text: To assess, identify and manage material risks from cybersecurity threats and to prevent, detect and respond to cybersecurity threats, including threats associated with the use of third-party service providers, the Company has a robust cybersecurity program. The Company's global cybersecurity team, overseen by the CIO, implements policies and procedures and uses a balanced approach to validate the effectiveness of the program, leveraging third party expert security resources, information technology resources, executive business leadership, internal and external audit, third-party vendors and other IT and business partners. The program uses a combination of standards and best practices from the National Institute of Standards and Technology, Center of Internet Security, third-party vendor partners, and other industry forums. Annually, the program is assessed both internally and externally, including a thorough industry benchmarking, maturity assessments, best practice reviews, and risk assessments, with control validation occurring monthly internally (focused on core critical controls), quarterly (focused on vulnerabilities/cyber-incident simulations) and annually (focused on a review of best practices) via third-party vendors and partners, and annually via external third parties, including the conduct of internal/external penetration tests and tabletop exercises. Third-party service providers are assessed initially based on security questionnaires and the access of third-party service providers is audited annually and/or with any change in circumstances. Third-party service providers are also monitored through a combination of security information and event management technology and managed detection response services. The CIO provides key results and findings from these assessments to the cybersecurity governance council and Audit Committee. The Company has a robust incident response plan intended to help provide timely remediation to cybersecurity incidents and also to help provide notice of any material incidents to the appropriate internal and external entities.


text: To help associates acquire the knowledge to support the protection of our environment, the Company provides comprehensive annual security awareness training, periodic information updates, and regular testing/training programs. In addition, the Company annually purchases a cybersecurity insurance policy.

companyName: Zurn Elkay Water Solutions Corp

ticker: ZWS

secItem: Item 1C


text: The Company depends heavily on information technology infrastructure to manage our business objectives and operations, support our customers' requirements and protect sensitive information. To date, the Company has not experienced a cybersecurity threat or cybersecurity incident that has materially affected the Company, including our business strategy, results of operations or financial condition. While the Company has a robust cybersecurity program in place and has taken steps to maintain and enhance its cybersecurity, a material security breach could impede the Company's ability to carry on business in the normal course.


text: As we have previously described in Item 1A, Risk Factors, there have been significant and increasing instances of data and security breaches, malicious interference with technology systems and industrial espionage involving companies in numerous industries, including cloud providers, and cybersecurity threats are becoming more complex. In addition, at times a large percentage of our workforce may be working remotely in response to outbreaks of infectious disease, which may heighten these risks. While we have taken steps to maintain and enhance our cybersecurity by implementing additional security technologies, internal controls, network and data center resiliency, redundancy and disaster recovery processes and backup systems, upgrading our remote work environment and by obtaining insurance coverage, these measures may be inadequate and our technology systems could be vulnerable to disability, failures, or unauthorized access. As a result, any inability by us to successfully manage our information systems, or respond effectively to any attack on or interference with our systems, including matters related to system and data security, privacy, reliability, compliance, performance and access, problems related to our systems caused by natural disasters, security breaches or malicious attacks, and any inability of these systems to fulfill their intended business purpose, could impede our ability to record or process orders, manufacture and ship in a timely manner, account for and collect receivables, protect sensitive data of the Company, our customers, our employees, our suppliers and other business partners, comply with our third party obligations of confidentiality and care, or otherwise carry on business in the normal course. Any such events could require costly remediation beyond levels covered by insurance and could cause us to lose customers and/or revenue, including as a result of legal or regulatory claims or proceedings, or damage our reputation, any of which could have a material adverse effect on our business and operating results. We are also subject to an increasing number of evolving data privacy and security laws and regulations that impose requirements on us. We collect, store, access and otherwise process various types of confidential or sensitive data, including proprietary business information, personal data and other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. Failure to comply with such laws and regulations could result in the imposition of fines, penalties and other costs.


text: Zurn Elkay's management and Board recognize the importance of robust oversight of cybersecurity risk, information security, and technology risk in maintaining the trust and confidence of our customers, partners, employees, and stockholders. The Audit Committee, on behalf of the Board, oversees the Company's material financial and other risk exposures, including risks related to cybersecurity. Our Board has extensive cybersecurity experience, including two members of the Audit Committee who have received a certificate in cybersecurity oversight from the Carnegie Mellon University Software Engineering Institute. Cybersecurity risk also is monitored, assessed and managed as part of the Company's integrated Enterprise Risk Management program. A cybersecurity governance council, comprised of executive leaders, including the two members of the Audit Committee with cybersecurity experience, meets at least quarterly to review the Company's cybersecurity program and its effectiveness. This cybersecurity governance council receives updates and reports from the Company's global cybersecurity team (discussed below) on the cybersecurity program and its effectiveness relating to the prevention, detection, mitigation and remediation of cybersecurity incidents. The Chief Information Officer (CIO) provides periodic updates to the Audit Committee on any material initiatives and key updates on the cybersecurity program and its effectiveness, including any material threats. The CIO also provides an annual update regarding information security to the full Board. The CIO has more than 36 years of information technology experience, including approximately 18 years serving as a CIO.


text: As we have previously described in Item 1A, Risk Factors, there have been significant and increasing instances of data and security breaches, malicious interference with technology systems and industrial espionage involving companies in numerous industries, including cloud providers, and cybersecurity threats are becoming more complex. In addition, at times a large percentage of our workforce may be working remotely, which may heighten these risks. While we have taken steps to maintain and enhance our cybersecurity by implementing additional security technologies, internal controls, network and data center resiliency, redundancy and disaster recovery processes and backup systems, upgrading our remote work environment and by obtaining insurance coverage, these measures may be inadequate and our technology systems could be vulnerable to disability, failures, or unauthorized access. As a result, any inability by us to successfully manage our information systems, or respond effectively to any attack on or interference with our systems, including matters related to system and data security, privacy, reliability, compliance, performance and access, problems related to our systems caused by natural disasters, security breaches or malicious attacks, misuse of artificial intelligence tools, and any inability of these systems to fulfill their intended business purpose, could impede our ability to record or process orders, manufacture and ship in a timely manner, account for and collect receivables, protect sensitive data of the Company, our customers, our employees, our suppliers and other business partners, comply with our third party obligations of confidentiality and care, or otherwise carry on business in the normal course. Any such events could require costly remediation beyond levels covered by insurance and could cause us to lose customers and/or revenue, including as a result of legal or regulatory claims or proceedings, or damage our reputation, any of which could have a material adverse effect on our business and operating results. We are also subject to an increasing number of evolving data privacy and security laws and regulations that impose requirements on us. We collect, store, access and otherwise process various types of confidential or sensitive data, including proprietary business information, personal data and other information that is subject to privacy and security laws, regulations and/or customer-imposed controls. Failure to comply with such laws and regulations could result in the imposition of fines, penalties and other costs.


text: Cybersecurity Risk Management As part of our overall risk management system, we have established certain procedures to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management system is designed to align with industry best practices, including International Organization for Standardization, or ISO, standards, provide a framework for handling cybersecurity threats and incidents, and facilitate coordination across different departments of our company. As part of this system, we have a formally documented information security management program and conduct regular tabletop exercises that include participation from executive officers. In addition, we engage consultants and other third parties who are experts in the cybersecurity risk management field to review and provide testing services as well as general incident management services. These engagements directly contribute to industry certifications and attestations that demonstrate our dedication to protecting the data that we are entrusted with by customers. Our Governance, Risk and Compliance team within the information security management program oversees and identifies material cybersecurity risks associated with our use of these third-party service providers through a formal vendor security risk management program.

companyName: APPIAN CORP

ticker: APPN


text: Board Governance Disclosure One of the Board's key functions is informed oversight of our risk management process, which includes responsibility for ensuring management has processes in place designed to identify, evaluate, manage, and mitigate cybersecurity risks to which it is exposed. The Board receives regular updates, on at least a quarterly basis, from our senior management team on such cybersecurity risks, developments in cybersecurity, and updates to the Company's information security management program. The Board is also involved in strategic decisions related to the impact of these risks on our business.


text: Management Governance Disclosure Our senior management team, which includes our Chief Information Security Officer, or CISO, is responsible for identifying, assessing, and managing material risks from cybersecurity threats, as well as for establishing processes to ensure such risks are monitored and mitigated, with the CISO taking the lead on such matters. Our CISO, who joined Appian in May 2021, brings over 17 years' experience in security and compliance initiatives, including experience in the software-as-a-service and platform-as-a-service cloud industries. We have documented the framework and process for when and by whom senior management is informed and when such information will be reported to the other parties in our Incident Response Guide, which is regularly reviewed and updated by the information security team.


text: Cybersecurity Risk Management As part of our overall risk management system, we have established certain procedures to assess, identify, and manage material risks from cybersecurity threats. Our cybersecurity risk management system is designed to align with industry best practices, including International Organization for Standardization, or ISO, standards, provide a framework for handling cybersecurity threats and incidents, and facilitate coordination across different departments of our company. As part of this system, we have a formally documented information security management program and conduct regular tabletop exercises that include participation from executive officers. In addition, we engage consultants and other third parties who are experts in the cybersecurity risk management field to review and provide testing services as well as general incident management services. These engagements directly contribute to industry certifications and attestations that demonstrate our dedication to protecting the data that we are entrusted with by customers. Our Governance, Risk, and Compliance team within the information security management program oversees and identifies material cybersecurity risks associated with our use of these third-party service providers through a formal vendor security risk management program.


text: Management Governance Disclosure Our senior management team, which includes our Chief Information Security Officer, or CISO, is responsible for identifying, assessing, and managing material risks from cybersecurity threats, as well as for establishing processes to ensure such risks are monitored and mitigated, with the CISO taking the lead on such matters. Our CISO, who joined Appian in May 2021, brings over 18 years' experience in security and compliance initiatives, including experience in the software-as-a-service and platform-as-a-service cloud industries. We have documented the framework and process for when and by whom senior management is informed and when such information will be reported to the other parties in our Incident Response Guide, which is regularly reviewed and updated by the information security team.


text: Cybersecurity Risk Management At MongoDB, cybersecurity risk management is an integral part of our overall information security program, which we review and update at least annually to reflect changes to our organization, business practices, technology and services, and applicable legislation and regulations. Our information security program is designed to align with the National Institute of Standards and Technology Cyber Security Framework and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third parties. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of a cybersecurity threat or incident including whether the cybersecurity threat or incident is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. In addition, our information security team provides ongoing education to and requires mandatory training at least once annually of all employees. To bolster the security of our products and services, we have appropriate technical and organizational measures in place to protect data that our customers upload to MongoDB Atlas, which is certified against ISO 27001:2013, ISO 27017:2015, ISO 27018:2019, SOC 2 Type II, Payment Card Industry Data Security Standard v.4, and Cloud Security Alliance ("CSA") Security, Trust, Assurance, Information Security Registered Assessors Program and Risk ("STAR") Level 2. We also engage third parties to perform annual audits of our standards-based certifications and we have undergone a Health Insurance Portability and Accountability Act examination validated by a qualified third-party assessor.

companyName: MongoDB, Inc.

ticker: MDB


text: Our board of directors has overall oversight responsibility for our enterprise risk management, and delegates cybersecurity risk management oversight to its Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. In addition, on a quarterly basis, certain members of our board of directors meet with our Chief Information Security Officer, ("CISO"), and other senior executives to perform more in-depth reviews of the Company's cybersecurity programs, as well as relevant cybersecurity risks and mitigation strategies and report back to the Audit Committee regarding the matters reviewed. Ahead of each such quarterly meeting, management, including the CISO and our information security team, prepares and provides cybersecurity reports that cover, among other topics, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies, legislative developments affecting MongoDB's information security program, and notable security incidents and investigations. The Audit Committee subsequently reports material cybersecurity matters to our full board of directors. In addition, our management follows a risk-based escalation process to notify the Audit Committee outside of the regular reporting cycle when they identify an emerging cybersecurity risk.


text: Our cybersecurity programs are under the direction of our CISO, who receives reports from our information security team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and dedicated security leaders are certified and experienced information systems security professionals and information security managers each with well over a decade of experience. Our CISO and information security team, along with our management, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity programs.


text: Despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors – Risks Related to our Business and Industry" in this annual report on Form 10-K.


text: Cybersecurity Risk Management At MongoDB, cybersecurity risk management is an integral part of our overall information security program, which we review and update at least annually to reflect changes to our organization, business practices, technology and services, and applicable legislation and regulations. Our information security program is designed to align with the National Institute of Standards and Technology Cyber Security Framework and provides a framework for handling cybersecurity threats and incidents, including threats and incidents associated with the use of services provided by third parties. This framework includes steps for assessing the severity of a cybersecurity threat or incident, identifying the source of a cybersecurity threat or incident including whether the cybersecurity threat or incident is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies and informing management and our board of directors of material cybersecurity threats and incidents. In addition, our information security team provides ongoing education to and requires mandatory training at least once annually of all employees. To bolster the security of our products and services, we have appropriate technical and organizational measures in place to protect data that our customers upload to MongoDB Atlas, which is certified against ISO 27001:2022, ISO 27017:2015, ISO 27018:2019, ISO 9001:2015, SOC 2 Type II, Payment Card Industry Data Security Standard v.4, and Cloud Security Alliance ("CSA") Security, Trust, Assurance, Information Security Registered Assessors Program and Risk ("STAR") Level 2. We also engage third parties to perform annual audits of our standards-based certifications and we have undergone a Health Insurance Portability and Accountability Act examination validated by a qualified third-party assessor.


text: Our board of directors has overall oversight responsibility for our enterprise risk management, and delegates cybersecurity risk management oversight to its Security Committee, which was established this past year. The Security Committee is responsible for ensuring that management has processes in place designed to identify and assess cybersecurity risks to which the Company is exposed and implement processes and programs designed to manage cybersecurity risks, including mitigation and remediation of cybersecurity threats and incidents. On a quarterly basis, the Security Committee meets with our Chief Information Security Officer, ("CISO"), and other senior executives to perform more in-depth reviews of the Company's cybersecurity programs, as well as relevant cybersecurity risks and mitigation strategies. Ahead of each such quarterly meeting, management, including the CISO and our information security team, prepares and provides cybersecurity reports that cover, among other topics, developments in cybersecurity and updates to the company's cybersecurity programs and mitigation strategies, legislative developments affecting MongoDB's information security program, and notable security incidents and investigations. The Security Committee subsequently reports material cybersecurity matters to our full board of directors. In addition, our management follows a risk-based escalation process to notify the Security Committee outside of the regular reporting cycle when they identify an emerging cybersecurity risk.


text: Our cybersecurity programs are under the direction of our CISO, who receives reports from our security teams and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CISO and key security leaders are certified and experienced information systems security professionals, security engineers, and information security managers each with well over a decade of experience. Our CISO and security teams, along with our management, are responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity programs.


text: As one of the world's largest cybersecurity solution providers, we routinely defend against advanced persistent threats both internally and for our clients. Our cybersecurity risk management program is an integral part of our overall enterprise risk management program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents.

companyName: Booz Allen Hamilton Holding Corp

ticker: BAH


text: Risk Management and Strategy Our Board and its committees oversee the Company's risk management processes, including but not limited to those relevant to cybersecurity risks, and are regularly briefed by management on risk management considerations. One of the primary tools that facilitates the Board's oversight and mitigation of risk is the Company's Enterprise Risk Management ("ERM") Program, which is designed to look holistically at risks which may cause a material, adverse impact to the Company's operations, reputation, or value. As part of the ERM Program, our Chief Operating Officer directs and chairs the ERM Steering Committee, which is comprised of members of senior management, including our Chief Financial Officer, General Counsel, Chief Information Officer, Chief Information Security Officer, Chief Administrative Officer, and Chief Ethics and Compliance Officer.


text: Under the ERM Program, our Chief Operating Officer prepares for the Board a quarterly update of our enterprise risks, including but not limited to enterprise cybersecurity risks, and conducts with the Board an annual risk identification and mitigation analysis. In addition to updates provided through the ERM Program, the Board is regularly updated by members of management, including the Chief Accounting Officer, Chief Legal Officer, and members of the ERM Steering Committee concerning significant risks facing the Company and processes that have been implemented to mitigate these risks, including but not limited to cybersecurity risks. Additionally, throughout the year, each of our sector presidents who leads one of our major market units provides a comprehensive overview of their market, including risks and challenges. See "Item 1C. Cybersecurity—Governance—Management's Responsibilities" below for additional information regarding our cybersecurity risk management program.


text: We also conduct periodic internal and third-party assessments, threat simulations, and exercises to test the effectiveness of our cybersecurity defenses and controls, including associated policies and procedures. We undertake efforts to address and mitigate risks from vulnerabilities identified during such assessments, simulations, and exercises.


text: Management's Responsibilities Our cybersecurity risk management program is led by our Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"), who are responsible for our information security strategy, policies, security architecture and engineering, security operations, and cybersecurity threat detection and response. Our CIO has over 25 years of information technology and program management experience, addressing complex information technology and cybersecurity challenges for large-scale enterprises in the U.S. Department of Defense, U.S. federal agencies, and commercial organizations. Our CISO, a Certified Information Systems Security Professional ("CISSP"), has over 20 years of information security and program management experience and has served as the CISO for several large-scale enterprises in the U.S. government services industry, commercial organizations, and not-for-profit organizations.


text: As a government contractor, we are required to comply with extensive regulations and standards, including but not limited to cybersecurity regulations and standards and the requirements of the DFARS. Additionally, our cybersecurity risk management program is guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our policies and implemented controls have been assessed by external organizations, including industry partners and the federal government. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks and, as appropriate, require them to comply with applicable laws and regulations. These contractual requirements include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. government.


text: To manage cybersecurity risk introduced from our supply chain, depending on the nature of a supplier's work and the sensitivity of the Booz Allen and client information provided to the supplier, we also require suppliers to complete our security questionnaires (based on data categorization) and provide evidence of security accreditations, and we evaluate supplier compliance with security requirements using internal and third-party resources.


text: Our CIO and CISO also lead our Cyber Fusion Center ("CFC"), whose function is, pursuant to our Cyber Incident Response Plan, to stay apprised of existing and emerging cybersecurity threats and monitor our information systems to proactively identify, protect against, and mitigate cybersecurity threats. The CFC uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for and address adversary activity against our information systems. The CFC possesses in-depth knowledge of network, endpoint, perimeter security systems, identity-based vulnerabilities, data protection, threat intelligence, forensics, penetration testing, and malware reverse engineering, as well as the functioning of specific applications or underlying information systems infrastructure.


text: The Cyber Incident Response Team ("CIRT") is responsible for the incident response process and provides direction and guidance to users of Booz Allen information systems when responding to cybersecurity incidents. The CIRT also provides intrusion monitoring of networks and information systems, and performs triage and analysis of events to identify potential incidents, including potential incidents occurring on third-party systems. The CIRT categorizes anomalous cybersecurity events into discrete levels in which cybersecurity events are escalated to appropriate levels of management, as well as our Cyber Incident Materiality Committee, Audit Committee, and Board, based on the severity of the incident. While typical cybersecurity management and incident response is provided by internal resources, we have arrangements with certain third parties whom we can engage if additional support and resources are required.


text: Board of Directors' Roles and Responsibilities The Audit Committee is responsible for oversight of the Company's risk management and mitigation, including but not limited to the Company's cybersecurity risks, and is regularly briefed by our CIO and CISO regarding the Company's cybersecurity risk management program, cybersecurity incidents involving the Company, vendors, suppliers, subcontractors and other third parties, as well as associated mitigation actions taken, in order to assess and manage associated risks and potential harm and damages. The Audit Committee reports to the Board on cybersecurity risks to the Company on a periodic basis.


text: Cybersecurity Threats Even with our extensive and systematic approach to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cybersecurity insurance, the cost related to cybersecurity threats or disruptions may not be fully insured.


text: During the period covered by this Annual Report, we have not experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or our financial condition. Future cybersecurity incidents could, however, materially affect our business strategy, results of operations, reputation, or financial condition. See Item 1A., "Risk Factors," for a discussion on cybersecurity risks and how they could materially affect the Company.


text: As one of the world's largest cybersecurity solution providers, we routinely defend against advanced persistent threats both internally and for our customers. Our cybersecurity risk management program is an integral part of our overall Enterprise Risk Management ("ERM") program, and is designed to assess, identify, manage and mitigate internal and external cybersecurity risks, threats and incidents.


text: Risk Management and Strategy Cybersecurity oversight is embedded in our ERM Steering Committee, chaired by the Chief Operating Officer and including senior executives such as the Chief Information Security Officer ("CISO") and Chief Information Officer ("CIO"). This committee is responsible for: • Identifying, assessing, and managing cybersecurity risks within the broader ERM framework; • Aligning cybersecurity risk management priorities and strategies with business objectives; • Monitoring periodic internal and third-party assessments, threat simulations, and security exercises to evaluate cybersecurity defenses; and • Addressing identified vulnerabilities through mitigation efforts and risk response strategies. See "Item 1C. Cybersecurity—Governance—Management's Responsibilities" below for additional information regarding our cybersecurity risk management program.


text: Management's Responsibilities Our cybersecurity risk management program is led by our CISO, who is responsible for our information security strategy, policies, compliance, security architecture and engineering, security operations, and cybersecurity threat detection and response. Our CISO, a Certified Information Systems Security Professional ("CISSP"), has over 20 years of information security and program management experience and has served as the CISO for several large-scale enterprises in the U.S. government services industry, commercial organizations, and not-for-profit organizations.


text: As a government contractor, we are required to comply with extensive regulations and standards, including but not limited to, cybersecurity regulations and standards and the requirements of the DFARS. Additionally, our cybersecurity risk management program is guided by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Our policies and implemented controls have been assessed by external organizations, including industry partners and the federal government. We work closely with our subcontractors and suppliers to identify and manage cybersecurity risks and, as appropriate, require them to comply with applicable laws and regulations. These contractual requirements include the requirement that our subcontractors implement certain security controls, and that our subcontractors self-report the status of their implementation of these controls to the U.S. government.


text: To manage cybersecurity risk introduced from our supply chain, depending on the nature of a supplier's work and the sensitivity of our and our customers' information provided to the supplier, we also require suppliers to complete our security questionnaire and provide evidence of security accreditations, and we evaluate supplier compliance with security requirements using internal and third-party resources.


text: Our CISO also leads our Cyber Fusion Center ("CFC"), whose function is, pursuant to our Cyber Incident Response Plan, to stay apprised of existing and emerging cybersecurity threats and monitor our information systems to proactively identify, protect against, and mitigate cybersecurity threats. The CFC uses intelligence collected from various sources, fused with intelligence collected from analysis and response actions, to proactively search for and address adversary activity against our information systems. The CFC possesses in-depth knowledge of network, endpoint, perimeter security systems, identity-based vulnerabilities, data protection, threat intelligence, forensics, penetration testing, and malware reverse engineering, as well as the functioning of specific applications or underlying information systems infrastructure. The CFC partners with a third party managed systems security provider ("MSSP") to augment 24x7 cyber incident monitoring.


text: The Cyber Incident Response Team ("CIRT") is responsible for the incident response process and provides direction and guidance to users of our information systems when responding to cybersecurity incidents. The CIRT also provides intrusion monitoring of networks and information systems, and performs triage and analysis of events to identify and respond to potential incidents, including potential incidents occurring on third-party systems. The CIRT categorizes anomalous cybersecurity events into discrete levels in which cybersecurity events are escalated to appropriate levels of management, as well as our Crisis Management Team, Cyber Incident Materiality Committee, Audit Committee, and Board, based on the severity of the incident. While typical cybersecurity management and incident response is provided by internal resources, we have arrangements with certain third parties whom we can engage if additional support or resources are required.


text: Board of Directors' Roles and Responsibilities The Board oversees the Company's risk management processes, including those relevant to cybersecurity risks, and the Audit Committee provides focused governance of cybersecurity, ensuring that cybersecurity threats, vulnerabilities, and incident response measures are continuously assessed and managed. The Audit Committee receives regular briefings from the CISO on risks related to internal systems, third-party relationships, and emerging cybersecurity threats. The Audit Committee provides updates to the Board on significant cybersecurity risks and the Company's mitigation strategies.


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: NEVRO CORP


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (i) our cybersecurity risk assessment processes, (ii) our security controls, and (iii) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on assessment of their criticality to our operation and respective risk profile, suppliers, and vendors that have access to our critical systems and information.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations,business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program.


text: The Committee receives periodic reports from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding any cybersecurity incidents, as well as any incidents it considers to be significant or potentially significant.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Information Security Officer (CISO), internal security staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal information technology personnel who in turn manage our retained external cybersecurity consultants. Our management team's experience includes significant responsibility for developing and maintaining cybersecurity risk management programs and for managing cybersecurity risks prior to joining us.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal information technology personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our internal information technology environment.


text: Our CISO oversees our cybersecurity risk management in partnership with our Chief Financial Officer, General Counsel, Chief Compliance and Privacy Officer and other members of management. These members of management monitor and are informed of the prevention, mitigation, detection and remediation of cybersecurity incident through their management of, and participation in, the cybersecurity risk management and strategy processes described above.


text: Our CISO has worked for over 30 years in information technology, including the areas of infrastructure, security and application architecture. In the last 15 years, he has worked in security for healthcare, pharmaceutical and technology companies, the last six years as CISO. He earned his Bachelor of Science in Electronic Engineering from Universidade Federal do Rio de Janeiro in Brazil.


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size taking into account our operations.

companyName: LXP Industrial Trust

ticker: LXP


text: Management and Board Oversight Our enterprise risk management framework was developed in conjunction with a third-party that objectively assessed key stakeholder responses to questionnaires on our operations and business functions, including information technology and cybersecurity. Our internal controls over financial reporting include key controls covering certain information technology and cybersecurity processes that are documented and tested annually.


text: The Audit and Cyber Risk Committee of our Board of Trustees assists our Board of Trustees on oversight of management in connection with regularly assessing our key risks and engaging in enterprise-wide risk management as they relate to cybersecurity and our technology and information systems, including with respect to strategies, objectives, capabilities, initiatives, policies and investments. A member of our Board of Trustees and the Audit and Cyber Risk Committee of our Board of Trustees is a recognized cybersecurity expert as a member of the Tech & Cybersecurity Advisory Committee for U.S. Senator Mark Warner and having been an investor in and director of private and public technology-focused companies.


text: We employ a Director of Information Technology who works exclusively on information technology and cybersecurity matters and has over 28 years of related experience. We employ a Director of ESG and Corporate Operations who spends part of her business time on information technology matters, specifically business applications, and has 11 years of related experience. Both employees report to our Chief Operating Officer.


text: Due to our size and the size of our employee base, we use third-party vendors to assist us with our network and information technology requirements. Since 2019, BDO USA, LLC ("BDO") has acted as our outsourced chief technology officer/chief information security officer ("CTO/CISO") and provided us with the following services through a dedicated partner in BDO Digital's Security & Compliance: • Overseeing chief security role and informing leadership of cybersecurity risks and the role of staff in protecting information, including, but not limited to: Monitoring emerging risks, suggesting and overseeing implementation of mitigations; Championing security awareness and training programs; and Reporting significant security events to leadership.


text: • Guidance regarding incidence response, business continuity and disaster recovery program, strategy and testing. • Oversight and guidance on vendor risk management processes and individual vendor profiles. • IT strategy advice. • Monitoring the relationship with our information technology managed services provider. • Technical, policy and procedure recommendations.


text: Together with our Director of Information Technology, BDO reports frequently to our Chief Operating Officer and General Counsel and to the Audit and Cyber Risk Committee of our Board of Trustees on a quarterly basis.


text: We outsource our information technology managed services to a third-party provider of customized private cloud solutions featuring virtual desktops and servers. Our Director of Information Technology, together with BDO, oversees the third-party managed service provider ("MS Provider").


text: We maintain a critical systems vendor management program with the assistance of a third-party provider of vendor risk intelligence data, including cybersecurity vulnerabilities, business health and credit risk.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize a regularly updated incident response plan. Our incident response plan was developed to guide the internal response to incidents taking into account a recognized third party cybersecurity framework. Pursuant to our incident response plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the incident response team is made up of two teams: the information security response team and the business response team. The information security response team is generally led by our Chief Operating Officer and includes our CTO/CISO, our Director of Information Technology, our MS Provider account manager, our Chief Financial Officer and other members of our senior leadership. The business response team includes primary and secondary contacts for each impacted business area. These individuals assist with any necessary customer notification procedures. The incident response team regularly reports to senior management, including the CEO, in the event of a significant incident, and our Chief Operating Officer and Chief Financial Officer provide reports to our Audit and Cyber Risk Committee and our Board of Trustees.


text: The Audit and Cyber Risk Committee oversees, on behalf of the Board of Trustees, our information technology and cybersecurity strategy and initiatives. Our Board of Trustees has determined that one of the members of our Audit and Cyber Risk Committee is an information technology/cybersecurity expert and has significant experience in, among other areas, emerging technologies and coordinating national security and technology policy. On at least a quarterly basis, our Chief Operating Officer, CTO/CISO and Director of Information Technology report to our Audit and Cyber Risk Committee on information technology matters, including cybersecurity. Our Audit and Cyber Risk Committee then updates the Board of Trustees following management's update. On a periodic basis, our Audit and Cyber Risk Committee commissions an external assessment of our cybersecurity practices and receives a report from the third-party firm performing our internal audit function. The most recent assessment was completed in 2023.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from, and reporting cybersecurity events.


text: Prevention and Preparation As noted above, we utilize our MS Provider for cloud-based information technology services. This third-party solution includes 24/7 monitoring and is built to the NISI/ISO framework. We also engage a nationally recognized public accounting firm to perform periodic cybersecurity assessments, which entail performing a qualitative current state evaluation of our cybersecurity program in line with specific domains within the recognized third party framework. In addition, we take the following preventative measures: • We engage a third party to perform internal and external penetration tests on an annual basis. • We require multi-factor authentication for our network and primary applications. • We utilize geolocation-based blocking.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is annual employee training on cybersecurity around phishing, malware and other cyber risks. We use a third-party provider of security awareness training and simulated phishing for our email phishing reporting and cyber security training. Our employees are required to complete quarterly cybersecurity training programs.


text: We maintain comprehensive business continuity and disaster recovery plans, which update on at least an annual basis and we test through tabletop exercises on an annual basis. We do not maintain any on-premises data or servers.


text: We are exposed to risks from interactions with vendors and other third parties. To mitigate this risk, we perform due diligence on our vendors and third-party service providers. We believe we work with reputable vendors and require SOC reports from critical vendors and IT service providers.


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, and notification from external parties (e.g., our third-party information technology provider). Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g. ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, our first priority is to contain the cybersecurity incident as quickly as possible consistent with the procedures in our incident response plan. A representative of our third-party information technology provider is a member of the incident response team. Our third-party information technology provider takes the lead on assisting us with the steps and procedures to contain the incident. If our third-party information technology provider is unable to contain the incident, we expect to work with our CTO/CISO and cybersecurity insurer to engage the appropriate vendor for containment.


text: Once a cybersecurity incident is contained our focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, or employee re-training, among other things. We have specific recovery time objectives and recovery point objectives in our disaster recovery plan.


text: Our incident response plan provides clear communication protocols, including with respect to members of senior management, including the CEO, CFO and COO, internal and external counsel, our management disclosure committee and the Audit and Cyber Risk Committee and the Board of Trustees. With respect to our SEC reporting obligations related to a cybersecurity incident, as set forth in the incident response plan, the leaders of the incident response plan regularly brief the management disclosure committee on developments related to an incident. In addition, the COO and CTO/CISO engage with external legal counsel with respect to other regulatory reporting obligations related to an incident.


text: Following the conclusion of an incident the incident response team will generally assess the effectiveness of the cybersecurity program and make adjustments as appropriate.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams that we are able to prevent or sufficiently mitigate harm from. Although we make efforts to maintain the security and integrity of the third party networks and systems we use, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a security incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third party providers, will be effective. See "Item 1A–Risk Factors–Cybersecurity incidents may adversely affect our business."


text: We believe we maintain an information technology and cybersecurity program appropriate for a company our size taking into account our operations.


text: Management and Board Oversight Our enterprise risk management framework was developed in conjunction with a third-party that objectively assessed key stakeholder responses to questionnaires on our operations and business functions, including information technology and cybersecurity. Our internal controls over financial reporting include key controls covering certain information technology and cybersecurity processes that are documented and tested annually.


text: The Audit and Cyber Risk Committee of our Board of Trustees assists our Board of Trustees on oversight of management in connection with regularly assessing our key risks and engaging in enterprise-wide risk management as they relate to cybersecurity and our technology and information systems, including with respect to strategies, objectives, capabilities, initiatives, policies and investments.


text: We employ a Director of Information Technology who works exclusively on information technology and cybersecurity matters and has significant related experience. Our Director of Information Technology reports to our Chief Operating Officer.


text: Due to our size and the size of our employee base, we use third-party vendors to assist us with our network and information technology requirements. Since 2019, BDO USA, LLC ("BDO") has acted as our outsourced chief technology officer/chief information security officer ("CTO/CISO") and provided us with the following services: • Overseeing the chief security role and informing leadership of cybersecurity risks and the role of staff in protecting information, including, but not limited to: Monitoring emerging risks, and suggesting and overseeing implementation of mitigations; Overseeing security awareness and training programs; and Reporting significant security events to leadership.


text: • Guidance regarding incidence response, business continuity and disaster recovery program, strategy and testing. • Oversight and guidance on vendor risk management processes and individual vendor profiles. • IT strategy advice. • Monitoring the relationship with our information technology managed services provider. • Technical, policy and procedure recommendations.


text: Together with our Director of Information Technology, BDO regularly reports to our Chief Operating Officer and General Counsel and to the Audit and Cyber Risk Committee of our Board of Trustees on a quarterly basis.


text: We outsource our information technology managed services to a third-party provider of customized private cloud solutions featuring virtual desktops and servers ("MS Provider"). Our Director of Information Technology, together with BDO, oversees the MS Provider.


text: We maintain a critical systems vendor management program with the assistance of a third-party provider of vendor risk intelligence data, including cybersecurity vulnerabilities, business health and credit risk.


text: In the event of an incident which jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize an incident response plan. Our incident response plan was developed to guide the internal response to incidents taking into account a recognized third party cybersecurity framework. Pursuant to our incident response plan and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the incident response team is made up of two teams: the information security response team and the business response team. The information security response team is generally led by our Chief Operating Officer and includes our CTO/CISO, our Director of Information Technology, our MS Provider account manager, our Chief Financial Officer and other members of our senior leadership. The business response team includes primary and secondary contacts for each impacted business area. These individuals assist with any necessary customer notification procedures. The incident response team regularly reports to senior management, including the CEO, in the event of a significant incident, and our Chief Operating Officer and Chief Financial Officer provide reports to our Audit and Cyber Risk Committee and our Board of Trustees.


text: The Audit and Cyber Risk Committee oversees, on behalf of the Board of Trustees, our information technology and cybersecurity strategy and initiatives. Our Board of Trustees has determined that one of the members of our Audit and Cyber Risk Committee is an information technology/cybersecurity expert and has significant experience in, among other areas, emerging technologies and coordinating national security and technology policy. On at least a quarterly basis, our Chief Operating Officer, CTO/CISO and Director of Information Technology report to our Audit and Cyber Risk Committee on information technology matters, including cybersecurity. Our Audit and Cyber Risk Committee provides updates to the Board of Trustees. On a periodic basis, our Audit and Cyber Risk Committee commissions an external assessment of our cybersecurity practices and receives a report from the third-party firm performing our internal audit function. The most recent assessment was completed in 2023.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program focuses on (1) preventing and preparing for cybersecurity incidents, (2) detecting and analyzing cybersecurity incidents, and (3) containing, eradicating, recovering from, and reporting cybersecurity events.


text: Prevention and Preparation As noted above, we utilize our MS Provider for cloud-based information technology services. This third-party solution includes 24/7 monitoring and is consistent with a well-recognized cybersecurity framework. We also engage a nationally recognized public accounting firm to perform periodic cybersecurity assessments, which entail performing a qualitative current state evaluation of our cybersecurity program in line with specific domains within the recognized third-party framework. In addition, we take the following preventative measures: • We engage a third party to perform internal and external penetration tests on an annual basis. • We require multi-factor authentication and other enhanced security measures for our network and primary applications. • We utilize geolocation-based blocking and mobile device management.


text: We recognize that threat actors frequently target employees to gain unauthorized access to information systems. Therefore, a key element of our prevention efforts is employee training on cybersecurity around phishing, malware and other cyber risks. We use a third-party provider of security awareness training and simulated phishing for our email phishing reporting and periodic cyber security training.


text: We maintain comprehensive business continuity and disaster recovery plans, which we update on at least an annual basis and we test through tabletop exercises on an annual basis. We do not maintain any on-premises data or servers.


text: We are exposed to risks from interactions with vendors and other third parties. To mitigate this risk, we perform due diligence on our vendors and third-party service providers. We believe we work with reputable vendors and require SOC reports from critical vendors and IT service providers.


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, and notification from external parties (e.g., our third-party information technology provider). Once a potential cybersecurity incident is identified, including a third party cybersecurity event, the incident response team designated pursuant to the incident response plan follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, our first priority is to contain the cybersecurity incident as quickly as possible consistent with the procedures in our incident response plan. A representative of our third-party information technology provider is a member of the incident response team. Our third-party information technology provider takes the lead on assisting us with the steps and procedures to contain the incident. If our third-party information technology provider is unable to contain the incident, we expect to work with our CTO/CISO and cybersecurity insurer to engage an appropriate vendor for containment.


text: Once a cybersecurity incident is contained our focus shifts to remediation. Eradication and recovery activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, or employee re-training, among other things. We have specific recovery time objectives and recovery point objectives in our disaster recovery plan.


text: Our incident response plan provides clear communication protocols, which may include, depending on the incident's classification and other circumstances, our CEO, CFO and COO, our internal and external counsel, our management disclosure committee and the Audit and Cyber Risk Committee and the Board of Trustees. In addition, our COO and CTO/CISO generally engage with external legal counsel with respect to regulatory reporting obligations related to an incident.


text: Following the conclusion of an incident, the incident response team will generally assess the effectiveness of the cybersecurity program and make adjustments as appropriate.


text: Cybersecurity Risks As of December 31, 2024, we are not aware of any material cybersecurity incidents in the last three years. However, there can be no assurance that our security efforts and measures, and those of our third-party providers, will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See "Item 1A–Risk Factors–Cybersecurity incidents may adversely affect our business."


text: Risk management and strategy We are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operation and reputation. We recognize the importance of developing, implementing, and maintaining comprehensive cybersecurity measures as part of our larger risk management program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our risk management team works closely with our Information Technology and Information Security ("InfoSec") departments to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our information security program incorporates data encryption and access control, single sign-on and multi-factor authentication, vulnerability management, and malware protection for both laptops and servers. We align with industry standards and frameworks, and we maintain FedRAMP Moderate authorization, an ISO 27001 certificate, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. There can be no guarantee that, in every instance, our policies and procedures will be properly followed or that those policies and procedures will prevent malicious or unauthorized access to our information systems.

companyName: WORKIVA INC

ticker: WK


text: Engaging Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights in order to adhere to industry standard practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: Overseeing Third-party Risk We require that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment. Our Governance, Risk and Compliance team conducts security assessments of critical third-party providers before engagement and maintains ongoing annual monitoring to mitigate risks relating to data breaches or other security incidents originating from third-parties.


text: Risks from Cybersecurity Threats We have not encountered any incidents from cybersecurity threats to date, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, our business strategy, results of operations, or financial condition. Although we have not yet been materially impacted by any cybersecurity incident, we are subject to cybersecurity threats, as discussed in Item 1A. Risk Factors, including in the risk factor entitled "We face continually evolving cybersecurity risks, which could result in the loss, theft, misuse, unauthorized disclosure, access, or destruction of confidential information or data, disruption of our solutions, damage to our brands, reputation and relationships with customers, legal exposure and financial losses." The Board of Directors (the "Board") has established oversight mechanisms designed to manage risks associated with cybersecurity threats.


text: Board of Directors Oversight The Board is composed of members who have diverse expertise including, risk and financial management, technology, cybersecurity and finance, equipping the Board to oversee cybersecurity risks effectively.


text: Management's Role Managing Risk The Chief Information Security Officer ("CISO") plays a pivotal role in informing the Board and the Audit Committee on cybersecurity risks and provides comprehensive briefings on a regular basis, with a minimum frequency of three times per year to the Audit Committee and once per year to the full Board. During committee reports, the Audit Committee would apprise the full Board of any significant cybersecurity updates. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and knowledge gleaned from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the CISO and Chief Executive Officer ("CEO") inform and consult as appropriate with the Board regarding any significant developments in the cybersecurity domain.


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with an incident response plan. This plan includes actions to mitigate the impact of any current cybersecurity incidents and long-term strategies for remediation and prevention of future incidents.


text: Monitoring Cybersecurity Incidents and Reporting to Board of Directors The CISO regularly informs the CEO, Chief Legal Officer, Chief Information Officer and in-house data privacy counsel regarding cybersecurity risks and incidents to keep senior management abreast of our cybersecurity posture and potential risks facing Workiva. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board, to enable it to provide oversight and guidance on any critical cybersecurity issues.


text: Risk Management and Strategy We are subject to various cybersecurity risks that could adversely affect our business, financial condition, results of operations, and reputation. We recognize the importance of developing, implementing, and maintaining comprehensive cybersecurity measures as part of our larger risk management program to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. Our risk management team works closely with our Business Technology and Information Security ("InfoSec") departments to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our information security program incorporates data encryption and access control, single sign-on and multi-factor authentication, vulnerability management, and malware protection for both laptops and servers. We align with industry standards and frameworks, and we maintain FedRAMP Moderate authorization, an ISO 27001 certificate, and SOC 1 and 2 Type 2 reports to comply and adhere to industry standard practices. There can be no guarantee that, in every instance, our policies and procedures will be properly followed or that those policies and procedures will prevent malicious or unauthorized access to our information systems.


text: Engaging Third Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we regularly engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights in order to adhere to industry standard practices. Our collaboration with these third-parties includes regular audits, risk and vulnerability assessments, and consultation on security enhancements.


text: Overseeing Third-Party Risk We require that all third-party vendors that have access to or handle sensitive information undergo a risk-based vendor security assessment. Our Governance, Risk and Compliance team conducts security assessments of critical third-party providers before engagement and maintains ongoing annual monitoring to mitigate risks relating to data breaches or other security incidents originating from third-parties.


text: Board of Directors Oversight The Board is composed of members who have diverse expertise including, risk and financial management, technology, cybersecurity and finance, equipping the Board with the necessary skill set to effectively oversee cybersecurity risks.


text: Management's Role Managing Risk The Chief Information Security Officer ("CISO") plays a pivotal role in informing the Board and the Audit Committee on cybersecurity risks and provides comprehensive briefings on a regular basis, with a minimum frequency of three times per year to the Audit Committee and once per year to the full Board. During committee reports, the Audit Committee apprises the full Board of any significant cybersecurity updates. These briefings encompass a broad range of topics, including: • Current cybersecurity landscape and emerging threats; • Status of ongoing cybersecurity initiatives and strategies; • Incident reports and knowledge gleaned from any cybersecurity events; and • Compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the CISO and Chief Executive Officer inform and consult as appropriate with the Board regarding any significant developments in the cybersecurity domain.


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of security controls and regular system audits to identify potential risks. In the event of a cybersecurity incident, the CISO is equipped with an incident response plan. This plan includes actions to mitigate the impact of any current cybersecurity incidents and long-term strategies for remediation and prevention of future incidents. Our CISO and other dedicated cybersecurity personnel are certified and experienced information systems security professionals and information security managers with decades of experience and industry certifications, including Certified Information Systems Security Professional; Offensive Security Certified Professional; Global Information Assurance Certification; Security Strategic Planning, Policy, and Leadership; and Certified Information Security Manager, among others.


text: Monitoring Cybersecurity Incidents and Reporting to Board of Directors The CISO regularly informs the CEO, Chief Legal Officer, Chief Information Officer and in-house data privacy counsel regarding cybersecurity risks and incidents to keep senior management abreast of our cybersecurity posture and potential risks facing Workiva. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the Board to enable it to provide oversight and guidance on any critical cybersecurity issues.


text: Risk Management and Strategy As an externally managed company, our day-to-day operations are managed by our advisor and our executive officers under the oversight of our board of directors. As such, we rely on our advisor's cybersecurity program, as discussed herein, for assessing, identifying, and managing material risks to our business from cybersecurity threats. Our cybersecurity program, as implemented by our advisor and overseen by our board of directors, is integrated into our overall risk management system, and included as part of our information technology security incident response plan.

companyName: Strategic Realty Trust, Inc.


text: Due to the small size of our operations, our advisor has elected to outsource the information technology function to a third-party managed service provider, or the MSP, that specializes in fully managed information technology services and fully managed cybersecurity. The MSP is responsible for managing all of our advisor's hosted services, all of the computer and computer-related hardware and software used for our advisor to manage our operations, and all onsite and offsite backups. The MSP also provides managed security services designed to prevent cybersecurity threats, to identify and remediate vulnerabilities, to monitor systems 24/7, to protect data and systems, to detect potential intrusions and cybersecurity incidents, to quarantine systems should they be compromised, and to recover from business interruptions or other disasters. The MSP follows the NIST Cybersecurity Framework, developed by the National Institute of Standards and Technology of the U.S. Department of Commerce, to measure the maturity of the services it provides to us and its other clients.


text: The MSP conducts ongoing cybersecurity training to ensure all employees are aware of cybersecurity risks and performs periodic phishing simulation testing for increased cyber resilience. Annually, the MSP conducts penetration testing to assess cybersecurity measures and to review the information security control environment and operating effectiveness. In addition, our advisor evaluates key third-party service providers before granting the service provider access to its information systems and has a process in place to ensure that future access is appropriate. Our assessment of risks associated with the use of third-party providers is part of the advisor's overall cybersecurity risk management framework. For any software platforms that are hosted by third parties, our advisor confirms the vendor maintains a System and Organization Controls ("SOC") 1 report. While we have control, through our contract with the MSP, over our information systems, we do not have control over the information systems of third parties who provide services, and in particular certain property management services, at our commercial real estate properties. Although we confirm third party software platforms maintain a SOC 1 report, we rely on third parties for managing their cybersecurity risk. Our advisor maintains third-party cyber insurance and upon identification of a significant cyber incident, our advisor would notify its cyber insurance carrier and engage a third-party cyber forensic analysis vendor to assist in investigating and remediating the incident.


text: As of the date of this Annual Report, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. However, our business is highly dependent on our ability to collect, use, store and manage organizational and property data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our business or managing real estate, liability to tenants, loss of tenant or other sensitive data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking," "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy our office location. As our advisor has elected to outsource our information technology functions to third-party providers, we bear the risk of having less direct control over the security and performance of those systems.


text: As part of its responsibilities pursuant to our corporate governance guidelines, our board of directors oversees our policies with respect to risk assessment and risk management, including with respect to cybersecurity risks. The board of directors administers its risk oversight function by receiving regular reports from our executive officers on areas of material risk to us, which reports include any updates regarding cybersecurity incidents or other developments.


text: As discussed above, we engage the MSP to assist us with the identification, monitoring and management of cybersecurity risks and rely on the expertise and knowledge of the MSP with respect to supporting our information technology network. The MPS reports periodically to our management team as necessary, including our Chief Executive Officer and Chief Financial Officer. These senior executive officers then brief our board of directors on security matters as required and no less frequently than annually. Our Chief Financial Officer, together with our advisor's Director of Human Resource is responsible for managing our cybersecurity risk and developing mitigation strategies and implementing controls to reduce the likelihood of a cybersecurity incident occurring and to reduce the impact of such an incident should this occur.


text: We are increasingly dependent on sophisticated software applications and computing infrastructure to conduct key operations. We depend on both our own systems, networks, and technology as well as the systems, networks and technology of our contractors, consultants, vendors and other business partners.

companyName: Arbutus Biopharma Corp

ticker: ABUS


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust and comprehensive cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, with regular evaluations of our cybersecurity posture, including internal and external audits, as well as annual penetration tests. We also require cybersecurity training when onboarding new employees and contractors and on an annual basis thereafter. Our cybersecurity program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Risk Assessment Framework to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our oversight of third-party service providers. As part of our new vendor onboarding process, we assess all new third-party service providers for technical capabilities, reputation, financial stability, pricing, and other criteria and all new third-party service providers are reviewed and approved by our Finance and Legal departments. Foreign vendors are evaluated separately for compliance with the Foreign Corrupt Practices Act. Our contracts with third-party service provides include appropriate data security and privacy terms. For certain key third-party service providers, we obtain a SOC type 2 audit report from the vendor's audit firm which provides detailed information and assurance about a service organization's security, availability, processing integrity, confidentiality and privacy controls, in accordance with Statement on Standards for Attestation Engagements No. 18.


text: Process for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats In the event of a cybersecurity incident, we maintain a regularly tested Incident Management and Response program as well as business continuity and disaster recovery plans. Pursuant to the program and its escalation protocols, designated personnel are responsible for assessing the severity of an incident and associated threat and handling it in accordance with that severity level. We have relationships with a number of third-party service providers to assist with cybersecurity evaluation, containment and remediation efforts.


text: Management Oversight The controls and processes employed to assess, identify and manage material risks from cybersecurity threats are implemented and overseen by our Executive Director of IT and Information Security (ED, IT & IS), who reports to our Chief Financial Officer. Our ED, IT & IS has over 30 years of IT experience and an Advanced Graduate Certification in Cybersecurity. He is responsible for the day-to-day management of the cybersecurity program, including the prevention, detection, investigation, response to, and recovery from cybersecurity threats and incidents, and is regularly engaged to help ensure the cybersecurity program functions effectively in the face of evolving cybersecurity threats. He provides regular briefings (quarterly at a minimum) to our Computer Security Incident Response Team consisting of the Chief Financial Officer and General Counsel/Chief Compliance Officer on cybersecurity matters, including threats, events, and program enhancements.


text: While the Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing our data privacy, information technology and security and cybersecurity risk exposures. On at least an annual basis, the ED, IT & IS reports to the Audit Committee on information security and cybersecurity matters, including significant information technology risks, material threats (and the potential impact of those exposures on our business, financial results, operations and reputation) and the steps implemented by management to monitor and mitigate exposures. He also apprises the Audit Committee promptly of any high priority cybersecurity incidents, consistent with our Incident Management and Response Policy, and provides updates to the full Board as needed.


text: Cybersecurity Risks Management assesses the top organizational risks for the Company on an annual basis. Our cybersecurity risk is a component of our overall organizational risk assessment. Management also performs a specific cybersecurity risk assessment based on the NIST cybersecurity risk framework. As part of our cybersecurity risk assessment, department leaders identify, assess and evaluate risks impacting our operations across the Company, including those risks related to cybersecurity. Department leaders are asked to consider the severity and likelihood of certain risk factors, drawing upon their company knowledge and past business experience. Our cybersecurity risk assessment helps to inform our risk mitigation strategies. While we maintain a robust cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors."


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners. In the last three years, we did not experience any material cybersecurity incidents or threats.


text: Cybersecurity Program Given the importance of cybersecurity to our business, we maintain a robust and comprehensive cybersecurity program to support both the effectiveness of our systems and our preparedness for information security risks. This program includes a number of administrative, physical and technical safeguards, with regular evaluations of our cybersecurity posture, including internal and external audits, as well as annual penetration tests. We also require cybersecurity training when onboarding new employees and contractors and on an annual basis thereafter. Our cybersecurity program leverages industry frameworks, including the National Institute of Standards and Technology (NIST) Cybersecurity Framework to strengthen our program effectiveness and reduce cybersecurity risks.


text: We use a risk-based approach with respect to our oversight of third-party service providers. As part of our process for onboarding new vendors, we assess new third-party service providers for technical capabilities, reputation, financial stability, pricing, and other criteria and such third-party service providers are reviewed and approved by our Finance and Legal departments. We have implemented processes to confirm that agreements with third-parties contain data security and privacy terms as appropriate. For certain key third-party service providers, we obtain a SOC type 2 audit report from the vendor's audit firm which provides detailed information and assurance about a service organization's security, availability, processing integrity, confidentiality and privacy controls.


text: While our Board of Directors has overall responsibility for risk oversight, our Audit Committee oversees cybersecurity risk matters. The Audit Committee is responsible for reviewing, discussing with management, and overseeing our data privacy, information technology and security and cybersecurity risk exposures. On at least an annual basis, the ED, IT & IS reports to the Audit Committee on information security and cybersecurity matters, including significant information technology risks, significant threats (and the potential impact of those exposures on our business, financial results, operations and reputation) and the steps implemented by management to monitor and mitigate exposures. He also apprises the Audit Committee promptly of high priority cybersecurity incidents, consistent with our Incident Management and Response Policy, and provides updates to the full Board as needed.


text: We also maintain cybersecurity insurance providing coverage for certain costs related to cybersecurity-related incidents that impact our own systems, networks, and technology or the systems, networks and technology of our contractors, consultants, vendors and other business partners.


text: As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected our business strategy, results of operations or financial condition or are reasonably likely to have such a material effect.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, and data related to our clinical trials and commercial and pipeline tests ("Information Systems and Data").

companyName: CASTLE BIOSCIENCES INC

ticker: CSTL


text: Our Director of Cyber Security & Infrastructure ("DCSI") oversees our information security function, which in conjunction with our security and engineering operations, Security Operations Center, a third-party managed security provider, helps identify, assess and manage the Company's cybersecurity threats and risks. This group identifies and assesses risks from cybersecurity threats by monitoring and evaluating our threat environment and the Company's risk profile using various methods including, for example: manual and automated tools; subscribing to and analyzing reports of cybersecurity threats and threat actors; conducing scans of our environment; evaluating our and our industry's risk profile and threats reported to us; coordinating with law enforcement concerning certain threats; conducting internal and external audits and threat assessments; conducting vulnerability assessments; using external intelligence feeds; and working with a third-party test our incident response processes.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: an incident response and business continuity plan; vulnerability management policy; risk assessments; implementing certain certifications and security standards; encrypting certain of our data; network security controls; segregating certain data; access and physical security controls; asset management, tracking, and disposal; monitoring our systems; employee training; penetration tests; maintaining cybersecurity insurance; and dedicated cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, cybersecurity risk is addressed as a component of the Company's enterprise risk management program; our information security function works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; our senior management evaluates material risks from cybersecurity threats against our overall business objectives and reports to the audit committee of the board of directors, which is primarily responsible for overseeing our risk management processes on behalf of our board of directors.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example professional services firms (including legal counsel), threat intelligence service providers, cybersecurity consultants, cybersecurity software and managed service providers, penetration testing firms, and dark web monitoring services.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have vendor management processes to manage cybersecurity risks associated with our use of certain providers. These processes may include reviewing vendors' written security programs and security assessments, conducting security assessment calls with vendor personnel, and imposing contractual obligations related to information security on certain of our vendors. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "If our information technology systems, or those of third parties upon which we rely, or our data are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; loss of customers or sales; and other adverse consequences."


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee oversees the risk assessment, risk management and internal controls over cyber security matters, as outlined in its committee charter.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our DCSI. Our DCSI has over 20 years of experience as a security professional, has a CISSP certification, and has completed the Carnegie Melon Insider Risk Management Program.


text: The DCSI is responsible for hiring appropriate personnel, leading enterprise-wide cybersecurity strategy, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel.