on the Cybersecurity Program and the Company's approach to cybersecurity risk management to the Audit Committee of the Board of Directors two times a year and to the full Board periodically, as appropriate. These reports include updates on the Company's cybersecurity risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Cybersecurity Program, recent developments, evolving standards and emerging threats or trends within cybersecurity. The Audit Committee and Board receive prompt and timely information regarding cybersecurity threats and incidents that meet specified thresholds, as well as ongoing updates regarding any such threats or incidents until they have been addressed.


text: The Cybersecurity Program is managed by the CIO, and the Company's IT team is responsible for enterprise-wide informational technology, coordinating with various functions and business groups to ensure they are following best practices. The current CIO has over two decades of experience in various roles in information technology and information security. The CIO and the IT team work with the business to implement the Cybersecurity Program, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's Cybersecurity Incident Response Plan. The CIO and the IT team use detection tools to monitor for cybersecurity threats and incidents in real time, apply mitigation and remediation steps and then report such threats to the Audit Committee and the Board, as appropriate.


text: The Company's efforts include a wide range of actions, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating and improving the effectiveness of the Company's cybersecurity measures and planning. The Company engages in periodic assessment and testing of the Cybersecurity Program and may periodically engage a third-party expert to conduct assessments, audits and testing. The results of such assessments, audits and testing are reported to the CIO and the Audit Committee or full Board, as applicable, and the Company makes adjustments as appropriate.


text: The Company's Cybersecurity Risk Management Approach The Company utilizes and relies on CIM Group for its IT and IT administration. CIM Group's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. CIM Group's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. CIM Group's controls leverage the National Institute of Standards and Technology Cybersecurity Framework. CIM Group also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources.

companyName: Creative Media & Community Trust Corp

ticker: CMCT


text: In addition, all employees of the Company and CIM Group receive mandatory training on cybersecurity matters upon hiring and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: For further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Cybersecurity risks and cybersecurity incidents may adversely affect our business by causing a disruption to our operations, a compromise or corruption of our confidential information, and/or damage to our business relationships, all of which could negatively impact our financial results."


text: Management Oversight of Cybersecurity Risk Management CIM Group's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO") and representatives from CIM Group's operations, compliance and accounting departments. The Committee is responsible for CIM Group's cybersecurity policy and overseeing the activities of CIM Group's cybersecurity practices, including assessing CIM Group's risks and controls. The Committee is chaired by the CTO and has more than 30 years of experience in the fields of information technology, cybersecurity and adjacent roles, including serving on cybersecurity advisory councils. In addition, members of the Committee has relevant industry experience in enterprise risk management and compliance. The team responsible for developing and implementing our cybersecurity program collectively holds an MS in Cybersecurity and Information Assurance and have multiple cybersecurity certifications, including CRISC, CISM, CISA, NCSP-NIST, CISSP, CASP+, CySA+ and Security+.


text: The Committee has established a Cybersecurity Subcomittee (the "Subcommittee"). The Subcommittee consists of, among other individuals, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC's cybersecurity rules adopted in 2023), including us, in complying with such cybersecurity rules.


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the CIM Group's IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, CIM Group maintains incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to CIM Group's business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.


text: CIM Group's personnel responsible for cybersecurity policy comprises of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.


text: We believe that the processes, policies and procedures established by the Committee and the Subcommittee provide guidance for consistent and effective incident handling and response and set standards for internal notifications and escalations, as well as external notification considerations with respect to a cybersecurity event or incident requiring disclosure or notification in accordance with applicable laws.


text: Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board of Directors has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the Audit Committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 on a Current Report on Form 8-K and shall oversee the Company's response to such matter.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents.


text: The Committee has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of, among other individuals, the CCO, the CTO, the chief financial officers of public companies that are subject to the SEC's cybersecurity rule adopted in 2023 and are managed by CIM Group, including our Chief Financial Officer. The Subcommittee is tasked with assisting CIM Group-managed public companies (that are subject to the SEC's cybersecurity rules adopted in 2023), including us, in complying with such cybersecurity rules.


text: Board of Directors Oversight of Cybersecurity Risk Management The Audit Committee of our Board of Directors has oversight of our cybersecurity risks. The Audit Committee receives quarterly updates from CIM Group with respect to the effectiveness of its cyber readiness and cybersecurity program. This oversight includes briefing and a report by the CTO or CIM Group's Head of Transformation, as well as a discussion of any cybersecurity breaches detected by CIM Group and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by CIM Group, the health of CIM Group's information security system, effectiveness of CIM Group's cybersecurity controls and recoverability and business continuity testing. Pursuant to the Company's cybersecurity policy, the Audit Committee will be promptly notified of any material cybersecurity incident required to be disclosed under Item 1.05 on a Current Report on Form 8-K and shall oversee the Company's response to such matter.


text: Risk Management and Strategy As part of our enterprise risk assessment function, which is led by our Senior Vice President and head of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing the company, including from cyber threats. Our enterprise risk assessment function is part of our overall risk management processes. Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology. We believe that our processes provide us with a comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.

companyName: SIRIUS XM HOLDINGS INC.

ticker: SIRI


text: We have developed a robust cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform simulations and drills at both a technical and management level.


text: Internally, we have a security awareness program which includes training that reinforces our information technology and security policies, standards and practices, and we require that our employees comply with these policies. The security awareness program offers training on how to identify potential cybersecurity risks and protect our resources and information. This training is mandatory for all employees on an annual basis, and it is supplemented by testing initiatives, including periodic phishing tests. We also provide specialized security training for certain employee roles, such as application developers. Finally, our privacy program requires all employees to take periodic awareness training on data privacy. This training includes information about confidentiality and security, as well as responding to unauthorized access to or use of information.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have routinely engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged: Novacoast, an international cybersecurity company specializing in IT services and software development, to augment our monitoring and detection efforts; Synopsys, Inc., a leader in electronic design automation, to perform our external penetration testing and vulnerability assessment; Recorded Future, one of the world's largest intelligence companies, and Mandiant, a recognized leader in cyber defense, threat intelligence and incident response services, to provide threat intelligence and analysis services; and Mandiant to augment our incident response ability and provide forensic services. We also purchase insurance to protect us against the risk of cybersecurity breaches. Our Senior Vice President and Treasurer is responsible for our insurance programs and reviews on a regular basis our cyber insurance policies and assesses whether we have appropriate coverage.


text: To date, risks from cybersecurity threats have not previously materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. That said, as discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Role of the Board The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives regular reports from our Chief Product and Technology Officer, Chief Information Security Officer and the Chief Information Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. Our Senior Vice President and head of Internal Audit reports directly to the Audit Committee and is responsible for reporting to the Committee on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Audit Committee regularly reports to the Board on cybersecurity risks and other matters reviewed by the Committee. In addition, the Board receives separate presentations on cybersecurity risk from our Chief Product and Technology Officer. Furthermore, all Board members are invited to attend each Audit Committee meeting and have access to the materials for each Audit Committee meeting.


text: As a matter of process, the Audit Committee annually reviews, and recommends to the Board its approval of, our information security policy and information security program. Furthermore, on an annual basis, the Board reviews and discusses our technology strategy with our Chief Product and Technology Officer and approves our technology strategic plan.


text: Role of management Our Chief Information Security Officer, together with our Chief Product and Technology Officer and Chief Information Officer, is responsible for the day-to-day management of our cybersecurity risks. We have established a Security Council, which includes our Chief Executive Officer, Chief Commercial Officer, Chief Product and Technology Officer, Chief Information Security Officer, Chief Information Officer, Chief Financial Officer, General Counsel and other senior officers, that meets on at least a quarterly basis to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing information security, fraud, vendor, data protection and privacy, and cybersecurity risks.


text: We have a security incident response framework in place. We use this incident response framework as part of the process we employ to keep our management and Board of Directors informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. The framework is a set of coordinated procedures and tasks that our incident response team, under the direction of the Chief Information Security Officer, executes with the goal of ensuring timely and accurate resolution of cybersecurity incidents. Our cybersecurity framework includes regular compliance assessments with our policies and standards and applicable state and federal statutes and regulations. In addition, we validate compliance with our internal data security controls through the use of security monitoring utilities and internal and external audits.


text: Our Chief Information Security Officer, Chief Product and Technology Officer and Chief Information Officer each have extensive experience in the information technology area. In particular, our Chief Information Security Officer has over twenty years of professional experience in the information security area, including as a result of his service as the director of security, a security architect and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC; our Chief Product and Technology Officer has twenty eight years of professional experience in the information security area; and our Chief Information Officer has twenty three years of professional experience in the information security area.


text: Risk Management and Strategy As part of our enterprise risk assessment function, which is led by our Senior Vice President and head of Internal Audit, we have implemented processes to assess, identify and manage the material risks facing us, including from cyber threats. Our enterprise risk assessment function is part of our overall risk management processes. Our cybersecurity program is built upon internationally recognized frameworks, such as ISO 27001, and maps to standards published by The National Institute of Standards and Technology. We believe that our processes provide us with a reasonable and comprehensive assessment of potential cyber threats. We conduct regular scans, penetration tests, and vulnerability assessments to identify any potential threats or vulnerabilities in our systems. Our processes to assess, identify and manage the material risks from cyber threats include the risks arising from threats associated with third party service providers, including cloud-based platforms.


text: We have developed a robust cyber crisis response plan which provides a documented framework for handling high severity security incidents and facilitates coordination across multiple parts of the company. Our incident response team constantly monitors threat intelligence feeds, handles vulnerability management and responds to incidents. In addition, we routinely perform simulations and drills at technical, management and executive levels.


text: From time to time, we engage third-party service providers to enhance our risk mitigation efforts. For instance, we have routinely engaged an independent cybersecurity advisor to lead a cybersecurity crisis simulation exercise that has been used by our senior leaders to prepare for a possible cyber crisis. In addition, we have engaged: Novacoast, an international cybersecurity company specializing in IT services and software development, to augment our monitoring and detection efforts; Synopsys, Inc., a leader in electronic design automation, to perform our external penetration testing and vulnerability assessment; Recorded Future, one of the world's largest intelligence companies, and Mandiant, a recognized leader in cyber defense, threat intelligence and incident response services, to provide threat intelligence and analysis services and augment our incident response ability. Our Senior Vice President and Treasurer is responsible for our insurance programs and reviews on a regular basis our insurance policies and assesses whether we have appropriate coverage.


text: To date, risks from cybersecurity threats have not materially affected us, and we currently do not expect that the risks from cybersecurity threats are reasonably likely to materially affect us, including our business, strategy, results of operations or financial condition. As discussed more fully under "Item 1A – Risk Factors", the sophistication of cyber threats continues to increase, and the preventative actions we take to reduce the risk of cyber incidents and protect our systems and information may be insufficient. Accordingly, no matter how well designed or implemented our controls are, we will not be able to anticipate all security breaches of these types, including security threats that may result from third parties improperly employing AI technologies, and we may not be able to implement effective preventive measures against such security breaches in a timely manner.


text: Role of the Board The Audit Committee of the Board of Directors is responsible for the primary oversight of our information security programs, including relating to cybersecurity. The Audit Committee receives regular reports from our Chief Information Security Officer on, among other things, our cyber risks and threats, the status of projects to strengthen our information security systems, assessments of our security program, and our views of the emerging threat landscape. Our Senior Vice President and head of Internal Audit reports directly to the Audit Committee and is responsible for reporting to the Committee on our company-wide enterprise risk assessment, and that assessment also includes an evaluation of cyber risks and threats. The Chair of the Audit Committee reports to the Board on cybersecurity risks and other matters reviewed by the Committee. In addition, the Board receives separate presentations on cybersecurity risk. Furthermore, all Board members are invited to attend each Audit Committee meeting and have access to the materials for each Audit Committee meeting.


text: As a matter of process, the Audit Committee annually reviews, and recommends to the Board its approval of, our information security policy and information security program. Furthermore, on an annual basis, the Board reviews and discusses our technology strategy and strategic plan.


text: Role of management Our Chief Information Security Officer is responsible for the day-to-day management of our cybersecurity risks. To ensure robust oversight, we have established a Security Council comprising senior leaders, including our Chief Executive Officer, Chief Operating Officer, Chief Information Security Officer, Chief Financial Officer, General Counsel and Chief Privacy Officer. The Security Counsel meets on at least a quarterly basis to review cybersecurity and information security matters. The Security Council has primary management oversight responsibility for assessing and managing risks related to information security, fraud, vendor oversight, data protection and privacy, and cybersecurity.


text: Our Chief Information Security Officer has extensive experience in the information technology area, with over twenty years of professional experience in the information security area, including as a result of his service as the director of security, a security architect and a software security engineer at companies such as Squarespace, Verizon Media (Oath), Tumblr, Bridgewater Associates and EMC. Our Chief Information Security Officer aims to ensure rigorous oversight and execution of our cybersecurity and information security strategy.


text: The Company is subject to several material risks related to cybersecurity threats. A cybersecurity attack could prevent the Company from managing client portfolios, cause the unauthorized disclosure of sensitive or confidential client or employee information, and/or result in misappropriation of information or funds, which individually or collectively could severely harm its business.

companyName: DIAMOND HILL INVESTMENT GROUP INC

ticker: DHIL


text: The Company has an Information Security Committee (the "Committee") to identify, assess, and manage cybersecurity risks and to implement necessary policies and procedures to mitigate those risks. The Committee also coordinates employee education efforts throughout the year. The Managing Director of Information Technology serves as the Committee chair and the day-to-day manager of the Company's information security management systems. The Committee is comprised of members having expertise in information technology infrastructure, data security, risk management, compliance, and business continuity and recovery efforts. The Committee identifies and assesses risks by understanding and evaluating the Company's systems, processes, data, and controls. This information is then augmented through participation by certain Committee members in industry threat intelligence groups designed to share best practices and emerging threats related to cybersecurity. The Committee also completes a full cybersecurity risk assessment annually, which drives the implementation of policies and procedures as well as the scope of third-party testing. The Committee has implemented a comprehensive set of cybersecurity policies and procedures that follows standards established by the International Organization for Standardization ("ISO 27001"). Included are policies and procedures to oversee, identify, and mitigate the Company's cybersecurity risks as well as cybersecurity risks to the Company associated with its significant service providers and vendors. The Company's cybersecurity policies and procedures have been independently certified by a third-party as compliant with the ISO 27001 standard. The Committee engages multiple third-party experts to perform penetration tests on a periodic basis, and to assess whether these policies and procedures are designed appropriately and operating effectively.


text: Cybersecurity oversight forms part of the Board's risk oversight of the Company. The Board oversees efforts by management to manage the cybersecurity risks to which the Company may be exposed. The Board receives at least annual reports and meets periodically with the Chief Compliance Officer and the Managing Director of Information Technology, both of whom serve on the Committee. From its review of these reports and discussions with the Committee and management, the Board ensures it has sufficient awareness of the material cybersecurity risks to which the Company is exposed, enabling a dialogue about how management manages and mitigates those risks. The Board currently has three members who have obtained certifications in cybersecurity oversight.


text: The Company is subject to several material risks related to cybersecurity threats. A cybersecurity attack could prevent the Company from managing client portfolios, cause the unauthorized disclosure of sensitive or confidential client or employee information, and/or result in misappropriation of information or funds, which individually or collectively could severely harm its business. In 2024, the Company did not identify any cybersecurity risks that have materially affected or are reasonably likely to materially affect its business strategy, results of operations, or financial condition. However, despite its efforts, the Company cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that it has not experienced an undetected cybersecurity incident. For more information about these risks, please see Item 1A.


text: The Company has an Information Security Committee (the "Committee") to identify, assess, and manage cybersecurity risks and to implement necessary policies and procedures to mitigate those risks. The Committee also coordinates employee education efforts throughout the year. The Technology Risk & Information Security Officer serves as the Committee chair and the day-to-day manager of the Company's information security management systems. The Committee is comprised of members having expertise in information technology infrastructure, data security, risk management, compliance, legal, and business continuity and recovery efforts. The Committee identifies and assesses risks by understanding and evaluating the Company's systems, processes, data, and controls. This information is then augmented through participation by certain Committee members in industry threat intelligence groups designed to share best practices and emerging threats related to cybersecurity. The Committee also completes a full cybersecurity risk assessment annually, which drives the implementation of policies and procedures as well as the scope of third-party testing. The Committee has implemented an information security program that includes a comprehensive set of cybersecurity policies and procedures that follows standards established by the International Organization for Standardization ("ISO 27001"). The policies and procedures within the program, among other things, are to oversee, identify, and mitigate the Company's cybersecurity risks as well as cybersecurity risks to the Company associated with its significant service providers and vendors. The Company's cybersecurity policies and procedures have been independently certified by a third party as compliant with the ISO 27001 standard. The Committee engages third-party experts to perform penetration tests on a periodic basis and to assess whether these policies and procedures are designed appropriately and operating effectively.


text: Cybersecurity oversight forms part of the Board 's risk oversight of the Company. The Board oversees efforts by management to manage the cybersecurity risks to which the Company may be exposed. The Board receives quarterly reports and meets periodically with the Committee chair. From its review of these reports and discussions with management and the Committee chair, the Board ensures it has sufficient awareness of the material cybersecurity risks to which the Company is exposed, enabling a dialogue about how management manages and mitigates those risks. The Board currently has four members who have obtained certifications in cybersecurity oversight.


text: Risk Management and Global Strategy We have implemented processes, technologies, and controls to seek to assess, identify, and manage risks associated with cybersecurity threats. Management considers cybersecurity risks within our overall approach to enterprise risk management. We evaluate these risks based on several frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), Center for Internet Security (CIS) 18 Critical Security Controls, and the Payment Card Industry Data Security Standard (PCI DSS). Our governance policies, including our Information Security Policy, outline high-level objectives designed to meet compliance and regulatory requirements.

companyName: COSTCO WHOLESALE CORP /NEW

ticker: COST


text: We undertake a bi-annual NIST CSF and CIS 18 Critical Security Controls assessment, conducted by a third-party, to measure our program maturity. We have implemented a variety of technologies, leveraging third-party security providers for some, and engage in multiple activities to seek to identify and mitigate vulnerabilities and risks in systems. These include, among other activities, scanning for common vulnerabilities and exposures, penetration tests on internal and external networks, code scans on applications, allowed application listing, configuration management tools, employee awareness and training, and internal and external audits. We also review, with various frequencies, on a risk-based priority select third parties with whom we do business, in an effort to reduce the likelihood of security incidents or business interruptions. We maintain cybersecurity insurance that would apply to certain losses arising from significant security incidents.


text: We maintain a security operations center, supported by external providers and our employees, which provides threat detection and incident response capabilities. We maintain cyber incident response plans and related playbooks, for execution by our information security team, in coordination with stakeholders (including legal counsel). Significant incidents will be escalated to a Cybersecurity Materiality Committee to assess materiality based on qualitative and quantitative factors. The Committee is composed of a cross-divisional group of executives representing the core business functions of Information Technology and Security, Operations, Administration, Finance and Accounting, and Legal. We conduct periodic tabletop exercises, including at the executive level, to test our response processes and incident management procedures.


text: Our Board of Directors has delegated certain responsibilities to the Audit Committee of the Board. The Audit Committee reviews and discusses with management the identification and mitigation of cybersecurity risks, including (among other things) the effectiveness of risk-management policies and practices designed to help safeguard our operations, financial systems, and data. Our Vice President of Information Security and Chief Information Security Officer (CISO) presents cybersecurity-related topics, including program maturity progress, regularly to the Audit Committee. The Internal Audit team, in its periodic compliance and risk assessment updates to the Audit Committee, also reports on its reviews of certain of our cybersecurity risk exposures, controls, and management actions. The full Board also receives cybersecurity evaluations from time to time.


text: Our information security organization is led by our CISO, who has over eighteen years of relevant experience, serving in leadership roles across the retail and technology sectors. The CISO is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our CISO reports to our Chief Information and Digital Officer (CIDO), who has more than thirty years' experience in which he has led global digital responsibilities, including leading global cyber teams. Our CIDO reports to the Chief Executive Officer.


text: Risks from Material Cybersecurity Threats We and our third-party service and merchandise providers have experienced cybersecurity incidents and threats. Based on the information available as of the date of this Form 10-K, we are not aware of any risks from actual cybersecurity incidents that have materially affected us or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. It is possible that there have been intrusions into our systems that have not been identified by our controls and procedures and that might manifest in significant events at a later time. There can be no guarantee that the actions and controls we and our third-party service providers have implemented and are implementing will be sufficient to protect our systems, information or other property. See "Risk Factors" in Item 1A of this Form 10-K for more information on our cybersecurity-related risks.


text: Risk Management and Global Strategy We have implemented processes, technologies, and controls to seek to assess, identify, and manage risks associated with cybersecurity threats. Management considers cybersecurity risks within our overall approach to enterprise risk management. We evaluate these risks based on several frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), Center for Internet Security (CIS) 18 Critical Security Controls, and the Payment Card Industry Data Security Standard. Our governance policies, including our Information Security Policy, outline high-level objectives designed to meet compliance and regulatory requirements.


text: We undertake regular NIST CSF and CIS 18 Critical Security Controls assessments, conducted by a third-party, to measure program maturity. We have implemented a variety of technologies, leveraging third-party security providers for some, and engage in multiple activities to seek to identify and mitigate vulnerabilities and risks in systems. These include, among other activities, scanning for common vulnerabilities and exposures, penetration tests on internal and external networks, code scans on applications, allowed application listing, configuration management tools, employee awareness and training, and internal and external audits. We also review with various frequencies and on a risk-based priority select third parties with whom we do business, in an effort to reduce the likelihood of security incidents or business interruptions. We maintain cybersecurity insurance that would apply to certain losses arising from significant security incidents.


text: We maintain a security operations center, supported by external providers and our employees, which provides threat detection and incident response capabilities. We maintain cyber incident response plans and related playbooks in coordination with stakeholders (including legal counsel). Significant incidents will be escalated to a Cybersecurity Materiality Committee to assess materiality based on qualitative and quantitative factors. The Committee is composed of a cross-divisional group of executives representing the core business functions of Information Technology and Security, Operations, Administration, Finance and Accounting, and Legal. We conduct periodic tabletop exercises, including at the executive level, to review our response processes and incident management procedures.


text: Our Board of Directors has delegated certain responsibilities to the Audit Committee of the Board. The Audit Committee reviews and discusses with management the identification and mitigation of cybersecurity risks, including (among other things) the effectiveness of risk-management policies and practices designed to help safeguard our operations, financial systems, and data. Our Chief Information and Digital Officer (CIDO) and his executive team, including the Vice President of Information Security and Chief Information Security Officer (CISO), present cybersecurity-related topics, including program maturity progress, regularly to the Audit Committee. The Internal Audit team, in its periodic compliance and risk assessment updates to the Audit Committee, also reports on its reviews of certain of our cybersecurity risk exposures, controls, and management actions. The full Board also receives cybersecurity evaluations from time to time.


text: Our information security organization is led by the CISO. The CISO is responsible for all aspects of our cybersecurity program, including cybersecurity engineering and architecture, cybersecurity operations, incident response, threat intelligence, identity and access management, cybersecurity risk and compliance, and vulnerability management. Our former CISO left the Company in June 2025, and we are actively sourcing a qualified replacement. In the interim, our Deputy CISO, who has over 20 years of cybersecurity and leadership experience, is managing the CISO responsibilities. The CISO position reports to our CIDO, who has more than 30 years experience in which he has led global digital responsibilities, including leading global cyber teams. Our CIDO reports to the Chief Executive Officer.


text: Risk Management and Strategy The importance of protecting against unauthorized access to or use of customer data that has been entrusted to us as part of the various services provided to our customers; as well as operational disruptions caused by cybersecurity events, is of paramount importance to us. The Bank relies upon a formalized Information/Cybersecurity Program ("ICP") to ensure we are protecting the confidentiality, integrity and availability of confidential information. The ICP is approved by the Board of Directors or a Committee thereof annually, and is designed to identify reasonably foreseeable internal and external threats, assess the likelihood and potential damage these threats could cause, and assess the appropriateness of policies, standards and procedures used to identify and mitigate risk levels to within the documented risk appetite. The ICP has been designed to align with industry best practices, as well as Regulatory guidelines and laws; and leverages both the Secure Control and the National Institute of Standards and Technology Cybersecurity frameworks as its baselines.

companyName: FLAGSTAR BANK, NATIONAL ASSOCIATION

ticker: FLG


text: The ICP incorporates formal policies and procedures to ensure established controls are subjected to testing and independent effective challenge, to provide for appropriate due diligence and ongoing oversight of third parties who have access to our confidential information and/or systems, and to provide information and cybersecurity training to our employee population to ensure awareness of risks facing the institution and latest techniques used by malicious actors. A key component of the training program is the performance of phishing and social engineering campaign, the result of which are used to gauge the training program's effectiveness, as well as to identify employees that pose a potential higher level of phishing/social engineering susceptibility risk, with all such employees provided additional targeted training. The ICP also includes subject matter expert review of third-party servicing agreements to ensure provisions adequately protect the bank in the event of a cybersecurity event whenever the relationship involves sensitive customer information. Internal auditors and third-party security experts are relied upon to review and ensure that established controls are appropriately designed, effectively implemented, and operating as intended; with such reviews undertaken as part of the Bank's internal audit and third-party penetration testing programs.


text: The information/cybersecurity risk management program relies upon a layered security model to protect against both internal and external threats; and is a component of the Bank's formalized enterprise risk management program ("ERM Program"), which is reviewed and approved by the Board of Directors or Committee thereof at least annually. The ERM Program sets forth enterprise-wide operational practices to ensure consistency in the organizations approach to risk identification, documentation, measurement, management, and mitigation with all aspects of risk management documented within a centrally maintained risk management platform ("RMP"). A key aspect of the ERM Program is the risk and control self-assessment ("RCSA") process, which is used to evaluate the mitigation effectiveness of implemented controls through an independent effective challenge program. Gaps or control weaknesses identified as part of the RCSA process require creation of issues and remediation strategies, both of which are formally documented within the RMP, where remediation efforts are managed and monitored from initial creation through ultimate completion of the respective work effort. Independent effective challenge has been embedded throughout this process and ensures that remediation efforts will, and have satisfactorily addressed the identified issue.


text: A formal Incident Response Plan ("Plan") is maintained by the Information Security Department, and approved by the Board of Directors or designated Committee thereof at least annually. The Plan sets forth the Bank's information/cybersecurity incident response framework, which has been designed to ensure a consistent, repeatable response to any actual or threatened cybersecurity incident ("Incident"). The framework sets forth the team structure utilized for the coordination, monitoring, oversight, and internal and external reporting in connection with any identified Incident; and delineates responsibilities for all team members involved in response activities, as well as guidance for all employees in connection with defining, discovering, reporting, investigating, containing, and recovering from an Incident. During the reporting period, we did not experience any cybersecurity risks or incidents that have materially or are reasonably likely to materially affect the Bank; including its business strategy, result of operations, or financial condition.


text: We believe that the impact of any previously identified cyber incidents, including those subject to ongoing investigation and remediation, will not have a material impact on the Company, including business strategy, results of operations or financial condition.


text: The Board of Directors, through its Risk Assessment ("RAC") and Technology ("TEC") Committees, (together the "Committees") provides direction and oversight of both the enterprise risk management and information/cybersecurity risk management programs. The Committees meet monthly to review and discuss overall state, current developments, management and performance metrics, risk identification and mitigation status, and new initiatives associated with both the Enterprise Risk Management and Information/Cybersecurity Programs. The Committees rely upon various management level committees (e.g.


text: Enterprise Risk Management, Operational Risk Management, and Technology Management) for oversight and direct management of the overarching risk management framework, which includes the information/cybersecurity risk management program and direct reporting by the Chief Information Security Officer ("CISO").


text: The CISO is responsible for administration, management, and oversight of the Information/Cybersecurity Program; and is supported by a team of individuals that possess various levels of educational and technical hands-on expertise to carry out daily responsibilities and to ensure the Program's success and continued maturation. The CISO reports directly to the Chief Risk Officer, and has over 15 years of direct experience in designing, implementing, and maturing information and cybersecurity strategies within the financial sector. Prior to joining the Bank, the CISO served as a technology examiner for one of the three Federal banking regulatory agencies, with over ten years of experience performing technology examinations of financial institutions ("FI") and FI service providers primarily within the New York metropolitan area.


text: The information/cybersecurity risk management program relies upon a layered security model to protect against both internal and external threats; and is a component of the Bank's Risk Governance Framework, which is reviewed and approved by the Board of Directors or Committee thereof at least annually. The Risk Governance Framework sets forth enterprise-wide operational practices to ensure consistency in the Company's approach to risk identification, assessment and testing, issues management, and mitigation with all aspects of risk management documented within a centrally maintained Governance, Risk and Controls ("GRC") risk management platform. A key aspect of the Risk Governance Framework is the risk and control self-assessment ("RCSA") process, which is used to evaluate the mitigation effectiveness of implemented controls through an independent effective challenge program. Gaps or control weaknesses identified as part of the RCSA process require creation of issues and remediation strategies, both of which are formally documented within the GRC risk management platform, where remediation efforts are managed and monitored from initial creation through ultimate completion of the respective work effort. Independent effective challenge has been embedded throughout this process and ensures that remediation efforts will and have satisfactorily addressed the identified issue.


text: A formal incident response plan is maintained by the Information Security Department and approved by the Board of Directors or designated Committee thereof at least annually. The response plan sets forth the Bank's information/cybersecurity incident response framework, which has been designed to ensure a consistent, repeatable response to any actual or threatened cybersecurity incident. The framework sets forth the team structure utilized for the coordination, monitoring, oversight, and internal and external reporting in connection with any identified incident; and delineates responsibilities for all team members involved in response activities, as well as guidance for all employees in connection with defining, discovering, reporting, investigating, containing, and recovering from an incident. During the reporting period, we did not experience any cybersecurity risks or incidents that have materially or are reasonably likely to materially affect the Bank; including its business strategy, result of operations, or financial condition.


text: The Board of Directors, through its Risk Assessment ("RAC") and Technology ("TEC") Committees, (together the "Committees") provides direction and oversight of both the Risk Governance Framework and information/cybersecurity risk management programs. The Committees meet quarterly to review and discuss overall state, current developments, management and performance metrics, risk identification and mitigation status, and new initiatives associated with both the Risk Governance Framework and information/cybersecurity risk management programs. The Committees rely upon various management level committees (e.g. Enterprise Risk Management, Operational Risk Management, and Technology Management) for oversight and direct management of the overarching Risk Governance Framework, which includes the information/cybersecurity risk management program and direct reporting by the Chief Information Security Officer ("CISO").


text: The CISO is responsible for administration, management, and oversight of the Information/Cybersecurity Program; and is supported by a team of individuals that possess various levels of educational and technical hands-on expertise to carry out daily responsibilities and to ensure the Program's success and continued maturation. The CISO reports directly to the Chief Information Officer and has over 15 years of direct experience in designing, implementing, and maturing information and cybersecurity strategies within the financial sector. Prior to joining the Bank, the CISO served as a technology examiner for one of the three Federal banking regulatory agencies, with over ten years of experience performing technology examinations of financial institutions and financial institutions service providers primarily within the New York metropolitan area.


text: CYBERSECURITY RISK MANAGEMENT AND STRATEGY We maintain a comprehensive cybersecurity program, recognizing the critical importance of safeguarding our operations, employees, customers, and other business partners from the constantly evolving risks associated with cybersecurity threats. These risks include, among other things, operational risks, reputational risks, financial risks, and litigation and legal risks.

companyName: DECKERS OUTDOOR CORP

ticker: DECK


text: As a part of our comprehensive cybersecurity program, we have developed an incident response plan (IRP) designed to quickly respond to, mitigate, and recover from cybersecurity incidents. The IRP includes procedures for incident detection and reporting, initial assessment, containment, eradication, recovery, post-incident activities, and continuous improvement.


text: We also integrated cybersecurity risk management into our overall risk management framework to ensure that cybersecurity risks are considered in all aspects of our business. The integration ensures that cybersecurity considerations are integral to our strategic and operational decision-making. Our management team works closely with our Chief Technology Officer (CTO) and Chief Information Security Officer (CISO), ensuring that our cybersecurity efforts align with our business objectives and operational needs. Key components of our cybersecurity approach include, among other things: • establishing a dedicated action team, led by our CTO and CISO, to oversee and manage cybersecurity risks; • implementing a comprehensive cybersecurity risk assessment process and strategy based on industry standards and established frameworks such as the National Institute of Standards and Technology (NIST) Special Publication 800-61; • implementing a vendor risk management program, which includes cybersecurity and data privacy audits, evaluating vendor risk level, and monitoring risk mitigation efforts; • conducting penetration tests and security maturity assessments throughout the year; • periodically engaging independent third-party assessors to audit our cybersecurity and information system programs to evaluate their effectiveness; • implementing industry-standard technologies and processes to protect our system and data and to help detect potential suspicious activity; • maintaining access controls to safeguard data and systems; • providing annual trainings to employees on responsible information security, data security and cybersecurity practices including appropriate action to take against cybersecurity threats; • conducting periodic phishing simulations to our employees; • engaging in cybersecurity incident tabletop exercises and scenario planning exercises; • maintaining a cybersecurity and information security risk insurance policy, which insures for data incidents or breaches and other technology related exposures; and • periodically reviewing and updating our IRP, privacy policy, and other relevant policies/procedures. These approaches are not exhaustive, and we plan to continuously improve our approaches to cybersecurity risk management.


text: In the three-year period ended March 31, 2024, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats or incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material threats or incidents. Refer to Part I, Item 1A, "Risk Factors - Risks Related to Technology, Data Security and Privacy" within this Annual Report for further information.


text: CYBERSECURITY GOVERNANCE Our Board of Directors has delegated to the Audit Committee primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and information security issues. Our CTO and CISO, who head our cybersecurity and information security initiatives, provide quarterly updates to the Audit Committee, and annual updates to the full Board of Directors. These updates cover various topics, such as efforts to enhance our cybersecurity posture, operational and incident metrics, mitigation actions, and key performance indicators like cybersecurity maturity, program health, and audit and compliance activities. In addition to these regular updates, significant cybersecurity incidents and updates are escalated on an as-needed basis in accordance with our IRP.


text: Our CTO and CISO have extensive experience in cybersecurity. Our CTO has served in his role since 2014. He has also served in various roles in Information Technology for over 25 years, including the oversight of Information Security for 15 years. Our CISO has served in various roles in Information Technology for over 25 years, including 15 years in Information Security. He holds a B.S. in Cybersecurity and Information Assurance, along with industry certifications that include the Information Systems Audit and Control Association Certified in Risk and Information Systems Control, Certified Information Security Manager, and International Information System Security Certification Consortium Certified Information Systems Security Professional certifications.


text: We also integrated cybersecurity risk management into our overall risk management framework to ensure that cybersecurity risks are considered in all aspects of our business. The integration ensures that cybersecurity considerations are integral to our strategic and operational decision-making. Our management team works closely with our Chief Digital & Data Officer (CDDO) and Chief Information Security Officer (CISO), ensuring that our cybersecurity efforts align with our business objectives and operational needs. Key components of our cybersecurity approach include, among other things: • establishing a dedicated action team, led by our CDDO and CISO, to oversee and manage cybersecurity risks; • implementing a comprehensive cybersecurity risk assessment process and strategy based on industry standards and established frameworks such as the National Institute of Standards and Technology (NIST) Special Publication 800-61; • implementing a vendor risk management program, which includes cybersecurity and data privacy audits, evaluating vendor risk level, and monitoring risk mitigation efforts; • conducting penetration tests and security maturity assessments throughout the year; • periodically engaging independent third-party assessors to audit our cybersecurity and information system programs to evaluate their effectiveness; • implementing industry-standard technologies and processes to protect our system and data and to help detect potential suspicious activity; • maintaining access controls to safeguard data and systems; • providing annual trainings to employees on responsible information security, data security and cybersecurity practices including appropriate action to take against cybersecurity threats; • conducting periodic phishing simulations to our employees; • engaging in cybersecurity incident tabletop exercises and scenario planning exercises; • maintaining a cybersecurity and information security risk insurance policy, which insures for data incidents or breaches and other technology related exposures; and • periodically reviewing and updating our IRP, privacy policy, and other relevant policies/procedures. These approaches are not exhaustive, and we plan to continuously improve our approaches to cybersecurity risk management.


text: In the three-year period ended March 31, 2025, our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any prior cybersecurity incidents experienced by either us or third parties, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. Refer to Part I, Item 1A, "Risk Factors - Risks Related to Technology, Data Security and Privacy" within this Annual Report for further information.


text: CYBERSECURITY GOVERNANCE Our Board has delegated to the Audit Committee primary responsibility for oversight of risk assessment and risk management, including risks related to cybersecurity and information security issues. Our CDDO and CISO, who head our cybersecurity and information security initiatives, provide quarterly updates to the Audit Committee, and annual updates to the full Board. These updates cover various topics, such as efforts to enhance our cybersecurity posture, operational and incident metrics, mitigation actions, and key performance indicators like cybersecurity maturity, program health, and audit and compliance activities. In addition to these regular updates, significant cybersecurity incidents and updates are escalated on an as-needed basis in accordance with our IRP.


text: Our CDDO and CISO have extensive experience in cybersecurity. Our CDDO has served in his role since September 2024. He has over 15 years of experience in digital transformations, enterprise technology, artificial intelligence, and data management. Our CISO has served in various roles in Information Technology for over 25 years, including 15 years in Information Security. He holds a B.S. in Cybersecurity and Information Assurance, along with industry certifications that include the Information Systems Audit and Control Association Certified in Risk and Information Systems Control, Certified Information Security Manager, and International Information System Security Certification Consortium Certified Information Systems Security Professional certifications.


text: Cybersecurity is an important part of our risk management program and an area of increasing focus for our Board and management. We maintain a robust cybersecurity infrastructure to safeguard our operations, networks, and data through comprehensive security measures including our technology tools, internal management, and external service providers.

companyName: CENTURY CASINOS INC /CO/

ticker: CNTY


text: Our Chief Information Officer ("CIO") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has over 14 years of experience in information technology and security positions. The CIO leads a team which includes our Corporate Director of Information Security and Senior Systems Engineer, with a combined 28 years of information technology and cybersecurity related experience. Both of these individuals hold Certified Information System Security Professional ("CISSP") certifications.


text: Our Board of Directors, primarily through the Audit Committee, oversees management's approach to managing cybersecurity risks. The Audit Committee, comprised solely of independent directors, is charged with overseeing the Company's risk management, including information technology and cybersecurity. The Audit Committee routinely engages with relevant management on a range of cybersecurity-related topics, including the threat of environment and vulnerability assessments, policies and practices, technology trends, and regulatory developments from the CIO.


text: We use a risk-based approach to identify, assess, protect, detect, respond to, and recover from cybersecurity threats, utilizing industry standard frameworks such as the National Institute of Standards and Technology Cybersecurity Framework, internal controls, and robust technological toolsets. Our information security program includes, among other aspects, penetration and vulnerability assessments and management, intrusion detection systems, antivirus and malware protection, encryption, access control, high availability and redundancy, and employee training. Risks identified by the CIO and other cybersecurity personnel are analyzed to determine the potential impact on us and the likelihood of occurrence. Such risks are continuously monitored to ensure that the circumstances and severity of such risks have not changed. The CIO also routinely discusses trends in cyber risks and our strategy with our Audit Committee and management on a regular basis, in addition to an annual review and discussion with the full board.


text: In addition, we engage independent third-party cybersecurity providers for vulnerability assessments and penetration testing. We regularly engage these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness training, and supplemental training as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the training and assess the need for additional controls and/or training.


text: Material cybersecurity incidents are required to be reported to the Board of Directors. As of the date of this report, we are not aware of any incidents from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: Our Chief Information Officer (" CIO ") is responsible for assessing, identifying, and managing the risks from cybersecurity threats. Our CIO has over 15 years of experience in information technology and security positions. The CIO leads a team which includes our Corporate Director of Information Security and Senior Systems Engineer, with a combined 29 years of information technology and cybersecurity related experience. Both of these individuals hold Certified Information Systems Security Professional ("CISSP") certifications.


text: In addition, we engage independent third-party cybersecurity providers for vulnerability assessments and penetration testing. We regularly engage these providers to aid in the identification and remediation of potential threats. We also endeavor to apprise employees of emerging risks and require them to undergo annual security awareness training, and supplemental training as needed. Additionally, we conduct periodic internal exercises to gauge the effectiveness of the training and assess the need for additional controls and/or training. Our teams evaluate the risk profile of third-party service providers, considering key risk factors such as cybersecurity measures, data privacy policies, and regulatory compliance. We maintain communication channels with key third-party service providers to assess and respond to potential impacts of incidents within a service provider's organization. We rely on our third parties to communicate such incidents to us in a timely manner. Beyond cybersecurity assessments, our teams conduct a structured due diligence process as part of our vendor compliance program for third-party providers that meet specific criteria set by us. We use third-party risk management services to evaluate additional risk factors, including but not limited to past or pending litigation, criminal history, derogatory information, and financial stability.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems. Such processes are periodically assessed against the National Institute of Standards and Technology cybersecurity framework and include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices.

companyName: CASELLA WASTE SYSTEMS INC

ticker: CWST


text: We engage external parties to supplement our internal capabilities and to assess our cyber maturity and readiness on a periodic basis. This includes being party to a managed services agreement with an external party for incident response; engaging an external party for comprehensive cybersecurity assessment, opportunity prioritization, initiative road mapping and cyber project delivery; and engaging additional external parties to assist with critical cyber-related infrastructure such as firewall maintenance and upgrade initiatives. While utilizing third-party service providers presents risk, we assess all third-party service providers for their qualifications before engaging them and monitor such providers throughout the term of the engagement in order to help protect us from any additional vulnerabilities.


text: We do not believe that there are currently any known risks from cybersecurity threats that are reasonably likely to materially affect us or our business strategy, results of operations or financial condition.


text: The Audit Committee of our Board of Directors ("Audit Committee") provides direct oversight over cybersecurity risk and acts in an advisory capacity to our management team, primarily, as it relates to cybersecurity, our Chief Information Officer ("CIO"), and provides updates to the Board of Directors regarding such oversight. The Audit Committee receives quarterly updates from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our CIO leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. This includes the utilization of a security operations center which deploys overlapping layers of security technology, monitoring, and staff for incident response. Should an incident arise, we, led by our CIO, follow a documented incident response plan, which includes activating retained third-party incident response specialists. The CIO's cybersecurity expertise is derived from over 30 years of experience in information technology, consulting, and technology transformation through ever-progressing leadership roles.


text: In an effort to deter and detect cyber threats, we provide key employees, with various cybersecurity trainings that cover timely and relevant topics, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: We have specific processes for assessing, identifying and managing cybersecurity risks, which are built into our information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and customer information from unauthorized access or attack, as well as secure our networks and systems. These processes are periodically assessed against the National Institute of Standards and Technology cybersecurity framework and include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and refine our practices. The processes are updated as needed on an annual basis.


text: Based on an assessment using the previously described cybersecurity risk management processes, we do not believe that there are currently any risks from cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Our CIO leads the operational oversight of our company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. This includes the utilization of a security operations center which deploys overlapping layers of security technology, monitoring, and staff for incident response. Should an incident arise, we, led by our CIO, follow a documented incident response plan, which includes activating retained third-party incident response specialists. The CIO's cybersecurity expertise is derived from over 30 years of experience in information technology, consulting, and technology transformation through ever-progressing leadership roles. Our CIO is supported by a dedicated team of cybersecurity professionals in addition to managed services and retained external experts.


text: In an effort to deter and detect cyber threats, we provide key employees with various cybersecurity trainings that cover a range of timely and relevant topics. The trainings function to educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks to our Company associated with cybersecurity threats. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees or customers; violation of privacy or security laws and other litigation and legal risk; and reputational risks. Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader enterprise risk management program process, covering other Company risks. As part of this process our enterprise risk professionals consult with Company subject matter experts to gather information necessary to identify cybersecurity risks, and evaluate their nature and severity, as well as identify mitigations and assess the impact of those mitigations on residual risk.

companyName: VIAVI SOLUTIONS INC.

ticker: VIAV


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a variety of privacy, cybersecurity, and incident response trainings and simulations, including regular phishing email simulations for all employees and contractors with access to corporate email systems; (4) tools designed to monitor our networks, systems and data for suspicious activity; (5) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and (6) a third-party risk management process for cybersecurity threat risks associated with our use of third-party service providers, including service providers, suppliers, and vendors. We leverage industry standard security frameworks, including from the National Institute of Standards and Technology and the International Organization for Standardization, to evaluate our security controls and manage risk. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident. Further, we conduct tabletop exercises to test and fortify the controls of our cybersecurity incident response program.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Please see the risk factor "Our business and operations could be adversely impacted in the event of a failure of information technology infrastructure." included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material information security breach incidents and the expenses we have incurred from information security breach incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Our Board of Directors (the Board) considers risks from cybersecurity threats as part of its risk oversight function and has delegated to the Audit Committee of the Board oversight of cybersecurity and other information technology risks. As set forth in its charter, our Audit Committee, comprised fully of independent directors, is responsible for oversight of risk, including cybersecurity and information security risk. Our Audit Committee has established a Cybersecurity Steering Committee consisting of three independent directors, Laura Black (who serves as Chair of the Cybersecurity Steering Committee), Douglas Gilstrap and Joanne Solomon, as well as our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other members of our management representing a variety of teams and functions including legal, finance, and internal audit. Members of our Cybersecurity Steering Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks.


text: The purpose of the Cybersecurity Steering Committee is to oversee our compliance with reasonable and appropriate organizational, physical, administrative and technical measures designed to protect the confidentiality, integrity, availability, security and operations of our information technology systems, transactions, and data owned by us, by providing guidance and oversight of our information technology and cybersecurity program.


text: The Cybersecurity Steering Committee generally meets on a quarterly basis and receives reports from the CISO and CIO of our cybersecurity and information security risk management and strategies, covering topics such as data security posture, results from third-party assessments, progress towards key initiatives, our incident response plan, and cybersecurity threat risks, incidents and developments. The Cybersecurity Steering Committee generally delivers reports and updates to the Audit Committee once a quarter.


text: The Audit Committee or, at the Audit Committee's instruction, the Cybersecurity Steering Committee regularly briefs the full Board on these matters, and the Board receives regular updates on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. Our full Board reviews cybersecurity related opportunities as they relate to our business strategy, and cybersecurity-related matters are also factored into business continuity planning. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.


text: Our CISO, in coordination with our CIO and our Information Security team, is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 9 years of experience in cybersecurity and information technology risk managing, including at another large public company. He also has a degree in computer science. Our CIO has over 15 years of information technology experience, which includes managing information security systems, developing cybersecurity strategy and implementing effective information and cybersecurity programs.


text: Our CISO and CIO supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, and alerts and reports produced by security tools deployed in the IT environment, such as vulnerability assessments, penetration testing, and tabletop exercises.


text: We have implemented a variety of cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess and manage such risks. Our approach includes: (1) an enterprise risk management program, which includes cybersecurity risks and is periodically refreshed; (2) security and privacy reviews designed to identify risks from many new features, software, and vendors; (3) a variety of privacy, cybersecurity, and incident response trainings and simulations, including regular phishing email simulations for all employees and contractors with access to corporate email systems; (4) tools designed to monitor our networks, systems and data for suspicious activity; (5) the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; and (6) a third-party risk management process for cybersecurity threat risks associated with our use of third-party service providers, including service providers, suppliers, and vendors. We leverage industry standard security frameworks, including from the National Institute of Standards and Technology and the International Organization for Standardization, to evaluate our security controls and manage risk. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use these frameworks as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident.


text: Our Incident Response Plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident. Further, we conduct tabletop exercises to test and fortify the controls of our cybersecurity incident response program.


text: We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. Please see the risk factor "Our business and operations could be adversely impacted in the event of a failure of information technology infrastructure." included as part of our risk factor disclosures under Item 1A of this Annual Report on Form 10-K, which disclosure is incorporated by reference herein.


text: Our Board of Directors (the Board) considers risks from cybersecurity threats as part of its risk oversight function and has delegated to the Audit Committee of the Board oversight of cybersecurity and other information technology risks. As set forth in its charter, our Audit Committee, comprised fully of independent directors, is responsible for oversight of risk, including cybersecurity and information security risks. Our Audit Committee has established a Cybersecurity Steering Committee consisting of three independent directors, Laura Black (who serves as Chair of the Cybersecurity Steering Committee), Douglas Gilstrap and Joanne Solomon, as well as our Chief Information Officer (CIO), our Chief Information Security Officer (CISO) and other members of our management representing a variety of teams and functions including legal, finance, and internal audit. Members of our Cybersecurity Steering Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks.


text: The Audit Committee or, at the Audit Committee's instruction, the Cybersecurity Steering Committee regularly briefs the full Board on these matters, and the Board receives regular updates on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. Our full Board reviews cybersecurity-related opportunities as they relate to our business strategy, and cybersecurity-related matters are also factored into business continuity planning. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported to the Audit Committee.


text: Our CISO, in coordination with our CIO and our Information Security team, is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has more than 10 years of experience in cybersecurity and information technology risk management, including at another large public company. He also has a degree in computer science. Our CIO has over 15 years of information technology experience, which includes managing information security systems, developing cybersecurity strategies and implementing effective information and cybersecurity programs.


text: Cyber Risk Management and Strategy The Company, under the oversight of the Audit Committee of its Board of Directors, has implemented and maintains a cybersecurity risk management program that includes processes for the systematic identification, assessment and treatment (through mitigation, transfer, avoidance and/or acceptance) of cybersecurity risks. This program extends to third-party vendors and the various properties under the Company's management, including corporate and commercial properties, through establishing vendor risk requirements and conducting vendor risk assessments.

companyName: MACERICH CO

ticker: MAC


text: This risk management program addresses, but is not limited to, risks identified by external auditors and assessors, internal auditors and assessors, threat intelligence providers, internal stakeholders, vulnerability management programs and security management programs. An internal audit team at the Company manages and maintains remediation strategies for identified risks, and reports on them regularly to senior leadership. As part of the Company's cyber risk management program, the Company has engaged external independent assessors to conduct cyber risk assessments, evaluate cyber risk management controls, and report both findings and recommendations to management.


text: The Company, like other companies in its industry, faces a number of cybersecurity risks in connection with its business. Although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date, the Company has, from time to time, experienced threats to and security incidents related to its data and systems. For more information about the cybersecurity risks the Company faces, see Item 1A. Risk Factors.


text: Governance Related to Cybersecurity Risks The Company's cyber risk management program and related operations and processes are directed by the Senior Vice President of Information Technology (the "SVP-IT"). Currently, the SVP-IT role is held by an individual who has over twenty five years of cybersecurity, information technology and systems engineering experience. The SVP-IT meets with the Chief Financial Officer and Chief Legal Officer quarterly to monitor and review the outcomes of the Company's cybersecurity risk management processes and to discuss and decide matters related to cybersecurity risk treatment strategy (including mitigations).


text: The Company also formed the Business Continuity Plan ("BCP") and Cyber Security Risk Committee (the "Security Committee"), which oversees the prioritization and escalation of risks from cybersecurity threats to senior leadership, is chaired by the SVP-IT and the Executive Vice President of Portfolio Operations and People. The Security Committee reports to the Chief Financial Officer and Chief Legal Officer, and the committee's members include senior company leadership responsible for asset management, risk management, marketing, and business development. Collectively, the Security Committee members possess experience in information security, risk management, oversight and legal compliance.


text: The Company's Board of Directors plays an important role in risk oversight and discharges its duties both as a full board and through its committees. The Board has delegated oversight of risk management matters, including cybersecurity and information technology matters, to its Audit Committee. As reflected in the Audit Committee charter, the committee is responsible for reviewing information technology, cybersecurity and other data protection strategies and plans, as well as assessing incident response protocols. The Security Committee provides quarterly reports to the Audit Committee and the SVP-IT attends board meetings yearly, or more frequently as appropriate, to inform the Company's Board of Directors on cybersecurity risks.


text: Additionally, the Company is subject to the requirements of the Sarbanes-Oxley Act of 2002 and information technology general controls are an important part of the Company's internal control over financial reporting and are subject to controls testing. Control deficiencies that represent cybersecurity risks would be reported by management to the Audit Committee.


text: The Company also formed the Business Continuity Plan ("BCP") and Cyber Security Risk Committee (the "Security Committee"), which oversees the prioritization and escalation of risks from cybersecurity threats to senior leadership, is chaired by the SVP-IT and the Executive Vice President of Portfolio Operations and People. The Security Committee reports to the Chief Financial Officer and Chief Legal Officer, and the committee's members include senior company leadership responsible for asset management, risk management, property management, marketing, and business development. Collectively, the Security Committee members possess experience in information security, risk management, oversight and legal compliance.