text: Governance Related to Cybersecurity Risks Our cyber risk management program and related operations and processes are managed by our Director of Information Technology, in consultation with the legal and human resources teams. The Director of Information Technology has primary responsibility for day-to-day management of our cyber risk management program, including monitoring for cybersecurity risks. Currently, the Director of Information Technology role is held by an individual who has over 18 years of cybersecurity, information technology, and systems engineering experience. The Director of Information Technology reports to the Chief People Officer.


text: The Director of Information Technology meets with the Chief People Officer periodically to monitor and review the outcomes of our cybersecurity risk management processes and to discuss and address matters related to cybersecurity risk management strategy. The Director of Information Technology, working with the Chief Legal Officer and Chief People Officer, provides periodic reports on cybersecurity risks to the audit committee, which is responsible for reviewing and overseeing the Company's risk management processes, including cybersecurity risks. The Chief Financial Officer, Chief People Officer and Chief Legal Officer and/or other senior members of the legal team, participate in audit committee meetings, which are generally led by the Chief Financial Officer, as well as meetings of the full board of directors.

companyName: C4 Therapeutics, Inc.

ticker: CCCC

secItem: Item 1C


text: Our enterprise risk management process is overseen by our Chief Legal Officer and Chief Financial Officer. In collecting information on enterprise risk, cyber security is specifically included as a risk category, and the results of our enterprise risk assessment processes, including risks related to cybersecurity, are also discussed with the audit committee and among senior management on a periodic basis. Further, in accordance with the committee's charter, the chair of the audit committee provides periodic updates on committee activities to the full board of directors, which may include discussion of any cyber risks.


text: Risk management and strategy We have developed processes for assessing, identifying and managing material risks from cybersecurity threats. Our enterprise risk management system incorporates risks from cybersecurity threats alongside other risks to the Company. Our information technology team oversees and implements a range of tools and services designed to minimize the risk or impact of any breach or unauthorized disclosure of our confidential and sensitive data. These tools and services include, from time to time: • monitoring emerging data protection laws and best practices regarding application security, access management, device protection, network management, and data loss prevention and recovery and implementing responsive changes to our processes; • undertaking periodic reviews of our partner-facing policies and statements related to cybersecurity; • utilizing intrusion detection and monitoring applications and multifactor authentication; • conducting periodic table-top exercises with management, including our Executive Director, Corporate Information Systems, and testing of our data security, incident response policies and procedures; • conducting periodic cybersecurity management and incident training for employees, including simulated phishing campaigns, which provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses; and • requiring employees, as well as third-parties who provide services on our behalf, to treat information and data with care.

companyName: Vericel Corp

ticker: VCEL


text: We also maintain an enterprise-wide incident response plan designed to secure the enterprise, mitigate the impact of a cybersecurity incident, recover and restore normal business operations, prevent similar future incidents and comply with applicable regulatory obligations arising from an incident. Management, including our Executive Director, Corporate Information systems, collaborates with our information technology team and technical partners to review at least annually our enterprise-wide incident response plan. Periodically, we engage assessors, consultants, auditors and other third parties, including by conducting exercises with an external partner to stress test our data security systems and practice company-wide response tactics. Our risk management processes also address cybersecurity threat risks associated with our use of third-party service providers, and third-party risks are included within our enterprise risk management program. In the event of a suspected or actual cybersecurity event, we have partnered with a globally recognized digital forensics investigation firm and outside counsel to provide services and support on a real-time basis to analyze any breach and secure both our data and information systems.


text: Despite our security measures, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For a discussion of how any risks from cybersecurity threats could materially affect the Company, including our business strategy and results of operations, see "Risk Factors – A cyber security incident or data privacy issue could result in a loss of confidential data, give rise to remediation and other expenses, expose us to liability under HIPAA, consumer protection and privacy laws, or other common law theories, subject us to litigation and federal and state governmental inquiries, damage our reputation, and otherwise be disruptive to our business," which is incorporated by reference into this Item 1C.


text: In the three most recently completed fiscal years and as of the date of this Annual Report on Form 10-K, we have not experienced any material cybersecurity incidents. Additionally, we do not believe any previous cybersecurity incidents we may have experienced are reasonably likely to materially affect us. This includes cybersecurity incidents resulting in penalties and settlements, of which there were none.


text: The Audit Committee of our Board oversees our risk management process, which includes risks from cybersecurity threats. The Audit Committee receives reports from management at least semi-annually, and more frequently if necessary, with respect to risks from cybersecurity threats. The Audit Committee also reviews cybersecurity and data security risks and mitigation strategies, along with program assessments, planned improvements and the status of information technology initiatives. The entire Board receives annual training from outside experts concerning the current global cybersecurity threat landscape and corporate best practices for mitigating cybersecurity risks, as well as the Board's legal, regulatory and fiduciary responsibilities from a cybersecurity standpoint. Additionally, the Board was engaged with management and outside experts throughout 2022, 2023 and 2024 in overseeing the development of the Company's Enterprise Incident Response Plan. This plan is reviewed and updated on an annual basis.


text: Our Executive Director, Corporate Information Systems, along with our Chief Legal Officer, Information Technology management team, and Chief Operating Officer, oversees our approach to cybersecurity and is responsible for assessing and managing material risks associated with cybersecurity threats. Our Executive Director, Corporate Information Systems has over 20 years of experience in the life science industry, including a focus in the past four years on information technology management. Additionally, his academic background includes advanced degrees in the life sciences and he brings a strong track record of managing cyber incident responses and related activities. In this role, our Executive Director, Corporate Information Systems works closely with an internal team that includes resources with various cybersecurity certifications and leverages the support of our external information security firm, technology partners and an industry-leading intelligence platform. Our Executive Director manages and leads the internal Information Technology team to maintain, update and enhance the Company's technology infrastructure and corresponding safety measures, as well as to ensure that appropriate safety measures are implemented to protect against evolving cybersecurity threats.


text: Our Executive Director, Corporate Information Systems is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management and strategy processes described above, including the operation of our Enterprise Incident Response Plan. Our Chief Legal Officer works closely with him and reports regularly to the Board and to the Audit Committee of the Board, covering the risks from cybersecurity threats.


text: Risk management and strategy We prioritize the management of cybersecurity risk and the protection of information across our enterprise by embedding data protection and cybersecurity risk management in our operations. Our processes for assessing, identifying, and managing material risks from cybersecurity threats have been integrated into our overall risk management system and processes.

companyName: ORMAT TECHNOLOGIES, INC.

ticker: ORA


text: As a foundation of this approach, our privacy and security policies govern our business lines and subsidiaries. We monitor the privacy and security regulations applicable to us in the regions where we do business as well as proposed privacy and security regulations and emerging risks.


text: We conduct internal and external penetration testing and risk assessments on a regular basis, and have engaged consultants, auditors and other relevant third parties to assist us with cybersecurity risk management processes. Our operations rely on the secure processing, storage and transmission of confidential and other information in our computer systems and networks. Computer viruses, hackers, and employee or vendor misconduct, and other external hazards could expose our data systems and those of our vendors to security breaches, cybersecurity incidents or other disruptions, any of which could materially and adversely affect our ability to conduct our business. While we have experienced cybersecurity incidents, to date, we are not aware that we have experienced a material cybersecurity incident. The sophistication of cybersecurity threats continues to increase, and the controls and preventative actions we take to reduce the risk of cybersecurity incidents and protect our systems, including the regular testing of our cybersecurity incident response plan, may be insufficient. In addition, new technology that could result in greater operational efficiency may further expose our computer systems to the risk of cybersecurity incidents. We may also maintain cyber liability insurance that covers certain damages caused by cybersecurity incidents. However, there is no guarantee that adequate insurance will continue to be available at rates that we believe are reasonable or that the costs of responding to and recovering from a cybersecurity incident will be covered by insurance or recoverable in rates. For more information, see Part I of this Annual Report, Item 1A "Risk Factors—Risks Related to the Company's Business and Operation—A cyber-incident, cyber security breach, severe natural event or physical attack on our operational networks and information technology systems could have a material adverse effect on our financial condition, results of operations, liquidity and cash flows."


text: As part of our overall risk management approach, we prioritize the management of cybersecurity risk at several levels, including Board oversight, executive commitment and employee training. Our Audit Committee, comprised fully of independent directors from our Board, oversees the Board's responsibilities relating to cybersecurity risks. Each of our Audit Committee and Board is informed of such risks through reports from our Chief Information Officer ("CIO") at least twice per year.


text: Our Chief Information Security Officer ("CISO"), who has been a chief information security officer at Ormat for seven years, is certified by the International Information System Security Certification Consortium as an Information Systems Security Management Professional ("ISSMP"), as an Information Systems Security Architecture Professional ("ISSAP"), and as a Certified Information Systems Security Professional ("CISSP"). Our CISO oversees compliance of our information security ("IS") standards and mitigation of IS risks. We also have the following internal bodies to support our processes to assess and manage cybersecurity risk as follows: • The Crisis Incident Management Team, which includes members of the executive management team, the CIO, CISO, and other senior executives across the Company, is alerted as appropriate to cybersecurity incidents, as well as other crises, such as natural disasters and outages. This team also periodically oversees tabletop drills on various cybersecurity incidents. • The Cyber Risk Disclosure Committee brings together senior management, including the CEO, CFO, General Counsel and other relevant functions to review the materiality of cyber incidents for disclosure purposes. The Cyber Risk Disclosure Committee members are also part of the Crisis Incident Management team. • The IT leadership team, led by our Chief Information Officer, oversees IT initiatives while considering cybersecurity risk mitigation with respect to these initiatives. The team provides periodic presentations to senior management and the Board on cybersecurity risk and mitigation. • The VP of Technical and Maintenance chairs monthly cybersecurity meetings to review cyber risks or threats related to the operations of our geothermal projects.


text: At the level of the general employee population, we hold trainings on privacy and information security, records and information management, and information security regulatory compliance, conduct phishing tests and generally seek to promote awareness of cybersecurity risk through broad communication and educational initiatives, depending on the employee's level, role and exposure to sensitive systems and the associated cybersecurity risk profile. We also contract with an external vendor to monitor alerts in real time on cybersecurity incidents.


text: With respect to third party service providers, we obligate our vendors to adhere to privacy and cybersecurity measures. We also restrict vendors' access to our organizational systems through a segmented and controlled environment which is monitored by us, and perform detailed and customized risk assessments of certain vendors, including their ability to protect data from unauthorized access.


text: We embrace a "defense in depth" approach to assess, identify, and manage cybersecurity threats. A defense in depth approach seeks to implement multiple layers of defenses in order to help reduce the risk that a single process or control failure might result in a material incident. We utilize a risk management framework to assess, manage, and report on material risks and threats. In light of the importance of cybersecurity matters, we have developed as part of this framework a risk domain specific to cybersecurity matters, including specifying applicable risk tolerances and metrics. The Executive Vice President, Chief Information Officer (CIO), who has served in information technology leadership roles with the Company since 2007 and has over 20 years of experience with matters related to cybersecurity, including as an executive leader and consultant, and Executive Vice President, Enterprise Risk Management (EVP, ERM), who has served in risk management leadership roles for the Company since 2015, have oversight over information technology and enterprise risk management matters, respectively, and receive monthly reports on cyber-related metrics and activities from their teams. In addition, we have implemented escalation procedures and protocols, including an incident response team that includes key members of management such as the CIO and EVP, ERM, to manage and coordinate responses to potentially significant cybersecurity incidents. Third party vendors are utilized to help validate our security posture and controls, and we have developed a third party vendor management program to assess and monitor risks arising from third party vendor systems.

companyName: Eastern Bankshares, Inc.

ticker: EBC


text: The Risk Management Committee of our Board of Directors has responsibility for oversight of the design, implementation, and operation of our enterprise risk management framework, including review and approval of risk management policies and review of our monitoring of risk, the effectiveness of its risk management processes, and material changes in risk. As part of this enterprise risk management oversight, our management team, including the EVP ERM and his team, provides quarterly reporting on our cybersecurity risk domain to the Risk Management Committee. The Risk Management Committee in turn reports on significant enterprise risk management issues to the full Board. In 2024, no cybersecurity events were identified that materially impacted our business strategy, operations, or financial condition. As further detailed in the "Risk Factors" section In Part I, Item 1A of this Annual Report on Form 10-K, we believe cybersecurity matters could pose a material risk to our strategy, operations, or financial condition. For example, a significant breach of our system security, or that of our third-party service providers, could enable access to Company or customer sensitive or confidential information or assets or could disrupt our business operations. This could result in costs of investigation, remediation and/or payment of a ransom; reputational harm and impairment of customer relationships; loss of revenue and regulatory sanctions and penalties, lawsuits, and potential liability, which could have a material adverse effect on our financial condition and results of operations.


text: Risk Management and Strategy Our information security program is led by our chief information security officer ("CISO"), who has over 25 years of experience in technology management, has 9 years of banking experience, and is a certified information systems security professional. The CISO oversees our "information security team" within our information technology department, which includes our identity and access management group, our security operations center group, and our security engineering and security architecture groups. These groups develop, deploy, monitor, and manage multiple processes, systems, and controls, including embedded controls within the technology we use, designed to help identify, protect against, detect, respond to, and recover from cybersecurity threats and incidents. In addition to our information security team, we also employ a senior vice president of IT governance and risk who has over 18 years of IT governance, risk, and compliance experience and is responsible for the development, monitoring, and reporting of IT-related key risk indicators ("KRIs"), including KRIs related to cyber risks. Both our CISO and our senior vice president of IT governance and risk report to our chief information officer ("CIO"), who has more than 25 years of technology leadership experience, including leadership experience at global financial institutions, and is responsible, among other things, for oversight of our information technology environment, strategy, and security risks.

companyName: SIMMONS FIRST NATIONAL CORP

ticker: SFNC


text: As part of our information security program, we undertake efforts to monitor new and emerging risks and evaluate the effectiveness and maturity of our cyber defenses through various means, including internal audits, targeted testing (including penetration testing), incident response exercises, maturity assessments, and industry benchmarking. In connection with these efforts, we use, on an as-needed basis, certain third-parties, including auditors, consultants, and others, that have particular cyber expertise.


text: We also maintain multiple groups that help oversee risks associated with our third-party service providers. These groups include (1) our third-party risk management department, which facilitates reviews of certain third parties by our assurance providers, including our information security and business continuity teams, (2) our vendor council, which reviews contractual terms (including, at times, terms related to confidentiality and data protection) for certain third-party relationships, and (3) our architecture review board, which reviews certain new business initiatives that may impact the Company's technical and/or security architecture.


text: Our information security program is one component of our broader enterprise risk management program. As such, KRIs related to cyber risk (which are a subset of operational risk KRIs) are reported to, and overseen and monitored by, our enterprise risk management committee, which is comprised of senior executives of the Company. Additionally, we maintain an incident response framework that details the applicable teams, their functions, and guidelines when a cybersecurity incident occurs. The framework is designed to cover significant aspects of the incident including detection, containment, remediation, and post incident analysis. Various groups of senior executives help oversee responses to security incidents, including the data loss prevention team, the core computer security incident response team, and the extended computer security incident response team.


text: While we do not believe that our business strategy, results of operations, or financial condition have been materially adversely affected by any cybersecurity incidents, cybersecurity threats are constant, and, like other financial institutions, we, as well as our customers, employees, and third-party service providers, have experienced a significant increase in information security and cybersecurity risk in recent years and will likely continue to be the target of cyber-attacks. We continue to assess the risks and changes in the cyber environment, reasonably invest in enhancements to our cybersecurity capabilities, and engage in industry and government forums to promote advancements in our cybersecurity capabilities. See the risk factor "Our business is heavily reliant on information technology systems, facilities, and processes; and a disruption in those systems, facilities, and processes, or a breach, including cyber-attacks, in the security of our systems, could have significant, negative impacts on our business, result in the disclosure of confidential information, and create significant financial and legal exposure for us." in "Item 1A. Risk Factors" of this Form 10-K for more information.


text: Our board of directors is aware of, and takes seriously, the importance of overseeing risks associated with cybersecurity threats. Senior management has provided the board of directors with cybersecurity information, as well as incident response training. Additionally, employees have received training related to cybersecurity. Cyber risks are incorporated into risk appetite metrics for operational risk and presented to and reviewed by the risk committee of the board of directors. Additionally, the audit committee of the board of directors receives and reviews internal audit reports concerning, among other things, matters related to information security. Furthermore, the board of directors of Simmons Bank, the Company's primary operating subsidiary, has established an information technology committee ("IT Committee") that receives regular reports from the CISO and CIO concerning our information security program and cybersecurity matters. The CIO also reports IT KRIs, including those related to cyber risks, to the IT Committee. Significant security incidents are also reported by senior management to the IT Committee or its chairman, when warranted. The IT Committee chairman provides reports of the committee's activities to the board of directors of Simmons Bank. The Company's board of directors, or the board of directors of Simmons Bank (as applicable), also approves information security-related policies, including the Acceptable Use Policy, Information Security Policy, IT Ransomware Policy, and Business Continuity Management Policy.


text: With respect to internal management, the CISO and CIO meet regularly to discuss the activities and operations of the information security team, and the CIO holds regular meetings with our chief executive officer to discuss cyber related matters, information technology issues, and cybersecurity threats. To enhance awareness, monitoring, and oversight of cybersecurity risks, management also uses the following internal committees (in addition to the enterprise risk management committee discussed above): (1) the IT strategy and investment committee, which is comprised of senior executives and helps provide oversight of the investment and strategic direction for the Company's IT function, (2) the IT steering committee, which is comprised of leaders from various business units and helps provide oversight and direction for inter- and intra-departmental IT related initiatives, and (3) the vulnerability management working group, which is comprised of IT leaders and helps establish appropriate roles, responsibilities, and escalation paths to resolve department and enterprise vulnerabilities within service level agreements.


text: Risk Management and Strategy Cyberattacks, computer malware, viruses, social engineering (including phishing and ransomware attacks), and general hacking are becoming more prevalent and more sophisticated in our industry. To mitigate the adverse impact of these threats to our business, we take a comprehensive approach to cybersecurity risk management and make proactively securing our systems and the data customers, employees, partners, and other stakeholders entrust to us a top priority. Our Board and our management are actively involved in the oversight of our risk management program, of which cybersecurity represents an important component. As described in more detail below, we have established policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats. See "Risk Factors — Risks Related to Our Intellectual Property and IT Systems" for a more comprehensive description of cybersecurity-related risks. We have devoted significant financial and personnel resources to implement and maintain security measures, which are designed to mitigate these risks and meet regulatory requirements and customer expectations, and we intend to continue to make significant investments to maintain the security of our data and cybersecurity infrastructure. There can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. While in the last fiscal year, we did not identify a cybersecurity threat or incident that resulted in a material adverse impact to our business, results of operations, or financial condition, there can be no guarantee that we will not experience or have not experienced such an incident.

companyName: Jamf Holding Corp.

ticker: JAMF


text: Our policies, standards, processes, and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the National Institute of Standards and Technology. Cybersecurity risks related to our business, technical operations, privacy, and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, internal IT audit, IT security, governance, risk, and compliance reviews. To protect, detect, and respond to cybersecurity threats, we aim to conduct the following activities at various intervals during the year, which vary in maturity across our business: • Regular network and endpoint monitoring; •24x7 security operations monitoring of our systems, networks, and services to detect and act on weaknesses and potential intrusions;


text: • Role-based access controls to identify, authenticate, and authorize individuals to access systems based on their job responsibilities; • Business resiliency planning with disaster recovery and business continuity testing; • Testing of new products and services and major changes to existing products and services to identify potential security vulnerabilities before release; • Protection, including encryption, for the secure communication of sensitive data; • Regular, proactive privacy and cybersecurity reviews of systems and applications, including third-party security practices; • Auditing of applicable data policies; • Regular internal and external security audits and penetration tests by third-party security vendors, as well as internal offensive team penetration testing; • At least annual security awareness training and testing of our employees; and • Monitoring emerging laws and regulations related to data protection and information security and implementing appropriate changes.


text: We have implemented incident response processes that focus on preparation for a cybersecurity incident; detection and analysis of a security incident; containment, eradication, and recovery; and post-incident analysis. Our program is designed to evaluate, rank by severity and prioritize response and remediation of security events and data incidents. Incidents are evaluated to determine operational and business impact, as well as privacy considerations. We also conduct tabletop exercises to simulate responses to cybersecurity incidents and evaluate the effectiveness of our incident response systems. Our team of cybersecurity professionals then collaborates with technical and business stakeholders across our business units to further analyze the risk to the Company, and form detection, mitigation, and remediation strategies. We maintain controls and procedures that are designed to promote prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management and the Audit Committee of our Board in a timely manner.


text: As part of our risk management program, we perform third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business, or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: Our cybersecurity policies, standards, processes, and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities including information security maturity assessments, audits, and independent reviews of our information security control environment and operating effectiveness. We have also obtained industry certifications and attestations.


text: Governance and Oversight Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Our Audit Committee is responsible for the primary oversight of risks from cybersecurity threats. Members of the Audit Committee receive quarterly updates from management regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any), and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy officers.


text: Our cybersecurity risk management and strategy processes are overseen by leaders from our enterprise operations, compliance, and legal teams, including our Chief Information Officer, Chief Information Security Officer, and Chief Legal Officer. Such individuals have extensive prior work experience in various roles involving information technology, including security, auditing, compliance, systems, and programming. These individuals are informed about, and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan, and report to the Audit Committee on any appropriate items.


text: Risk management and strategy We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures aligned to industry standards to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: National Storage Affiliates Trust

ticker: NSA


text: Management of Material Risks & Integration into Overall Risk Management We have strategically integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity awareness and risk management and have incorporated cybersecurity considerations into our decision-making processes. Our risk management team works closely with our IT department to identify, evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. Our risk management team also provides regular reporting to management on our enterprise cybersecurity risk posture.


text: Engagement of Third-parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, we engage a range of external experts, including cybersecurity assessors and consultants in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, so that we can better understand the current and evolving cybersecurity risks and strategies. Our collaboration with these third-parties includes periodic audits, threat assessments, and consultation on security enhancements.


text: Risks from Cybersecurity Threats We are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition. Refer to "Item 1A. Risk factors" in this annual report on Form 10-K, including "Security breaches through cyber-attacks, cyber-intrusions, or other methods could disrupt our information technology networks and related systems", for additional discussion about cybersecurity-related risks.


text: The board of trustees is acutely aware of the critical nature of managing risks associated with cybersecurity threats and oversees the Company's cybersecurity risk management activities.


text: Board of Trustees Oversight The audit committee of our board of trustees is central to the board of trustees's oversight of cybersecurity risks and bears the primary responsibility for this domain. The members of the audit committee have a variety of expertise, including financial, regulatory and risk management. The audit committee reviews our policies with respect to risk assessment and risk management related to cybersecurity. The audit committee and the board of trustees receive updates on the Company's cybersecurity risks and initiatives periodically. In addition, cybersecurity matters are reported to the audit committee or board of trustees so that the board of trustees and audit committee can effectively carry out their oversight role.


text: Management's Role Managing Risk Our risk management committee is comprised of a cross section of the Company's management team. The risk management committee has identified cybersecurity as a key risk to the Company's operations and established a cybersecurity sub-committee, which is comprised of members of the risk management committee and other personnel, to focus on this key risk.


text: The cybersecurity sub-committee plays a pivotal role in informing the risk management committee on cybersecurity risks. They provide comprehensive briefings to the risk management committee on a regular basis. These briefings encompass a broad range of topics, including: • Awareness of cybersecurity landscape, emerging threats, trends and developments; • Status of ongoing cybersecurity initiatives and strategies • Incident reports and learnings from any cybersecurity events • Compliance with regulatory requirements and industry standards; and • Education in cybersecurity and associated risk management frameworks.


text: The risk management committee actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives. This involvement ensures that cybersecurity considerations are a consistent focus of the Company and that the Company's cybersecurity efforts are aligned with the overall risk management framework. We have also implemented cybersecurity training at all levels of our organization and conduct periodic phishing assessment for our employees to reinforce that training.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with the cybersecurity sub-committee. With over a combined 50 years of experience in the field of cybersecurity, the cybersecurity sub-committee brings a wealth of expertise to their role. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our cybersecurity sub-committee oversees our cybersecurity strategies, tests our compliance with standards, remediates known risks, and leads our employee training program.


text: Monitor Cybersecurity Incidents The cybersecurity sub-committee stays apprised about the latest developments in cybersecurity, including potential threats and innovative risk management techniques, which is important for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. The cybersecurity sub-committee implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the cybersecurity sub-committee is equipped with a well-defined incident response plan, which provides a framework to mitigate the impact of cybersecurity incidents.


text: The cybersecurity sub-committee regularly informs the risk management committee of matters related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters and strategic risk management decisions are escalated to the audit committee and board of trustees, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Seadrill is dedicated to upholding comprehensive cybersecurity policies and procedures to safeguard our assets, data, and stakeholders. We achieve this by continuously assessing, identifying, and managing material risks associated with cybersecurity threats. Our cybersecurity program is built upon the U.S. Department of Commerce's National Institute of Standards and Technology ("NIST") Cybersecurity Framework. Cybersecurity risk is an integral part of our Enterprise Risk Management ("ERM") program, which evaluates potential impacts to our operations, financial stability, and reputation.

companyName: Seadrill Ltd

ticker: SDRL


text: The Vice President of Technical Services serves as the Senior Management sponsor for cybersecurity risk and mitigation plans. Day-to-day management of cybersecurity risks falls under the responsibility of the Director of Information Security and Information Technology ("ISIT") and the Cybersecurity Manager. Our Cybersecurity Manager is a retired U.S. Military Cyber Warfare Officer with over 15 years of experience in Cybersecurity Operations and a member of the International Association of Drilling Contractors Cybersecurity Committee.


text: The governance of Seadrill's cybersecurity program is detailed in Directives and Procedures within our Management System. These documents are regularly reviewed and outline the roles of our Cybersecurity Steering Committee, Security Operations Center, and our comprehensive Cyber Incident Response Plan. This plan specifies procedures for assessing the risk of foreseeable cyber incidents, escalating incidents to Senior Management (including necessary disclosures), and systematically responding to incidents through isolation, containment, analysis, and resolution. A structured de-escalation process follows these actions to ensure resolution and recovery. Our processes also address cybersecurity risks associated with third-party service providers, including those in our supply chain or with access to our systems or data. We evaluate key third-party providers' cybersecurity postures and may recommend specific mitigation controls. The Company works with various assessors, consultants, auditors, and other third parties on a regular basis to ensure the effectiveness of our cybersecurity measures.


text: To maintain and enhance the strength of our cybersecurity controls while reducing risk exposure, Seadrill conducts vulnerability assessments and penetration testing. As a principal risk, cybersecurity is also included in our rolling Internal Audit & Assurance program and is subject to external ISO 9001 quality management certification, certified by DNV. Oversight of these efforts is provided by the Assurance, Quality & Enterprise Risk Function, which ensures the robustness of key mitigations and controls.


text: Senior Management oversee the cybersecurity program through weekly and monthly updates, and report on the cybersecurity program to the Audit and Risk Committee for oversight, on a quarterly basis. Additionally, cybersecurity risks are reviewed annually as part of the ERM program. The ISIT Function leads ongoing training and awareness initiatives that applies to all Seadrill personnel, including employees, contractors and contingent workers, emphasizing cybersecurity as a critical organizational priority and mitigating the potential human factor in cyber incidents.


text: To date, Seadrill's business strategy, operations, and financial condition have not been materially affected by large-scale cybersecurity threats or incidents. For more information on the risks related to Cybersecurity, please refer to Part I, Item 1A, "Risk Factors - Risks Relating to Our Business and Industry - Failure to adequately protect our sensitive information, operational technology systems and critical data, or our service providers' failure to protect their systems and data could have a material adverse effect on us."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a written information security program, cybersecurity policy, cyber incident response policy and cyber incident response plan.

companyName: FIGS, Inc.

ticker: FIGS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall strategic risk management program, and shares common methodologies, reporting channels and governance processes that apply across the strategic risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services and our broader enterprise information technology ("IT") environment; • a cybersecurity team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and respond to cybersecurity incidents as needed; • cybersecurity awareness training of our employees, cybersecurity incident response team and senior management; • a cyber incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. See Item 1A. "Risk Factors—Risks Related To Information Technology, Cybersecurity and Data Privacy—System interruptions that impair customer access to our website or other performance failures in our or our third-party vendors' technology infrastructure could damage our business, reputation and brand and substantially harm our business, financial condition and results of operations."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the audit committee of the board of directors oversight of cybersecurity risks. The audit committee oversees management's implementation of our cybersecurity risk management program.


text: The audit committee receives regular reports from management, including our Chief Technology Officer ("CTO") and Senior Director of Information Security. These reports encompass a broad range of topics, such as our cybersecurity risks, the current cybersecurity landscape and the status of ongoing cybersecurity initiatives. The audit committee reports to the full board of directors regarding its activities, including those related to cybersecurity.


text: Our management team, including our CTO and Senior Director of Information Security, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for the day-to-day operation and implementation of our overall cybersecurity risk management program and supervises both our internal cybersecurity team and our retained external cybersecurity consultants. Our management team, including our CTO and Senior Director of Information Security, also supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Our CTO's background includes 14 years of experience leading technology at several eCommerce companies and our Senior Director of Information Security has 16 years of experience in the field of cybersecurity, including extensive experience as head of information security at public and private companies. Their combined in-depth knowledge and experience are instrumental in developing and executing our cybersecurity risk management program.


text: Cybersecurity Risk Management and Strategy The Company maintains an Enterprise Risk Management (ERM) program that is designed to identify, analyze and manage risks, including risks from cybersecurity threats. This program scores, ranks, and reports risks to Company managemen t based on the likelihood and impact the risk has relative to the strategic objectives and financial standing of the Company.

companyName: AbCellera Biologics Inc.

ticker: ABCL


text: The Company maintains a cybersecurity risk management program that includes, but is not limited to, periodic risk assessments and employee awareness training initiatives, as well as the employment of security analytical and assessment tools. We also maintain a cybersecurity incident response plan designed to help the Company defend against evolving cybersecurity threats, which sets out criteria for incident classification and procedures to escalate incidents to the appropriate stakeholders. Internally, we regularly monitor and assess the various components of our cybersecurity infrastructure, with the support of third-party consultants.


text: The Company has also established a process to identify and assess potential risks arising from cybersecurity threats associated with our use of critical third-party service providers. This process includes, as appropriate, conducting assessments of third-party providers' cybersecurity capabilities and reviewing third party providers' processes for alignment with our internal cybersecurity requirements.


text: Risks from cybersecurity threats have, to date, not materially affected us, our business strategy, results of operations or financial condition. We discuss how cybersecurity incidents could materially affect us in our risk factor disclosures in Item 1A of this Annual Report on Form 10-K.


text: Cybersecurity Governance The Chief Legal and Compliance Officer (CLO), and our dedicated information technology (IT) team, lead the Company's overall cybersecurity efforts. Together, our CLO and IT team have over 40 years of industry experience in implementing and managing information technology and information security systems, and members of our IT team maintain Certified Information Security Manager certifications. The CLO oversees the Company's cybersecurity risk management through regular meetings with the IT team to discuss, as appropriate, the risks and prevention of cybersecurity threats. Cybersecurity incidents are escalated based on defined incident severity criteria to management. As part of our ERM process, our CLO and other senior management positions report on identified cybersecurity risks, as appropriate, to the Audit Committee and the Board of Directors (Board).


text: Management is responsible for the day-to-day management of risks we face, while the Board as a whole and through its committees, provides guidance on the oversight of risk management.


text: The Audit Committee reviews the effectiveness of the Company's governance and management of cybersecurity risks, including those relating to business continuity, regulatory compliance and data management. The Audit Committee, at least annually, reviews and considers the results of our ERM process, including as it relates to risks from cybersecurity threats, and provides updates, as appropriate or required, to management and the Board.


text: Cybersecurity Risk Management and Strategy Cybersecurity is an integral part of our enterprise risk management. We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our Digital Systems. Our cybersecurity risk management program includes a cybersecurity incident response plan as well as property and casualty insurance that may cover damages caused as a result of a cybersecurity event.

companyName: HESS CORP


text: We design and assess our program based on the NIST CSF. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program overseen by our Chief Risk Officer, and shares certain methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other areas affecting our business risks, including financial, compliance, EHS, compensation and governance matters, among other topics.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to critical systems integral to our exploration, development and production activities as well as the activities of our business partners and our broader enterprise information technology environment; • a security team principally responsible for managing our cybersecurity risk assessment processes, our security controls and our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • ongoing cybersecurity awareness and compliance training that occurs quarterly and is mandatory for all our employees, incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors.


text: We have not identified risks from known cybersecurity threats during the year ended December 31, 2024, including as a result of any prior cybersecurity incidents, that have materially affected us or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Additional information about cybersecurity risks we face is discussed in Item 1A. Risk Factors, under the heading "Disruption, failure or cybersecurity attacks affecting or targeting information technology systems and infrastructure used by the Corporation or our business partners may materially impact our business and operations" which should be read in conjunction with the information above.


text: Our Board of Directors (Board) appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection and mitigation of the effects of any such incidents on the Corporation. The Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (Committee) primary responsibility for oversight of our risk management practices, including oversight of cybersecurity and other information technology risks.


text: The Committee oversees management's implementation of our cybersecurity risk management program. The Committee receives presentations on cybersecurity topics from management at least twice a year, including the nature of threats, defense and detection capabilities; incident response plans; and employee training activities. In addition, management updates the Committee, as necessary, regarding any material cybersecurity incidents as well as other incidents with lesser impact potential. The Committee reports to the full Board regarding its activities, including those related to cybersecurity.


text: Our management team – including our Chief Risk Officer, our Head of Information Technology and our Chief Information Security Officer (CISO) – is responsible for assessing and managing our material risks from cybersecurity threats. The team is primarily responsible for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our Chief Risk Officer has nearly 20 years of experience in this role at the Corporation and previously served as a consultant with Ernst & Young LLP's Risk Management and Regulatory Practice, where he assisted financial services and energy trading clients in establishing their risk management infrastructure. Our Head of Information Technology and our CISO each have over 20 years of experience in information technology leadership in oil and gas. Furthermore, our CISO holds a Bachelor of Science in Cyber and Data Security from the University of Arizona and is a Certified Information Systems Security Professional.


text: Our management team is informed about and monitors the efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: Risk Management and Strategy Managing Material Risks & Integrated Risk Management We have established policies and processes for assessing, identifying, and managing material risk from cybersecurity threats, and have integrated these processes into our overall risk management systems and processes. We routinely assess material risks from cybersecurity threats, including any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein.

companyName: GRID DYNAMICS HOLDINGS, INC.

ticker: GDYN


text: We conduct regular risk assessments to identify cybersecurity threats. We also conduct assessments as part of our regular process in the event of a material change in our business practices or established procedures that may affect information systems, which are vulnerable to such cybersecurity threats. These risk assessments include identification of reasonably foreseeable internal and external risks, the likelihood and potential damage that could result from such risks, attack surface state and threat modeling, and the sufficiency of existing policies, procedures, systems, and safeguards in place to manage such risks. We regularly perform internal audits of our cybersecurity procedures, review role-based data access rights, conduct system vulnerability scans and prepare incident logs, alerts and threat reviews. We have maintained our ISO 27001 certification since 2014 and are subject to annual ISO 27001 standard compliance monitoring audits and periodic customer security audits. During the year ended December 31, 2024, we completed the transition to the latest version of the standard and added two additional locations to the certification scope.


text: We incorporate results of these risk assessments to our policies and procedures, to maintain reasonable safeguards on an ongoing basis to minimize identified risks; reasonably address any identified gaps in existing safeguards; and regularly monitor the effectiveness of our safeguards.


text: As part of our overall risk management system, we monitor and test our safeguards and train our employees on these safeguards, in collaboration with human resources, IT, and a dedicated "Grid University" training department. Personnel at all levels and departments are made aware of our cybersecurity policies through multiple channels of communication and training.


text: Engage Third-Parties on Risk Management We typically engage third party auditors in connection with our risk assessment processes. These service providers assist us with designing and implementing our cybersecurity policies and procedures, as well as with monitoring and testing our safeguards at different levels. To address and mitigate potential risks associated with our use of such third parties, we require each third-party service provider to ensure that it has the ability to implement and maintain appropriate security measures, consistent with all applicable laws, to implement and maintain reasonable security measures in connection with their work with us, and to promptly report any suspected breach of its security measures that may affect our company.


text: Risks from Cybersecurity Threats We have not experienced any cybersecurity events, including cybersecurity incidents, that have had or which are likely to have any material impact on our business strategy, results of operations or financial position.


text: For additional information regarding risks related to cybersecurity threats, please refer to Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including the risk factor entitled "Failure to comply with laws and regulations relating to privacy, data protection, and cybersecurity could lead to government enforcement actions, private litigation and adverse publicity."


text: Board of Directors Oversight Our board of directors is responsible for monitoring and assessing strategic risk exposure, including cybersecurity risks, and our executive officers are responsible for the day-to-day management of the material risks we face. Our board of directors administers its cybersecurity risk oversight function directly as a whole, as well as through the audit committee.


text: Management's Role Managing Risk We devote significant resources, and designate high-level personnel, including our Chief Information Security Officer ("CISO") and Data Protection Officer ("DPO"), who each report to our Chief Operations Officer ("COO"), to manage cyber-related risk assessment and mitigation processes. Our CISO, who has been leading the team for over a decade, has over 20 years of industry experience, is a Certified Information Systems Security Professional and lead ISO 27001 auditor, and has authored five books on information security auditing strategy, wired and wireless network security, and penetration testing Our CISO and our management committee on cybersecurity, which includes our Chief Executive Officer ("CEO"), COO and IT Director, are primarily responsible for assessing and managing our material risks from cybersecurity threats. They are assisted by dedicated information security and IT staff, our DPO, HR Director, and legal and finance representatives. Our current management committee on cybersecurity includes dedicated full-time specialists in relevant fields ranging from code, application, system, and network security to computer forensics, data privacy and applied cryptography, physical security, social engineering and red teaming.


text: Our CISO and management committee on cybersecurity oversee our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our formal information security program includes measures to address: risk assessment and management, policy development and implementation, prevention strategies, detection mechanisms, incident response and mitigation, remediation and recovery, reporting and communication, compliance and legal considerations, efforts at continuous improvement, and training and awareness. Through these measures, our CISO and management committee on cybersecurity are informed about and monitor the lifecycle (i.e., prevention, detection, mitigation, and remediation) of cybersecurity threats or incidents.


text: Reporting to Board of Directors Our COO reports to our audit committee on a quarterly basis regarding the Company's current cybersecurity risks and activities, including any recent cybersecurity incidents and related responses, customer escalations and requests, cybersecurity systems testing, relevant threat landscape and activities of third parties, security controls implementation status and the implementation of any new cybersecurity tools. Our audit committee regularly reports its activities, including review of cybersecurity matters, to our board of directors. There is also an annual senior management meeting and report to our CEO and COO that follows our internal information security audit, which is overseen by the CEO.


text: Cybersecurity Risk Management and Strategy Our cybersecurity risk management strategy is a key component and has been integrated into our overall enterprise risk management program and has been designed based on established industry frameworks and standards, including those developed by the National Institute of Standards and Technology and the US Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program. Although this does not mean that we currently meet all of any particular technical standards, specifications, or requirements, we use these frameworks, complemented by insights from internal assessments, to guide the development of policies governing the use of our information assets, access to intellectual property, and the safeguarding of personal information.

companyName: Rocket Lab Corp

ticker: RKLB


text: To fortify our information assets, we employ industry-standard measures such as multifactor authentication and endpoint protection defenses. Moreover, we collaborate with internal stakeholders across the organization to embed fundamental cybersecurity principles into our operations. This entails implementing multiple layers of cybersecurity defenses, restricting access based on business necessity, and ensuring the integrity of our business information. Throughout the year, our employees undergo regular cybersecurity awareness training, receive guidance on protecting confidential information, and participate in simulated phishing exercises. We maintain a cybersecurity incident response plan that includes a cross-functional response team and procedures for responding to cybersecurity incidents.


text: We engage third-party assessors to conduct penetration testing and evaluate our adherence to industry-standard frameworks. Additionally, we maintain ongoing relationships with incident response experts and other external professionals. We also seek to collaborate with industry peers and cybersecurity practitioners in order to facilitate the exchange of insights and knowledge regarding potential threats, best practices, and emerging trends. We have developed processes to identify and oversee risks from cybersecurity threats associated with our third-party service providers, which includes the information security team assisting with and assessing cybersecurity robustness during onboarding as well as risk-based monitoring on an ongoing basis.


text: Our global information technology security team collaborates periodically with a cross-functional group of subject matter experts and leaders to assess and refine our cybersecurity posture and preparedness. This collaborative effort extends to partnerships with the National Defense Cyber Alliance, National Security Agency, and the FBI to monitor and comprehend active risks within the Aerospace industry, Defense Industrial Base, and Critical Infrastructure.


text: As of December 31, 2024, we have not identified any risks from cybersecurity threats (including any previous cybersecurity incidents) that have materially affected or are reasonably likely to materially affect the Company's business strategy, financial condition or results of operations. For further details on cybersecurity risks, please refer to the Risk Factors discussion in Item 1A of this Report, including the discussion under the heading "Any significant disruption in or unauthorized access to our computer systems or those of third parties that we utilize in our operations, including those relating to cybersecurity or arising from cyber-attacks, could result in a loss or degradation of service, unauthorized disclosure of data, or theft or tampering of intellectual property, any of which could materially adversely impact our business."


text: Governance of Cybersecurity Risk Management Our Board of Directors (the "Board") holds collective oversight responsibility for our strategic and operational risks. Assisting the Board in this capacity, our Audit Committee thoroughly reviews and deliberates on our risk assessment and risk management practices, including cybersecurity risks, in collaboration with management. The Audit Committee provides periodic reports on these reviews to the full Board of Directors.


text: Management bears the responsibility for the day-to-day assessment and management of cybersecurity risks. Our Chief Information Officer (CIO) assumes primary oversight of material risks stemming from cybersecurity threats. With over 20 years of experience across various information technology roles, our CIO also serves as the Vice President accountable for the Information Technology organization and information protection.


text: Reporting directly to our CIO, our Cybersecurity Manager brings over 15 years of experience in aerospace IT organizations, coupled with more than 10 years of expertise in cybersecurity.


text: Our CIO and Cybersecurity Manager evaluate our cybersecurity readiness through a combination of internal assessment tools and third-party control tests, vulnerability assessments, audits, and alignment with industry standards. We maintain governance and compliance structures tailored to promptly escalate cybersecurity-related matters to our cybersecurity team, addressing potential threats or vulnerabilities. Incidents undergo evaluation based on their impact and potential materiality, followed by reporting to designated internal and external personnel in accordance with defined procedures. Moreover, we implement diverse defensive measures and continuous monitoring techniques, leveraging established industry frameworks and cybersecurity standards, including collaboration with third-party security operations centers.


text: Our CIO conducts periodic meetings with the Audit Committee to review our information technology systems and address significant cybersecurity risks.


text: Risk Management and Strategy We identify and assess areas of risk for our business on an ongoing basis, and we have developed, and regularly update and refine, comprehensive practices to manage and mitigate existing and potential risks to our business. As part of that process, we continually identify and assess areas of cybersecurity risk for our business using the National Institute of Technology Cybersecurity Framework 2.0 ("NIST CSF 2.0 Framework"). We have an information security risk management framework that has processes dedicated to the identification, assessment and management of material risks from cybersecurity threats. Our approach to cybersecurity risk management includes the following elements: • a team dedicated solely to cybersecurity which is managed by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Digital and Transformation Officer ("CDTO"); • a third party risk management process that includes cybersecurity assessments of third party products and systems proposed to connect to our information systems environment or access or store our data; and • a cybersecurity incident response plan.

companyName: Ardent Health, Inc.

ticker: ARDT


text: Our cybersecurity team, which includes both our employees and those of our managed services providers, is comprised of people with various functional areas of responsibility, including personnel from our information technology, operations, legal, compliance, risk management, communications, incident command center, security, human resources, finance and internal audit teams. We have contracted with a Security Operations Center service provider and a Managed Detect and Response service provider; both of which are staffed 24 hours a day to provide monitoring and active protection support for our cybersecurity risk management program. Our senior security leadership team has significant experience with data security, and members have served in various roles within our security program.


text: We have devised a multi-faceted approach to assess, identify, protect, detect, respond to and recover from cybersecurity threats using the NIST CSF 2.0 Framework. We have implemented numerous threat management tools and processes, and developed disaster recovery and business continuity plans that are tested and updated periodically. We strive to stay abreast of cybersecurity threats through integrated threat intelligence feeds, industry and federal threat notices, and participation in healthcare industry intelligence sharing. We also regularly conduct table-top exercises, which serve to simulate cybersecurity incidents to practice our response and identify gaps. We routinely perform security risk assessments using internal and external services, including internal and external penetration testing.


text: We also require all employees to complete cybersecurity awareness training annually, and we circulate cybersecurity awareness alerts, safety tips and newsletters to employees across the enterprise regularly. In addition, we routinely run phishing campaigns and perform other tests to increase awareness of cybersecurity threats.


text: Our business requires us to share data, and have our systems interact, with third parties, including our service providers and vendors, as well as other healthcare providers and their vendors. This interaction and sharing of data creates risks to our systems and makes us vulnerable to third party systems and practices. Incidents and cybersecurity attacks at third parties can impact our operations and our obligations to patients, payers and others. We manage this risk through an information technology review and approval process that considers the anticipated use and implementation of proposed technologies and includes cybersecurity team assessments of third party products and systems proposed to connect to our information systems or access or store our data. A subgroup of our cybersecurity team is dedicated to risk assessment analyses of vendor security practices and protections. We leverage the FAIR (Factor Analysis of Information Risk) model to help quantify the third party's cyber risk. We endeavor to incorporate security measures into contracts with vendors. In addition to protecting our assets and systems, our cybersecurity team is tasked with detecting and defending against cybersecurity threats to our systems and data. We maintain a response plan, updated annually, that outlines actions to be taken with respect to cyber incidents and includes procedures, notification processes, and protocols for escalation to senior management. We have a cybersecurity incident response team composed of a smaller, core group of our cybersecurity team. We also engage third parties, such as forensics consultants, external legal counsel and law enforcement, as needed and as appropriate based on the circumstances. Incidents are escalated to senior management as appropriate based on the nature of the incident.


text: Management Oversight— Management is responsible for the day-to-day handling of risks facing our Company, including cybersecurity risks. Our CISO, who reports directly to our CDTO, oversees and manages our cybersecurity strategy and related programs. As the head of our cybersecurity team, both internal and outsourced, our CISO is primarily responsible for assessing and managing risks from cybersecurity threats. The processes by which he is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents is described above. He reports information about such risks to the CDTO and other members of senior management, who, in turn, report them to our Board and Audit and Compliance Committee, as appropriate. Our CISO joined us in January 1998 with 13 years of experience in various technology and information security roles within Ardent.


text: Board Oversight—Our Board of Directors (the "Board"), as a whole and through its committees, oversees risk management, including cybersecurity risks. The Board has delegated certain risk management responsibilities with respect to cybersecurity to our Audit and Compliance Committee. Our Board has identified the oversight of cybersecurity risks to be one of its priorities, and it receives regular reports from management, including the CDTO and the CISO, on various cybersecurity matters, including the security of our information systems, anticipated sources of future material cyber risks and how management is addressing any significant potential vulnerability. The Board's Audit and Compliance Committee receives regular updates on cybersecurity threats and other matters. In addition to regular updates to the Audit and Compliance Committee, we have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported in a timely manner to the Board and Audit and Compliance Committee.


text: Existing and Potential Risks As discussed in the Risk Factors section above, our operations could be significantly and negatively impacted by cybersecurity threats and other disruptions affecting our information technology, related information systems and sensitive information. We rely on our information technology to process, transmit and store clinical, financial and operational data that includes PHI, PII and proprietary and confidential business data. We utilize EHRs and other information technology in connection with all of our operations, including our billing and other financial systems, supply chain and labor management tools. As described above, our information systems, in turn, interface with and rely on third party systems that we do not control, including medical devices and other processes supporting the interoperability of healthcare infrastructures.


text: In November 2023, we experienced the Cybersecurity Incident, which temporarily disrupted our operations and involved the exfiltration of certain confidential employee and patient information. We incurred significant costs to remediate the issues, sustained lost revenues from the associated business interruption and incurred other related expenses. Following the Cybersecurity Incident, we implemented certain changes to our information systems and processes meant to provide additional protections to our environment, including, among other things, enhancing the visibility of our Security Operations Center, training practices, detection tools and capabilities, and implemented new tools and processes, expanded the scope of vulnerability management, and increased scrutiny of internet access. In addition, we adopted several technologies that incorporate artificial intelligence capabilities to enhance our protection capabilities. However, we continue to face a heightened risk of cybersecurity threats targeting healthcare providers, including ransomware attacks, which may materially impact our operations. Threat actors continue to proliferate, adapt and devote significant effort to attacking the information systems and electronically transmitted and stored data of healthcare providers and related entities.


text: Except for the Cybersecurity Incident, no risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may not be sufficient to cover all insured losses or all types of claims that may arise.


text: Cybersecurity Risk Management and Strategy Our cybersecurity program is staffed by a team of skilled cybersecurity professionals, including ~20 dedicated internal cybersecurity resources. Four members of the security team currently have Certified Information Systems Security Professional (CISSP) credentials, many hold one or more Global Information Assurance Certification (GIAC)/The Sans Institute (SANS) cybersecurity certificates, and in total the team has over 70 security and network certifications. Our response team members are in various global locations to ensure 24/7 monitoring and response capabilities and are backed by a 24/7 Managed Security Services Provider (MSSP) who monitors cybersecurity alerts.

companyName: Crane Co

ticker: CR


text: We educate and share best practices globally with our employees to raise awareness of cybersecurity threats. As part of our internal training process, we maintain annual training for all employees on cybersecurity standards, as well provide monthly trainings on how to recognize and properly respond to phishing, social engineering schemes and other cyber threats. The Company uses advanced systems to block and analyze all email for threats, as well as equip our employees with an intuitive mechanism to easily report suspicious emails which are analyzed by our security systems and dedicated incident response team. Monthly "test" phishing emails are sent to our associates. Any failures trigger a retraining exercise if not properly reported and a monthly training vignette on cybersecurity awareness. To round out our robust awareness program, we have specific and regular training for our IT professionals, and we regularly engage independent third parties to test our information security processes and systems as part of our overall enterprise risk management program.


text: Crane Company was separated from its parent company, Crane Holdings, on April 3, 2023, and since the separation and during the preceding 5 years as Crane Holdings, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our operations or financial results, in any penalties or settlements, or in the loss or exfiltration of Company data. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. The Company maintains cyber risk and related insurance policies as a measure of added protection.


text: Cybersecurity Governance The cybersecurity program is led by Crane Company's Chief Information Security Officer, who regularly reports to our executive team about our program, including a review of cyber threat trends, our information security organization and staffing, and the status of ongoing efforts and investments to strengthen our cybersecurity defenses.


text: We utilize a risk-based, multi-layered information security framework following the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls. We have adopted and implemented a systematic approach measuring ourselves against this multi-layered framework which we formally review on a quarterly basis (monthly updates as necessary) to identify and mitigate security risks that we believe are commercially reasonable for manufacturing companies of our size and scope and commensurate with the risks we face. In addition, we provide a minimum of two formal program updates each year to the Audit Committee of our Board of Directors.


text: Risk Management and Strategy As we are a company that leverages data, technology and analytics to improve health care, we invest in long-term solutions to address current and foreseeable risks and threats to data security and privacy, while also enabling technological development that enhances the member experience. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: Alignment Healthcare, Inc.

ticker: ALHC


text: We have designed and deployed a comprehensive cybersecurity risk management program that is embedded in our broader risk management framework, all of which is overseen by our Board of Directors. Our program is designed to include ongoing assessment of our critical assets; detection and analysis of potential threats; timely management of identified security risks; and prompt remediation planning and implementation. To successfully operate and monitor our security readiness, we maintain a data security and privacy team with substantial real-world experience to detect and respond to cybersecurity threats. Our multi-layered security is bolstered by technologies and partners and includes annual employee and vendor security awareness trainings, enhanced access control, data loss protection and vulnerability management, among other technical and process security controls. Our proprietary data architecture, AVA, incorporates high security controls around member data. Our information security program considers how attackers are using emerging technologies (such as artificial intelligence) to help inform our defensive tactics. Our team also regularly reviews emerging product technology to improve our capabilities.


text: In 2021, we received the externally validated HITRUST certification, the gold standard compliance framework in the health care industry. Through our data security and privacy program and policies, we adhere to the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA), other federal regulations and best-practices within the health care industry. Moreover, our risk analysis methodology is consistent with ISO 27001, the Federal Information Security Management Act and the U.S. Department of Commerce National Institute of Standards and Technology and Center for Internet Security Special Publication 800-66.


text: Our strict protection and security measures have resulted in zero security incident-related disruptions or downtime to our business continuity. However, there is no guarantee that a future security incident would not materially affect our business strategy, results of operations or financial condition. See "Risk Factors" beginning on page 13 of this Form 10-K.


text: Engagement of Third Parties Our information security program is under nearly constant third-party review as part of Sarbanes-Oxley compliance and the HITRUST certification process, including independent third-party penetration testing of all information technology assets at least annually and assessment of our vulnerability to ransomware. Multiple industry-standard third-party tools are utilized to detect vulnerabilities. Alignment is a member of the Healthcare Information Sharing and Analysis Center (Health-ISAC) operated by the U.S. Department of Health and Human Services and the Department of Homeland Security and is affiliated with the FBI InfraGard program, providing deep, actionable intelligence regarding healthcare security and privacy threats and countermeasures. We continuously monitor the Health-ISAC reporting to anticipate and respond to potential threats.


text: Management of Third-Party Cyber-Risk We rely on third-party vendors to provide supplemental benefits to our members and for a variety of other key business functions. Accordingly, our vendor onboarding process includes a comprehensive security assessment. Moreover, at least quarterly, we assess the risks from cybersecurity threats relating to each of our member-facing and other key third-party service providers with whom we share protected health information, personal identifying information and confidential information. We generally require our suppliers to adopt security-control principles based on industry-recognized standards and we seek audit rights over their security protocols.


text: Cybersecurity Governance As a component of its general oversight over key risks to our business, our Board of Directors has established robust oversight mechanisms designed to ensure effective governance in managing risks associated with cybersecurity threats. As a technology-enabled Medicare Advantage platform, we have selected directors with backgrounds in technology and expertise in data privacy and cybersecurity matters, which represent important elements of our risk management strategy.


text: Our Audit Committee is responsible for the direct oversight of risks from cybersecurity threats. Members of the Audit Committee receive updates on at least a quarterly basis from senior management, including leaders from our information security, compliance and legal teams regarding matters of cybersecurity. Reports by management to the Audit Committee include existing and new cybersecurity risks, status updates regarding how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. The Audit Committee's involvement ensures that cybersecurity considerations are integrated into the Company's broader strategic objectives. The Audit Committee conducts an annual review of the company's cybersecurity posture and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework. As needed, this framework also includes consultations with our enterprise risk management committee, led by our Chief Compliance and Privacy Officer.


text: Alignment's cybersecurity organization is led by David MacLeod, our Chief Information Security Officer, who is responsible for the prevention, detection, mitigation, and remediation of cybersecurity incidents and reports to Robert Scavo, our Chief Information Officer, as well as to the Audit Committee. Mr. MacLeod has served as our CISO since December 2022, has over 26 years of diverse leadership experience in the healthcare information space (including over 20 years as a certified information systems security professional and chief information security officer) and holds advanced degrees in information technology management and computer science.


text: The CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. The CISO implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. In the event of a cybersecurity incident, the CISO is equipped with a well-defined incident response plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents.


text: Risk Management and Strategy We are subject to cybersecurity incidents and information theft risks in our operations, which we seek to manage through cybersecurity and information security programs, training and insurance coverage. To strengthen our security and cybersecurity defenses, we maintain a defensive approach to cybersecurity and information security designed to defend our systems against misuse, intrusions and cyberattacks and to protect the data we collect. Our processes to assess, identify and manage material risks from cybersecurity threats are strategically integrated into our overall risk management framework, as evidenced by annual risk assessments and required trainings across business lines and applications. Our information security program maintains procedures and controls for the systems, applications and our data and data of our third-party providers. We have an established cybersecurity training program which is administered through online learning modules and is required for all employees at least annually. Such trainings cover topics such as password protection, phishing, the protection of confidential information and asset security, among others and educate employees on mechanisms in place to report cybersecurity incidents or suspicions of cybersecurity incidents or threats. Further, we maintain a cybersecurity incident response plan, which is managed by our C hief Information Security Officer (CISO) and is reviewed and tested annually. The incident response process is overseen by a security operations and cybersecurity incident response team comprised of members across the organization, including global management and IT operations and leverages an organizational-wide platform that allows us to track, manage and resolve information security risks across the organization.

companyName: CORPAY, INC.

ticker: CPAY


text: Our information security program is designed to generally align with recommended practices in security standards issued by the International Organization for Standardization (ISO), American Institute of Certified Public Accountants (AICPA, SSAE18), National Institute of Standards and Technology Cybersecurity Framework (NIST CSF), Payment Card Industry Data Security Standard (PCI DSS) and other industry sources. Specifically, we strive to maintain ISO certifications (ISO 27001 Brazil and U.K.), SOC 1 and 2 Type 2 reports and PCI DSS reports on compliance to adhere to industry standard practices.


text: Our newly acquired businesses operate with independent cybersecurity programs and processes, which may vary in scope and complexity compared to our overarching cybersecurity framework, until they are fully integrated into our unified system.


text: As part of our overall risk mitigation strategy, we also maintain cybersecurity insurance coverage; however, such insurance may not be sufficient in type or amount to cover us against claims related to security breaches, cyberattacks and other cybersecurity incidents.


text: We have not identified any risks from cybersecurity threats, including as a result of previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations, or financial condition. However, we have been the target of cyber-attacks and expect them to continue as cybersecurity threats have been rapidly evolving in sophistication and becoming more prevalent in the industry. We cannot eliminate all risks from cybersecurity threats or provide assurances that we have not experienced an undetected cybersecurity incident in the past or that we will not experience such an incident in the future. For more information on the risks from cybersecurity threats and incidents that we face, refer to Part I, "Item 1A. Risk Factors."


text: Use of Third Parties To regularly assess whether our cybersecurity strategies and processes remain appropriate to prevent, investigate and address cybersecurity-related issues, we engage with information security and forensics firms with specialized industry knowledge. Our collaboration with these third parties includes the administration of third-party security questionnaires, risk assessments and testing and consultation on security enhancements to attempt to mitigate threats. We also collaborate with third parties, regulators and law enforcement, when appropriate, to resolve security incidents and assist in efforts to prevent unauthorized access to our processing systems.


text: In order to oversee and identify risks from cybersecurity threats and incidents associated our use of third-party service providers, we maintain a risk management program designed to help protect against the misuse of information technology. In addition to risk assessments and questionnaires obtained upon selection of a new service provider, we also perform annual third-party risk assessments to ensure these service providers continue to meet contractual obligations for cybersecurity, regulatory and industry requirements.


text: Board of Directors Oversight The Information Technology and Security Committee (ITSC) is responsible for providing oversight and leadership for our information technology security and cybersecurity planning processes, policies and objectives. The ITSC is composed of board members with both industry knowledge as well as expertise in technology and security, finance and risk management. The primary purpose of the committee is to review, assess and make recommendations regarding the long-term strategy for global information security and the evolution of our technology in a competitive environment.


text: To accomplish this purpose, the information technology and security committee has four primary responsibilities: • to understand the security controls and assessments conducted on major card platforms and concur that such controls are comparable to industry best practices and standards as appropriate; • to assess technology modernization plans and processing platform strategies to validate proper investment in multi- year initiatives that maintain effective and efficient use of Company resources; • to review progress on significant IT projects against milestones and quality indicators and evaluate actions intended to drive quality and timeliness; and • to evaluate the prioritization of strategies for intellectual property protection.


text: Management's Role The Board and the information technology and security committee directed the formation of a cross-functional cybersecurity council and receive regular cybersecurity reports from the Company's Chief Information Officer (CIO) and the CISO, among others. These reports include updates on our cybersecurity strategy and execution of its processes, including updates on procedures to prepare for, prevent, detect, respond to and recover from (as applicable) cybersecurity incidents. Such updates also include updates on our continued compliance with regulatory requirements. Our information security and risk management program is periodically evaluated by third-party specialists, and the results of those reviews are reported to the Board.


text: Our CISO, who reports directly to our CIO, has served in various roles in information technology and information security for over 20 years, with experience in technology risk management, cybersecurity, compliance, network engineering, information systems and business resiliency. He is a Certified Information Systems Security Professional and Certified Information Systems Auditor.