text: Processes for Assessing, Identifying and Managing Cybersecurity Risks We are continuously assessing and adopting new processes, systems and resources in an effort to make our business safer from cybersecurity threats. We depend on digital technology in many areas of our business and operations, including, but not limited to, our gathering and compression and water handling services, processing and recording financial and operating data, oversight and analysis of our operations and communications with the employees supporting our operations and our customers and service providers. We also collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary information for our business and that of our customers, suppliers, investors and other stakeholders.

companyName: Antero Midstream Corp

ticker: AM


text: Attacks on our assets or security breaches in our systems or infrastructure could lead to the corruption, loss or unauthorized use of such data, delays in production or delivery of our production to customers, difficulty in completing and settling transactions, challenges in maintaining our books and records, environmental damage, communication interruptions or other operational disruptions. We seek to address these risks by safeguarding assets, data and operations through the cybersecurity risk management processes described below:

secItem: Item 1C


text: Risk Assessments We assess our systems, networks and data infrastructure to identify potential cybersecurity threats and vulnerabilities via continuous automated processes that are complemented by manual processes that are executed on both a routine and ad hoc basis. These processes are designed to prevent, detect and investigate activities and events that could pose a cybersecurity risk or threat to us, and include, but are not limited to, monitoring and evaluating cybersecurity intelligence information published or provided by certain United States federal government agencies as well as private cybersecurity groups. Our risk assessment processes are conducted, monitored and reviewed by our security and compliance team as well as third-party consultants. In addition, we perform cybersecurity tabletop exercises with our information technology ("IT") department throughout the year. We also engage a third-party consultant to conduct an annual penetration test of our systems, networks and data infrastructure to complement our risk assessment processes and activities. These risk assessments help evaluate the likelihood and potential impact of cybersecurity incidents.


text: Our Vice President – IT oversees these risk assessments and meets regularly with the security and compliance team to review cybersecurity risks and threats, and also participates in our enterprise risk management process. In addition, the Company engages several third-party consultants in connection with the risk assessments, and we have established separate processes and procedures to oversee and identify cybersecurity risks associated with third parties. All third parties involved in our cybersecurity risk assessments are required to provide reports designed to allow us to monitor and assess such third parties' security controls.


text: We monitor and manage our cybersecurity risk and threat exposure through prioritized remediation efforts. Any cybersecurity risk or threat that requires corrective action is managed by our security and compliance team together with certain business partners and IT specialists, as deemed necessary. Potential solutions are assessed in alignment with risk, business and cybersecurity priorities and our controls and security architecture. Plans to remediate cybersecurity risks are approved and monitored regularly for completion.


text: Incident Identification and Response We have implemented a monitoring and detection system, with oversight from our Vice President – IT to help promptly identify cybersecurity incidents. In the event of any breach or cybersecurity incident, we have a formal incident response plan designed to provide for immediate action to contain the incident, mitigate the impact and restore normal operations efficiently.


text: Cybersecurity Training and Awareness We train our users throughout the year using a wide variety of methods on cybersecurity-related topics, including how to identify and report potential social engineering including phishing through emails, text messages and phone calls. Formal training on cybersecurity practices begins when an employee is hired and is re-administered annually. We also require third-party contractors with access to our systems be trained on these topics. In addition, special training is held both formally and informally for groups that entail higher threat risks.


text: Our IT polices are designed to address and manage all aspects of our IT environment, including cybersecurity, and we review and update our policies regularly as part of our risk management processes. We deploy both an internal Protection of Personal Identifiable Information Policy and a publicly available Privacy Notice to help us understand and respect the privacy of the individuals whose data we have custody over. We monitor our data collection practices, policies and notices in an effort to comply with the evolving nature of applicable data privacy and security laws.


text: Our cybersecurity risk management processes are integrated into our enterprise risk management program. Cybersecurity threats are understood to be dynamic and intersect with various other enterprise risks. As such, cybersecurity is considered to be an important component of our enterprise risk management approach. Our cybersecurity strategies are based on standard cybersecurity frameworks, including the National Institute of Standards and Technology and the International Organization for Standardization.


text: Board of Directors' Oversight of Cybersecurity Risks and Management's Role in Assessing and Responding to Cybersecurity Risks Cybersecurity risks are overseen at the board level through the Audit Committee. Our Vice President – IT, together with the security and compliance team, is responsible for the monitoring, assessment and management of cybersecurity risk, and seeks to maintain the security and continuity of our operations. Our Vice President – IT oversees the Company's cybersecurity strategy, cybersecurity and data privacy policies, measures and controls, and Board of Directors and Audit Committee communications on cybersecurity matters. Our Vice President – IT regularly briefs senior management, the Board of Directors and the Audit Committee on cybersecurity issues as part of our overall enterprise risk management program, including quarterly updates to the Audit Committee, which may include information regarding our exposure to privacy and cybersecurity risks, plans and activities to monitor and mitigate privacy and cybersecurity risks, IT governance policies and programs, including our cybersecurity incident response plan, and legislative and regulatory developments that could impact our privacy and cybersecurity risks. Additionally, our Vice President – Risk Management oversees our enterprise risk management process and apprises the Audit Committee and our Board of Directors of all significant risks facing the Company, including cybersecurity risks.


text: Our Vice President – IT, Biren Kumar, has more than 16 years of experience serving as a Chief Information Officer ("CIO") or similar role, which included responsibility for managing cybersecurity risk. Mr. Kumar was named Vice President – IT in 2024. Prior to joining Antero, he served as the CIO for several companies, including Dynegy Inc. from 2005 to 2011, Rockwater Energy Solutions Inc. from 2011 to 2014, KLX Inc. from 2014 to 2018 and KLX Energy Services Holdings, Inc. from 2018 to 2021. Mr. Kumar holds a Bachelor of Business Administration in Management Information Systems and a Master of Business Administration from the University of Houston.


text: Impact of Risks from Cybersecurity Threats The energy industry's growing reliance on information technology and operational technology to support critical operations, such as energy distribution and management activities, has made it more susceptible to cybersecurity incidents. As a result, the global rise of cybersecurity incidents, whether from intentional attacks or accidental events, poses a significant challenge to our industry. As cybersecurity threats continue to evolve in complexity and scale, it remains an ongoing and increasingly difficult task for the industry to prevent, detect, mitigate, and remediate these incidents.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future discovery of cybersecurity incidents remains. Please see "Item 1A. Risk Factors" for additional information about cybersecurity risks. Despite the implementation of our cybersecurity programs, our security measures cannot guarantee that a cyberattack with significant impact will not occur. A successful attack on our IT systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Processes for Assessing, Identifying and Managing Cybersecurity Risks We are continuously assessing and adopting new processes, systems and resources in an effort to make our business safer from cybersecurity threats. We depend on digital technology in many areas of our business and operations, including, but not limited to, estimating quantities of oil and natural gas reserves, processing and recording financial and operating data, oversight and analysis of drilling, completion and production operations and communications with our employees and third-party customers and service providers. We also collect and store sensitive data in the ordinary course of our business, including certain personally identifiable information and proprietary information for our business and that of our customers, suppliers, investors and other stakeholders.

companyName: ANTERO RESOURCES Corp

ticker: AR


text: Our Vice President – IT, Biren Kumar, has more than 16 years of experience serving as a Chief Information Officer ("CIO") or in similar roles, which have included responsibility for managing cybersecurity risk. Mr. Kumar was named Vice President – IT in 2024. Prior to joining Antero, he served as the CIO for several companies, including Dynegy Inc. from 2005 to 2011, Rockwater Energy Solutions Inc. from 2011 to 2014, KLX Inc. from 2014 to 2018 and KLX Energy Services Holdings, Inc. from 2018 to 2021. Mr. Kumar holds a Bachelor of Business Administration in Management Information Systems and a Master of Business Administration from the University of Houston.


text: Impact of Risks from Cybersecurity Threats The energy industry's growing reliance on information technology and operational technology to support critical operations, such as energy production, distribution, and management activities, has made it more susceptible to cybersecurity incidents. As a result, the global rise of cybersecurity incidents, whether from intentional attacks or accidental events, poses a significant challenge to our industry. As cybersecurity threats continue to evolve in complexity and scale, it remains an ongoing and increasingly difficult task for the industry to prevent, detect, mitigate, and remediate these incidents.


text: Cybersecurity Risk Management and Strategy The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of its critical systems and information.

companyName: O-I Glass, Inc. /DE/

ticker: OI


text: The Company assesses its program based on guidance from the National Institute of Standards and Technology ("NIST"). This does not imply that the Company meets any particular technical standards, specifications, or requirements, only that the Company uses the NIST as a guide to help it identify, assess, and manage cybersecurity risks relevant to its business.


text: The Company's cybersecurity risk management program is integrated into its overall enterprise risk management program and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: The Company's cybersecurity risk management program includes the following, among other things: risk assessments designed to help identify material cybersecurity risks to the Company's critical systems and information;


text: cross-functional teams responsible for managing the Company's (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of the Company's security processes and controls; cybersecurity awareness training of the Company's employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for certain service providers based on the Company's assessment of the providers' criticality to its business and the providers' cybersecurity risk profile.


text: The Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected the Company, including its operations, business strategy, results of operations, or financial condition. The Company faces certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations, or financial condition. See "Risk Factors – Risks Related to Information Technology, Cybersecurity and Data Privacy."


text: Cybersecurity Governance The Company's Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of the Company's cybersecurity risk management program.


text: The Committee receives quarterly reports from management on the Company's cybersecurity risks. In addition, management updates the Committee, as necessary, regarding cybersecurity incidents as determined by its Chief Human Resources and Technology Officer (the "CHRTO").


text: The Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. The full Board of Directors also receives briefings from management on the Company's cybersecurity risk management program. Members of the Board of Directors receive presentations on cybersecurity topics from the CHRTO or external experts as part of the Board's continuing education on topics that impact public companies.


text: The Company's management team is responsible for assessing and managing the Company's material risks from cybersecurity threats. The Company has a Cybersecurity Steering Committee comprised of members of management, including the CHRTO and the Company's Director of Cybersecurity, as well as other subject matter experts throughout the Company. The Cybersecurity Steering Committee has primary responsibility for the Company's overall cybersecurity risk management program and supervises both internal cybersecurity personnel and retained external cybersecurity consultants. The experience of the members of the Cybersecurity Steering Committee includes the Company's CHRTO, who has more than 20 years of experience across various industries, and the Company's Director of Cybersecurity, who has 29 years of IT experience, including eight years leading the Company's Cybersecurity Team of IT security professionals, and who is a member of the Information Systems Audit and Control Association and the International Information System Security Certification Consortium.


text: The Cybersecurity Steering Committee supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by the Company; and alerts and reports produced by security tools deployed in the IT environment.


text: Our business relies on computer systems to provide customer information, process customer transactions, communicate, and provide other general information necessary to manage our business. We also rely on a payment card industry- compliant third party to protect our customers' credit card information.

companyName: Waste Connections, Inc.

ticker: WCN


text: We assess, identify and manage material risks from cybersecurity threats under our enterprise risk assessment framework, as well as several related policies and procedures addressing areas such as threat vulnerability management, cyber risk management, data protection and classification, network security, access control, incident response, security awareness, employee training and asset management. These policies and related standards require identification of all Information Technology (IT) and Operational Technology (OT) critical systems, assets and networks, and sufficient controls for IT and OT asset inventory, including responsibilities for assets, information owners, and asset disposition processes. From a security perspective, our Information Technology and Safety teams are responsible for protecting physical processes, safety, production, efficiency, and protection of employees. Our Information Security team is directed at protecting all aspects of data and how information is stored, transmitted, processed and used in business processes.


text: Our Information Security team of the Information Technology department has the direct responsibility for developing, monitoring and enforcing information security standards and procedures; reviewing and approving all network interconnections for compliance to security standards; and assisting, consulting and training individuals throughout the Company in the use of appropriate information security practices. This group is responsible for ensuring that all IT and OT systems, assets and networks are aligned with the parent company and affiliate cybersecurity framework. We engage independent third-party consultants from time to time to assess the adequacy of our cybersecurity measures and assist in implementing any appropriate actions to address any vulnerabilities identified. The Senior Vice President – Chief Information Officer, or CIO, who reports to the Executive Vice President and Chief Operating Officer, oversees this group and is responsible for managing the program, in collaboration with our business and functions. Our CIO has served in that role with us since 2004 and has extensive experience with cybersecurity and information technology at the Company.


text: Our vendor risk management process includes conducting risk assessments to identify and monitor cybersecurity risks associated with third-party service providers, including threat detection and security event notifications. We also have requirements for third-party service providers which include regulatory compliance and meeting NIST Cybersecurity Framework policy and standards. Our agreements with third-party service providers include cybersecurity provisions to address risks.


text: Our Security Incident Response Plan is updated periodically and reviewed at least annually. This plan includes guidelines for the escalation and communication of cybersecurity incidents, including a requirement to timely report to executive leadership and the Board of Directors based on an assessment of the risk and other specified criteria. We have established a cyber incident response team to prepare for, mitigate and remediate cybersecurity incidents, which is integrated within our enterprise crisis management framework.


text: Cybersecurity risks are integrated into our overall risk management process through the collaboration of the cybersecurity professionals and our risk management functions to assess threat levels at the subsidiary and parent company level and identify steps and resources appropriate to manage such risks. The Board of Directors oversees the management of risks from cybersecurity threats through regular reports received from the CIO, which include updates on our performance with preparing, preventing, detecting, responding to, mitigating and recovering from cybersecurity incidents. Should a cybersecurity threat or incident pose a significant risk to the Company, our processes provide that the CIO, through the CEO, as appropriate, would promptly inform the Board regarding any such threat or incident.


text: We are regularly the target of attempted cyber and other security threats and must continuously monitor and develop our information technology networks and infrastructure to prevent, detect, address and mitigate the risk of unauthorized access, misuse, computer viruses and other events that could have a security impact. While to date the Company has not detected a significant compromise of its information and operating systems, significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. Risk Factors, "We are increasingly dependent on technology, including through the use of Artificial Intelligence (AI), in our operations and a failure of our technology could impact our ability to service our customers and adversely affect our financial results, damage our reputation, and expose us to litigation risk."


text: Cybersecurity is an integral part of risk management at Nabors. We rely on our technology infrastructure and information systems to interact with clients, vendors, operate our drilling rigs, and bill, collect, and make payments. Our technology infrastructure and information systems also support and form the foundation for our accounting and finance systems and form an integral part of our disclosure and accounting control environment. Our internally developed systems and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, which include any unauthorized access to our information systems that may result in adverse effects on the confidentiality, integrity, or availability of such systems or the related information. Potential cybersecurity threats include terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, theft of intellectual property or other security breaches. Such attacks have become more and more sophisticated over time, especially as threat actors have become increasingly well-funded by, or themselves include, governmental actors, organized crime and hackers with significant means. We expect that sophistication of cyber-threats will continue to evolve as threat actors increase their use of artificial intelligence and machine-learning technologies.

companyName: NABORS INDUSTRIES LTD

ticker: NBR


text: The Board of Directors appreciates the rapidly evolving nature of threats presented by cybersecurity incidents and is committed to the prevention, timely detection, mitigation, and preparedness for recovery of any such incidents whether perpetrated on the Company or our stakeholders. The Risk Oversight Committee of our Board has direct oversight of our management of cybersecurity risks.


text: Our Enterprise Risk Management Committee receives reports on the Company's cybersecurity program and developments from our Vice President of Information Technology. Our Enterprise Risk Management Committee and our Vice President of Information Technology report to the Company's Board of Directors at each of the regularly scheduled quarterly meetings. These reports include analyses of recent cybersecurity threats and incidents across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status;


text: We have a cross-functional approach to addressing cybersecurity risk, with digital technology, legal, and the corporate audit functions presenting to the Enterprise Risk Management Committee on key cybersecurity topics; and On at least an annual basis, the full Board of Directors receives a comprehensive cybersecurity review, including director education from third-party cybersecurity experts.


text: Our Vice President of Information Technology, reporting to our Chief Administrative Officer, has principal responsibility for assessing and managing cybersecurity risks and threats, implementing the systems necessary to address such risks and threats and preparing updates for the Risk Oversight Committee and the Board of Directors. Our Vice President of Information Technology has over 20 years of experience in the cybersecurity field, including with implementing advanced cybersecurity and risk management strategies, audits, compliance with regulatory requirements and applying various security frameworks such as ISO 27001 and NIST. Our Senior Director of Cybersecurity Governance reports to our Vice President of Information Technology and is responsible for the operation of our cybersecurity program and management of our cybersecurity team. Our Senior Director of Cybersecurity Governance has over 15 years of experience in the cybersecurity field including experience with risk assessments, implementing of industry-leading security tools, conducting security reviews of system implementations and cyber risk management strategies.


text: The Technology and Safety Committee of the Board of Directors reviews the integrity of information technology systems, including the potential for cybersecurity threats. In addition, the Risk Oversight Committee monitors management's identification and evaluation of major strategic, operational, regulatory, information technology, cyber security and other external risks inherent in the Company's business. Activities include mandatory training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation of cybersecurity insurance, periodic assessments of third-party service providers to assess cyber preparedness of key vendors, and running simulated cybersecurity drills, including vulnerability scanning, penetration testing and disaster recovery exercises, throughout the organization. These cybersecurity drills are performed both in-house and by third-party service providers. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. The Enterprise Incident Response Team also has effected comprehensive incident response plans that outline the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Enterprise Incident Response Team escalates events, including to the Chief Executive Officer and Board of Directors, as relevant, according to pre-defined criteria.


text: We leverage the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) to drive strategic direction and maturity improvement and engage third-party security experts to conduct risk assessments and program enhancements. Additionally, we evaluate our controls environment annually using other relevant standards like Oil and Natural Gas Subsector Cybersecurity Capability Maturity Model.


text: We engage subject matter experts such as consultants to assist us in establishing processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident. The Enterprise Incident Response Team oversees and establishes the parameters of our engagement with these experts to ensure we obtain the supplement assistance needed in this area, if any.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and we do not believe that such risks are reasonably likely to have such an effect over the long term. While we have not experienced any material cybersecurity threats or incidents, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. See Part I, Item 1A.—Risk Factors— Our business is subject to cybersecurity risks.


text: Cybersecurity Risk Management and Strategy Our approach to mitigating information technology and cybersecurity risk comprises a range of activities with the primary objective of maintaining the confidentiality, integrity and availability of our critical IT Systems and information related to our business. Although IT Systems are inherently vulnerable to interruption due to a variety of sources, we have aligned our cybersecurity risk management program, including our processes and controls, with certain applicable and relevant guidelines. For example, we have aligned our processes with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and assess our cybersecurity maturity against the NIST CSF's core functions; however, this does not imply that we meet any particular technical standards, specifications or requirements, only that we use the NIST CSF as a guide to help us identify, assess and manage cybersecurity risks relevant to our business.

companyName: SKYWEST INC

ticker: SKYW


text: Our cybersecurity risk management processes include a cybersecurity incident response plan, and we have invested in technical and organizational safeguards intended to manage and mitigate material risks from cybersecurity threats to our IT Systems, including network security controls, employee training, internal vetting of third-party vendors and service providers with whom we may share data, and regular system reviews and security exercises. Our cybersecurity risk management program is a component of our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: While we work closely with accredited third-party cybersecurity firms, where appropriate, to audit our security architecture, our Information Security Team, consisting of experienced cybersecurity professionals, is responsible for the day-to-day management of our cybersecurity risks, including directing our cybersecurity risk assessment processes, our security processes, and our response to cybersecurity incidents.


text: For the year ended December 31, 2024, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – Cybersecurity incidents, hardware or software failures or other information technology disruptions may negatively impact our operations, reputation and financial condition."


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation and enforcement of our cybersecurity risk management program.


text: The Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Audit Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential. The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Audit Committee members also receive presentations on cybersecurity topics from our Vice President of Information Technology and Chief Financial Officer, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our Chief Financial Officer and Vice President of Information Technology, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our Vice President of Information Technology has more than 25 years of experience managing and leading IT and cybersecurity teams. Our Vice President of Information Technology participates in the Aviation ISAC organization, an international membership community of airframers, airlines, airports, satellite manufacturers, aviation services, and their supply chains that collaborate to prevent, detect, respond to, and remediate cyber risk through threat intelligence sharing and best practices.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: Governance Related to Cybersecurity Risks Our management, with involvement and input from our audit committee, performs an annual enterprise-wide risk management (ERM) assessment to identify and manage key existing and emerging risks for our company. Our ERM process seeks to identify both the potential impacts to our company of a particular risk and the likelihood and proximity of any such risk. Our management team is responsible for implementing and overseeing our ERM process. Cybersecurity is among the risks identified for board of directors' level risk oversight as a result of our most recent ERM assessment, with our audit committee of the board of directors having been delegated responsibility for overseeing our policies, practices and assessments with respect to cybersecurity and other information technology risks.

companyName: Blueprint Medicines Corp


text: Our information security team is led by the SVP of IS, who reports to our chief financial officer. Our SVP of IS has over 25 years of experience managing and securing technology infrastructure. The information security team has responsibility for the planning and execution of our processes to manage cybersecurity and other information technology risks. The information security team also institutes and maintains controls for our systems, applications, and databases.


text: The audit committee receives periodic updates on our cybersecurity risks from our information security team, which include biannual presentations on the status of our cybersecurity risk management program by the SVP IS. These reports include updates on our performance preparing for, preventing, detecting, responding to and recovering from cyber incidents, if any. In addition, as needed, management updates the audit committee regarding any notable cybersecurity incidents. We have also implemented an annual process for employees to complete security awareness training.


text: Cyber Risk Management and Strategy Our processes to identify, assess, and manage risks presented by cybersecurity threats are informed by the National Institute of Standards and Technology Cybersecurity Framework. Our SVP of IS, with support from the information security team, is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include leveraging external third parties for security testing.


text: The information security team monitors security alerts from information security research sources and peer networking, and we have implemented processes and technologies for monitoring our networks for exfiltration of sensitive company information. Before contracting with third parties or purchasing third party technology or other solutions that involve exposure to sensitive company information the team assesses vendor risk, including by requesting SOC2 reports and/or security documentation from a vendor, where appropriate, and we receive and review security updates and alerts from these third parties. Penetration testing is performed periodically across our network boundaries to identify issues for remediation. Additionally, we maintain off-site back-ups and disaster recovery plans to restore our information and systems in the event of a disruptive event.


text: The information security team also has processes in place to inform and update management and, as needed, the audit committee about cybersecurity incidents that may pose significant risk to the company. Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third-party vendors' data and systems. For more information, please see "Item 1A, Risk Factors."


text: The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by our Board and delegated to the Audit Committee. Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.

companyName: Trilogy Metals Inc.

ticker: TMQ


text: The Company uses a multi-layered, multi-vendor cybersecurity protection structure that focuses on user security and system and infrastructure security to mitigate cybersecurity threats such as unauthorized access, cybersecurity attacks and other security incidents. These and other potential security threats may damage or disrupt our hardware and software systems, lead to a loss of data or to the misappropriation of confidential information. To mitigate these risks, we have implemented technology solutions that are designed to recognize anomalous activity and behavior including, but not limited to: the use of antivirus software, restrictions on installing applications directly to users' machines, the deployment of internet browsing filters, remote access using a VPN client, multi-factor authentication, network firewalls and email protection.


text: Management is responsible for managing cybersecurity risks and bringing to the Board's attention any material risks. Under the oversight of the Audit Committee, the Company's Chief Financial Officer is primarily responsible for the assessment and management of cybersecurity risks and utilizes a third-party consultant to assist with managing these risks.


text: While we have never had a material cybersecurity incident that impacted our operations, from time to time we face various cyber and other security threats, including attempts to gain unauthorized access to sensitive information and networks; employee threats; virtual and cyber threats to our directors, officers, and employees; threats to the security of our facilities and infrastructure; and threats from artificial intelligence, terrorist acts or other acts of aggression. Our customers and vendors may face similar threats. We utilize internal and external independent controls to monitor and mitigate the risk of these threats, including an outside independent Cybersecurity consultant, a Security Incident Response Plan (SIRP) and periodic Information Technology training for all employees.

companyName: SCI Engineered Materials, Inc.

ticker: SCIA


text: Preparation—perform a risk assessment, identify sensitive assets, and build a Computer Security Incident Response Team (CSIRT). Our team includes an outside IT Cybersecurity consultant that provides managed services on a regular basis.


text: Identification—monitor IT systems and detect deviations from normal operations and see if they represent actual security incidents. When an incident is discovered, collect additional evidence, establish its type and severity, and document everything.


text: Containment—perform short-term containment, for example by isolating the network segment that is under attack. Then focus on long-term containment, which involves temporary fixes to allow systems to be used in production, while rebuilding clean systems.


text: Eradication—remove malware from all affected systems, identify the root cause of the attack, and take action to prevent similar attacks in the future.


text: Recovery—bring affected production systems back online carefully, to prevent additional attacks. Test, verify and monitor affected systems to ensure they are back to normal activity.


text: Lessons learned—no later than two weeks from the end of the incident, perform a retrospective of the incident. Prepare complete documentation of the incident, investigate the incident further, understand what was done to contain it and whether anything in the incident response process could be improved.


text: The impact of potential cybersecurity threats is difficult to predict, but one or more of them could result in the loss of information or capabilities, harm to individuals or property, damage to our reputation, loss of business, regulatory actions, and potential liability, any of which could have a material adverse effect on our financial position, results of operations and/or cash flows. These threats could lead to losses of sensitive information or capabilities, harm to personnel, infrastructure, or products, and/or damage to our reputation as well as our vendor's ability to perform on our contracts.


text: Effective incident response involves every part of our organization, including IT teams, legal, technical support, human resources, corporate communications, and business operations. Our Board of Directors oversees all business, property, and affairs of the Company, including cybersecurity risks. Our management keep the members of the Board informed of our business through discussions at Board meetings and by providing them with reports and other materials throughout the year.


text: Our CSIRT includes our independent outside cybersecurity consultant as our strategic lead and the consultant and Chief Financial Officer (CFO) lead the Incident Response Team. Our consultant is certified in cybersecurity and our CFO has overseen our IT for over twenty years. Our team meets at least annually to review the Plan, discuss simulations and appropriate actions, and update the Plan where necessary.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. Our cybersecurity practices are integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks identified for oversight by our Board of Directors and the Board's Audit Committee through our annual ERM assessment. Our cybersecurity policies and practices follow the cybersecurity framework of the National Institute of Standards and Technology and other applicable industry standards. We generally approach cybersecurity threats through a cross-functional, multi-layered approach, with the specific goals of: (i) identifying, preventing and mitigating cybersecurity threats to the Company; (ii) maintaining the confidence of our customers, clients and business partners; (iii) preserving the confidentiality of internal and external information; and (iv) protecting the Company's intellectual property.

companyName: VEECO INSTRUMENTS INC

ticker: VECO


text: Vigilance: The Company maintains a global presence, with cybersecurity threat operations operating 24/7 around the world with a specific goal of detecting, containing and responding to cybersecurity threats and incidents.


text: Collaboration: The Company has established collaboration mechanisms with public and private entities, including intelligence and enforcement agencies, industry groups and third-party service providers to identify and assess cybersecurity risks.


text: Systems Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality, access controls and ongoing vulnerability assessments.


text: Third-Party Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, such as vendors, service providers and other users of the Company's systems.


text: Education: The Company provides periodic training for personnel regarding cybersecurity threats, with such training scaled to reflect the roles, responsibilities, and access of the relevant Company personnel.


text: Incident Response Planning: The Company has established and maintains incident response plans that address the Company's response to a cybersecurity incident, and such plans are tested on an ongoing basis.


text: Communication and Coordination: The Company utilizes a cross-functional approach to address the risk from cybersecurity threats and has formed an Information Security Leadership Group which includes management personnel from information technology, operations, legal, internal audit and other key business functions. The Information Security Leadership Group typically meets on a monthly basis, and more frequently as necessary.


text: Governance: Pursuant to the Company's ERM practices, oversight of cybersecurity risk management has been assigned to the full Board and to the Board's Audit Committee. Quarterly updates are provided by Company management, including the Company's Chief Information Security Officer, to the Audit Committee (three times per year) and the full Board (annually), to help ensure an ongoing dialogue regarding the Company's cybersecurity initiatives, threats and incidents.


text: A key part of the Company's strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of the Company's processes and practices through auditing, assessments, tabletop exercises and other exercises focused on evaluating effectiveness. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness and adjusts its cybersecurity processes and practices as necessary.


text: The Audit Committee oversees the management of risks from cybersecurity threats, including the policies, processes and practices that the Company's management implements to address risks from cybersecurity threats. Management's quarterly presentations include reports on a wide range of topics including, for example, recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and vendors. The Board also receives prompt and timely information regarding any cybersecurity incident that could pose a significant risk to the Company and receives ongoing updates regarding such incident until it has been addressed. At least once each year, and more frequently as required, the Board discusses the Company's approach to cybersecurity risk management with the Company's Chief Information Security Officer.


text: The Company's Chief Information Security Officer is the member of the Company's management that is principally responsible for overseeing the Company's cybersecurity risk management program, in partnership with other members of the Information Security Leadership Group. Our Chief Information Security Officer has served in various roles in information technology and information security for over twenty years. Our Chief Information Security Officer holds graduate degrees in cybersecurity and business administration and has attained multiple professional certifications including CISSP, CISA and CISM.


text: The Company's Chief Information Security Officer, in coordination with the Information Security Leadership Group, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the Company's incident response plan. Through ongoing communications with these teams, the Chief Information Security Officer and the Information Security Leadership Group monitor the prevention, detection, mitigation and remediation of cybersecurity incidents in real time, and report such incidents to the Board when appropriate, as addressed above.


text: While we and our third-party providers have in the past experienced cybersecurity incidents, we are not aware of any current incidents or new types of threats which have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition.


text: Risk Management and Strategy Hilltop recognizes the critical importance of protecting company data and the information systems that collect, process and maintain data, and we have developed an enterprise-wide program for assessing, identifying and managing material cybersecurity risks and threats. The systems we utilize include safeguards to protect against or mitigate possible threats, as well as controls designed to ensure accountability, availability, integrity and confidentiality of the data. Security measures are implemented to guard against unauthorized access, alteration, disclosure or destruction of data and systems, including accidental loss and destruction. Our program is supported by management and the board of directors.

companyName: Hilltop Holdings Inc.

ticker: HTH


text: Information Security Risk assesses technology risks and controls, evaluates application systems' conformance to internally defined and approved security standards, coordinates audits and examinations for Information Technology ("IT") and Information Security, as well as tracks open risk issues and exceptions. IT Security defines security policies and standards, conducts security awareness and training, evaluates security configuration and assesses vulnerability risk.


text: Security Operations utilizes security solutions to detect and respond to security threats and supports the end-user security needs. We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity and availability of our data.


text: Security Engineering plans, builds, and maintains technical controls and solutions that enhance our security posture that mitigate risk to the enterprise while assuring the integrity of the engineering design process.


text: Managing Material Cybersecurity Risks As a part of our overall risk management strategy, Information Security Risk conducts risk assessments on the technology environment as well as application systems implemented to support the various business functions of Hilltop based on the Gramm-Leach-Bliley Act guidance. Risks are identified from the Enterprise Risk Management and Internal Audit assessments of IT and Information Security. Information Security then quantifies the incidents and risks that have been identified and reports to the Operations & Strategy Committee, which is comprised of executives from across the enterprise representing disciplines including compliance, regulatory, information technology, risk, finance, and operations, if they meet certain thresholds. The necessary controls are identified to address the risk and this control evaluation contributes to the assessment of the residual risk value. In 2024, additional assessments were completed utilizing the FFIEC Cybersecurity Assessment Tool and the Ransomware Self-Assessment Tool for the enterprise.


text: Engage Third-Parties on Risk Management Recognizing the complexity and evolving nature of cybersecurity threats, Hilltop engages with a range of external experts, including cybersecurity assessors, consultants and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements. In particular, each year we engage a firm to perform penetration testing. We do not allow the same firm to be engaged for more than three years in an effort to obtain diversity in methods of testing. Additionally, at least every two years, we engage a firm to perform a red-team exercise for a simulated cybersecurity event.


text: Service Provider Oversight HTH Procurement processes contract requests, contract renewals and onboard of vendors. Such process creates a single point of entry for all sourcing and contract requests. Vendors who match certain inherent risk levels are then sent to Vendor Risk Management ("VRM") for further review and due diligence. Vendors who host Non-Public Personally Identifiable Information or vendors who we deem materially critical, regardless of risk, are managed by VRM. The VRM's due diligence process is risk-based and serves as a verification and analysis tool to assist in the evaluation of risk associated with new vendor relationships and ongoing reviews of inherently high-risk and vital vendors. VRM also is tasked with monitoring managed vendors business continuity and disaster recovery processes.


text: VRM considers specific factors in performing their due diligence based on the risk profile of the high-risk and vital vendor and services being performed. The specific factors include, but are not limited to, a review of the vendor's: Information security and related controls (third-party audit); Existence of disaster recovery and business continuity program and testing; Geographic location (country risk).


text: Material findings are reported to the Operations & Strategy Committee. A report of these vendors also is provided to the Risk Committee of the board of directors, which provides updates to the full board of directors.


text: Risks from Cybersecurity Threats We face a number of cybersecurity risks in connection with our business. We do not currently believe that any current cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, Hilltop, including its business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see Item 1A., "Risk Factors — Our operational systems and networks have been, and will continue to be, subject to an increasing risk of continually evolving cybersecurity or other technological risks, which could result in a loss of customer business, financial liability, regulatory penalties, damage to our reputation or the disclosure of confidential information."


text: The board of directors is acutely aware of the critical nature of managing risks associated with cybersecurity threats. To address the significance of these threats to our operations, customers and stockholders, we have established oversight mechanisms to ensure effective management, oversight and governance in managing risks associated with cybersecurity threats.


text: Board of Directors Oversight Our board of directors and the Risk Committee of the board of directors oversee an enterprise-wide approach to risk management, including cybersecurity risks, intended to support the achievement of organizational objectives, including strategic objectives, to improve long-term organizational performance and enhance stockholder value. The Risk Committee is central to the board of directors' oversight of cybersecurity risks and bears the primary responsibility for this function. The Risk Committee is composed of board members with diverse expertise including, risk management assisting them to oversee cybersecurity risks. The Risk Committee receives regular reports from our Chief Information Security Officer ("CISO") and provides updates to the full board of directors at each regular meeting of the board of directors. The Risk Committee also reviews all information security plans and policies, which are then recommended to the full board of directors for its review and approval.


text: Management's Role Managing Risk Our CISO plays a pivotal role in informing the Risk Committee on cybersecurity risks and developments. Our CISO provides comprehensive briefings to the Risk Committee on a regular basis, with a minimum frequency of four times per year. These briefings encompass a broad range of topics, including: Current cybersecurity landscape and emerging threats; Status of ongoing cybersecurity initiatives and strategies; Incident reports and learnings from any cybersecurity events;


text: Vulnerability management, including software patching, reviews of risk accepted vulnerabilities (remediated, renewed and top risks) and trends related thereto; and Compliance with regulatory requirements and industry standards. In addition to Risk Committee meetings, our CISO generally meets with executive management weekly to provide updates regarding current activities and areas of focus. In the event of a potential or actual cybersecurity event, the CISO immediately notifies the General Counsel at which point the information security incident response plan is activated if warranted. The information security incident response plan provides the procedures for responding, including personnel required to be informed and updated. The board of directors is informed promptly in the event such incident is, or is reasonably expected to have, a material impact on operations or financial condition. We also conduct cybersecurity tabletop exercises each year to ensure our processes and procedures align with our technical controls, and to ensure that the organization is prepared for a security-related event.


text: Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our CISO. With over twenty years of experience in the field of cybersecurity, our CISO brings a wealth of expertise to his role. His background includes extensive experience in all facets of information technology and information security and is well-recognized within the industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Our CISO is responsible for our Information Security Program and our information security leaders report directly to our CISO. We also maintain a standing committee, the Information Security Governance Committee, which consists of certain members of executive management, our CISO and information security leaders. Our Information Security Governance Committee allows for direct management reporting for IT Risk management, audit/examination report(s) review, and oversight of our Information Security strategy and program, and daily Security Operations.


text: Monitor Cybersecurity Incidents Our CISO is continually informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation and remediation of cybersecurity incidents. To assist our information security team in such knowledge acquisition, we subscribe to certain services that provide us alerts on security incidents and threats. Our CISO oversees the implementation of, and the processes for, the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. As previously noted, in the event of a cybersecurity incident, the information security incident response plan is enacted. This plan includes immediate actions to mitigate the impact of and remediate the incident.


text: Cybersecurity Risk Management and Assessment Advanced Energy understands the importance of managing risks from cybersecurity threats and maintains a comprehensive cybersecurity program developed with reference to the National Institute of Standards and Technology ("NIST") cybersecurity framework. Our cybersecurity program includes administrative, organizational, technical, and physical safeguards reasonably designed to protect the confidentiality, integrity, and availability of our data. We devote significant resources to network, operations, and product security, data encryption, business continuity/disaster recovery, vulnerability management, event monitoring and incident response, and other measures to protect our systems and data from unauthorized external access or internal misuse, including, but not limited to, the following:

companyName: ADVANCED ENERGY INDUSTRIES INC

ticker: AEIS


text: Operational Security. Access to our systems is restricted to those who require access in accordance with the principle of least privilege. We also conduct background checks for our employees where permitted by local law, require signed confidentiality agreements and acceptable use agreements, and follow termination/access removal processes.


text: Employee Training. We provide all employees with annual training on information security, data protection, and relevant Company policies so that they are empowered to identify cybersecurity risks and take action. To further enhance awareness and responsiveness to potential threats, we also conduct regular phishing simulations and email communications on cybersecurity trends awareness throughout the year. Third Party Assessment. We engage independent third party consultants to review the effectiveness and maturity of our cybersecurity program.


text: Incident Response Plan. We maintain an incident response plan to respond to and mitigate the effects of an information security incident. The plan provides for the formation of a multi-functional incident response team led by the Chief Information Officer ("CIO") and comprised of IT, legal, corporate communications, internal audit, operational personnel, and members of the Board of Directors.


text: Global Recovery. We have developed global cyber and disaster recovery processes for our information technology systems and critical information assets to preserve business continuity in the event of a cybersecurity incident.


text: Third Parties. We have an assessment and audit process for third party vendors. Prior to granting key vendor access to our systems or data, we conduct pre-engagement diligence to ensure that each of our third party vendors involved in processing sensitive data have reasonable cybersecurity processes and procedures in place. We also have contractual provisions with key vendors for prompt notification of material cybersecurity incidents. Insurance. We maintain cyber insurance coverage to mitigate the risk of losses from a cybersecurity incident.


text: Risk Monitoring. Management and our Board monitor cybersecurity and data protection developments, including new or forthcoming changes to the legislative and regulatory landscape as well as Advanced Energy's cybersecurity processes, investments, and actions as described below.


text: Cybersecurity risk is a component of Advanced Energy's broader risk management program and managed at the highest levels of the Company, starting with Advanced Energy's CIO, who meets with the Chief Executive Officer and other members of executive management regularly to discuss issues, assess risks, and coordinate Company-wide cybersecurity initiatives. Our CIO leads a dedicated cybersecurity technical team that manages, monitors, and enforces compliance with the cybersecurity program.


text: Although we have experienced non-material information security incidents from time to time in the past, in the last three years, we have not experienced any material cybersecurity incidents, nor has any incident had a material impact on our operations or financial condition. For a discussion of how risks from cybersecurity threats are reasonably likely to affect us, including our business strategy, results of operations, or financial condition, please see "If our information security measures are breached, disrupted, or fail, we may incur significant legal and financial exposure and liabilities" under the heading Part I, Item 1A "Risk Factors".


text: Cybersecurity Governance Pursuant to its charter, the Audit and Finance Committee of our Board of Directors is principally responsible for oversight of managements' actions to monitor and control cybersecurity risk exposure. The CIO routinely reports to the Audit and Finance Committee on enterprise cybersecurity matters, including, as appropriate, information security strategy, policies, and procedures, status of cybersecurity initiatives, results of third party assessments, emerging cybersecurity threats and risks, steps taken to mitigate such threats and risks, and cybersecurity developments and trends. The Audit and Finance Committee reports to the full Board and, if warranted, coordinates with the Board to address material risks. In addition, two members of the Board have been delegated authority to serve as initial points of contact for the Board in the event of a severe information security incident. The full Board receives a cybersecurity briefing from the CIO annually.


text: As discussed above, our cybersecurity risk management and strategy are led by our CIO, who has extensive leadership experience with enterprise information technology in the manufacturing and telecom industries, where he has held various executive roles in which he developed and executed IT strategy, including cybersecurity programs, helped achieve and maintain Sarbanes-Oxley compliance, and brought companies into compliance with ISO 27001, among other things.


text: Risk management and strategy We rely on our information technology to operate our business and provide our Barostim Therapy to patients. We have policies and processes designed to protect our information technology systems, some of which are managed by third parties, and resolve issues in a timely manner in the event of a cybersecurity threat or incident.

companyName: CVRx, Inc.

ticker: CVRX


text: As part of our broader risk management framework, we have identified the potential cybersecurity risks to our business. We have designed our business applications and hosting services to minimize the impact that cybersecurity incidents could have on our business and have identified back-up systems where appropriate. We seek to further mitigate cybersecurity risks through a combination of monitoring and detection activities, use of anti-malware applications, employee training, quality audits and communication and reporting structures, among other processes. We have an incident response plan in place that outlines containment, eradication, and recovery plans in the event of a cybersecurity threat or incident.


text: We engage a third-party consultant to assist us with designing controls and our cybersecurity risk management framework. We are also engaging with a third party to perform penetration testing. We also retain third parties to assist with the monitoring and detection of cybersecurity threats and responding to any cybersecurity threats or incidents.


text: With respect to third parties that manage or use our information technology or data, we obtain reports to assess the security of their systems and processes. We engage in ongoing monitoring of all third-party providers to ensure compliance with our cybersecurity standards. We have not encountered cybersecurity threats or incidents that have had a material impact on our business.


text: Our Board of Directors assigned specific oversight responsibility for cybersecurity to our Audit Committee, which also oversees our general risk management. The Audit Committee reviews and discusses with management our policies, practices, and risks related to information security and cybersecurity.


text: Our chief financial officer has primary responsibility for assessing, monitoring, and managing cybersecurity risks. Leaders of our information technology and device engineering, together with members of our finance team, comprise our Cybersecurity Committee, which meets to assess cybersecurity risks and identify new risks and assess our risk management framework on a quarterly basis. Among the members of this committee are employees who are knowledgeable about our products and systems, have prior experience managing cybersecurity risks, and maintain an active Certified Information Systems Security Professional certification.


text: Our chief financial officer provides an update to the Audit Committee on any risks related to cybersecurity on a quarterly basis. Our incident response plan includes notifying the Audit Committee, and then the Board of Directors, of any material threats or incidents that arise.


text: Risk Management and Strategy We recognize the critical importance in developing, implementing and maintaining robust cybersecurity measures and processes that are designed to safeguard our information systems and to assess, identify and manage material risks from cybersecurity threats.

companyName: TACTILE SYSTEMS TECHNOLOGY INC

ticker: TCMD


text: The fundamental controls of our cybersecurity program are based around the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). We engage qualified third-party consultants and advisors to conduct risk and vulnerability assessments to evaluate our systems and to advise us on cybersecurity risk management processes. We maintain a robust vulnerability-management program to evaluate our systems on a monthly basis, and we prioritize remediation efforts based on risk level and criticality of the system or data. We conduct comprehensive penetration testing with external consultants on our enterprise environment and our own products on at least an annual basis.


text: Cybersecurity risk management is an integral part of our technology modernization program. It is integrated into our business, as well as the broader software and digital environment. Our technology modernization program will move many of our core applications to industry-specific healthcare cloud solutions that offer robust HIPAA compliant, data security capabilities and tools. Our modernization plans revolve around simplifying our technology estate to reduce technical debt, automate security functions, and enable applications to take full advantage of best-practice, cloud security capabilities.


text: Our cybersecurity risk management process includes assessment of third-party service providers, suppliers and other business partners' ability to maintain compliance with our cybersecurity requirements, including review of Service Organization Control Type 2 ("SOC 2") reports and security controls. Our onboarding process for any third-party service provider includes execution of a business associate agreement that defines the service provider's responsibility to notify us in the event of any known or suspected cyber incident.


text: We maintain a thorough business continuity and resilience program designed to ensure our operations will withstand significant disruption and minimize impact on our patients and employees in the face of a significant challenge. Using standards developed by Disaster Recovery Institute International (DRII), we regularly conduct a business impact analysis to determine risk level, assess impact severity and prioritize business processes based on company needs.


text: As part of our monitoring process, we perform tabletop exercises at least annually to test our current plans. These cross-functional exercises involve employees from multiple departments and are designed to gain perspective, collect feedback and validate plan effectiveness. The information obtained from the business impact analysis, exercises and testing is utilized to update contingency plans for each department.


text: While we have experienced cybersecurity incidents and expect to continue to be subject to such incidents, to date, we have not experienced any cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. However, we are subject to ongoing risks from cybersecurity threats that could materially affect us, including our business strategy, results of operations, or financial condition, as further described in Part I, Item 1A, "Risk Factors" of this Annual Report on Form 10-K.


text: The Audit Committee of the Board of Directors oversees our cybersecurity and risk management programs, and receives updates from our Information Security and Compliance teams regarding the effectiveness of these programs on a quarterly basis. These reports include descriptions of security incidents and observed trends in threat activity, new programs and tooling designed to address developing areas of risk, and performance reporting of third-party testing, including security awareness training and cybersecurity assessments. The full Board of Directors has general oversight of the Company's risk management programs, which include cybersecurity risks, and the Audit Committee provides regular reports to the full Board of Directors related to cybersecurity matters and related risk oversight.


text: The Company's Director of Information Security reports to our Chief Information Officer. Our Director of Information Security is responsible for our cybersecurity program, develops and publishes security policies and procedures, and reports to the Audit Committee on the effectiveness of our security program. Our Director of Information Security has 25 years of technology leadership experience, including 19 years directly overseeing cybersecurity programs in the healthcare device manufacturing industry, and holds the Certified Information Systems Security Professional (CISSP) certification. Our Director of Information Security is responsible for the Company's Information Security Awareness Program, which includes security training for new hires and ongoing education for all staff, including annual refresher training and periodic bulletins regarding security risks. Security awareness email testing is performed on a monthly basis, with employee performance reported to management for inclusion in performance evaluations. Our Director of Information Security also performs risk assessments of third-party partners, including reviews of SOC 2 reports.


text: Cybersecurity Risk Management and Strategy As an externally managed company, our day-to-day operations are managed by our Manager and our executive officers (all of whom are executive officers of our Manager) under the oversight of our board of trustees. We rely on our Manager for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details our Manager has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Star Holdings

ticker: STHO


text: Our Manager has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. Our Manager's cybersecurity risk management program includes a cybersecurity incident response plan.


text: Our Manager has designed and assesses its program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF 2.0). This does not imply that our Manager meets any particular technical standards, specifications, or requirements, only that our Manager uses the NIST CSF 2.0 as a guide to help it identify, assess, and manage cybersecurity risks relevant to our business.


text: Our Manager's cybersecurity risk management program is integrated into its overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our Manager's cybersecurity risk management program includes: risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; the use of external service providers to assess, test or otherwise assist with aspects of our security controls; cybersecurity awareness training of our employees, incident response personnel, and senior management;


text: a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and a third-party risk management process for service providers, suppliers, and vendors.


text: Our Manager has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee is responsible for reviewing our Manager's implementation of our cybersecurity risk management program and evaluating its adequacy.


text: The Committee receives periodic reports from our Manager on our cybersecurity risks. In addition, our Manager updates the Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser impact potential.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from our Manager on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Manager's Head of IT, internal technology staff or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our Manager's team, including its Head of Risk Management and General Counsel, are responsible for assessing and managing our material risks from cybersecurity threats. Our Manager has primary responsibility for our overall cybersecurity risk management program and supervises both its internal cybersecurity personnel and its retained external cybersecurity consultants.


text: Our Manager supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Strategy and Risk Management To mitigate cybersecurity risks we have adopted a process of continuous improvement and adaptation to the ever-changing threat landscape. As part of this process, we engage with industry-leading managed security service providers to supplement our efforts in preventing, identifying and responding to cybersecurity threats. Our information technology operations, information security processes and CIRP are generally aligned with the National Institute of Standards and Technology's framework.

companyName: JBG SMITH Properties

ticker: JBGS


text: We have adopted a cloud-first strategy which is a foundational element to our overall cybersecurity posture. For essential systems, we utilize SaaS-based software partners who annually conduct Statement on Standards for Attestation Engagements SOC 1 or SOC 2 assessments, as appropriate, based on functional use within our company. Based on the nature of services provided by our technology partners, our third-party risk management process may include: Reviewing cybersecurity practices of such provider; Contractually obligating the provider to share detailed results of cybersecurity assessments on an annual basis;


text: Contractually obligating the provider to make us aware of significant cybersecurity related incidents; and Coordinating independent security assessments with the provider utilizing our own resources.


text: Cybersecurity Risk Management We have adopted a cybersecurity risk management process that is designed to identify and mitigate potential cybersecurity risks. On an annual basis, we work with credible, third-party cybersecurity experts to assess our ability to prevent, identify, and respond to cybersecurity threats through internal and external penetration tests and monthly vulnerability scans. We also test our organizational cybersecurity capabilities through facilitated tabletop exercises which simulate real life scenarios. Together with the findings of the SOC 1 and 2 assessments, and our threat intelligence and monitoring activities, these exercises, tests and scans help us identify potential cybersecurity risks. When practical and necessary, we patch vulnerabilities that are identified.


text: We deploy endpoint detection and monitoring technologies to identify potential cybersecurity incidents, which have capabilities to automatically isolate and terminate vulnerabilities. We utilize industry leading tools and controls for user management, authentication, and privileged access management.


text: We back up our systems and data to mitigate the impact of a cybersecurity event that would impact our ability to operate or result in the loss of data. We partner with strategic managed cybersecurity service providers to supplement the capabilities of our internal team. We periodically test, evaluate and refine our CIRP in response to identified risks.


text: To manage the third-party cybersecurity risk introduced by our cloud-first strategy, we have implemented a due diligence process for new software partners as well as an annual review process for essential SaaS system partners.


text: We conduct cybersecurity awareness training annually and simulated phishing campaigns no less than quarterly to test and educate our employees.


text: Notwithstanding the steps we take to address cybersecurity, we may not be successful in preventing or mitigating all cybersecurity incidents or threats.


text: Our Chief Information & Technology Officer along with our Vice President of Cybersecurity & Cloud Infrastructure provide principal oversight and guidance of our cybersecurity risk management strategy, programs and processes. The Chief Information & Technology Officer has over 20 years of experience in information technology in the real estate sector, leading organizations through strategic technology and process improvement initiatives. The Vice President of Cybersecurity & Cloud Infrastructure has over 15 years of extensive experience in cybersecurity and information technology. They are supported in their efforts by a team of technical experts who have had formal training and possess relevant industry related experience in addition to managed cybersecurity service providers who specialize in preventing, identifying, and responding to cybersecurity threats.


text: The Audit Committee of our Board of Trustees provides board-level governance and oversight regarding cybersecurity matters. Management meets with the Audit Committee periodically to discuss cybersecurity strategy, risk, trends, and internal personnel and qualifications. As part of our annual enterprise risk assessment, technology and cyber risks are standing risk factors which are ranked and reviewed by management.


text: In the event of a cyberattack, we engage our CIRP, which provides a framework of processes and procedures related to identifying, categorizing, responding, containing, analyzing, and eradicating cybersecurity threats to mitigate downtime and promptly restore systems and services. Management has responsibility for reporting cybersecurity incidents to the Audit Committee as they occur, if consistent with our CIRP. The CIRP also addresses management's responsibility, with Audit Committee oversight, with respect to any reporting or disclosure determinations related to a given cybersecurity incident and provides for Audit Committee and Board of Trustee briefings as appropriate.


text: Risks, Threats and Material Incidents As of December 31, 2024, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, we and our third-party providers have been the target of cybersecurity threats and expect them to continue. Notwithstanding the extensive approach we take to address cybersecurity, there can be no assurance that our cybersecurity efforts and measures will be effective or that attempted cybersecurity incidents or disruptions would not be successful or damaging. See Item 1A "Risk Factors" - Risks Related to Our Business and Operations - The occurrence of cyber incidents, or a deficiency in our cybersecurity, or the cybersecurity of our service providers, could negatively impact our business by causing a disruption to our operations, a compromise or corruption of our confidential information, regulatory enforcement and other legal proceedings, and/or damage to our business relationships, all of which could negatively impact our financial results.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical IT Systems and information.

companyName: WATTS WATER TECHNOLOGIES INC

ticker: WTS


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"). This does not imply that we meet any particular technical standards, specifications, or requirements. We use the NIST CSF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following: risk assessments designed to help identify material cybersecurity risks to our critical IT Systems, information, products, services, and our broader enterprise IT environment;


text: a security team principally responsible for managing our (1) cybersecurity risk assessment processes, (2) security controls, and (3) response to cybersecurity incidents;


text: the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security controls;


text: risk review of certain third-party service providers, including software vendors, third-party cloud services, and third-party hosting services, with ongoing risk monitoring for critical vendors through an external cybersecurity intelligence service;


text: cybersecurity awareness training of our employees, incident response personnel, and senior management; and a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents.


text: There can be no assurance that our cybersecurity risk management program and processes, including our policies, controls or procedures, will be fully implemented, complied with or effective in protecting our systems and information.


text: We have not experienced any material cybersecurity incidents. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a full discussion of cybersecurity risks, please see our Risk Factors in Item 1A.


text: Management Oversight of Cybersecurity Our Chief Information Officer ("CIO") and the Vice President ("VP") of Information Security have primary responsibility for our overall cybersecurity risk management program and supervise both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our former CIO left the Company in January 2025. Currently Shashank Patel, our Chief Financial Officer, is serving as Interim CIO as we proceed with an executive search to appoint a permanent CIO. Mr. Patel has been overseeing the Company's Information Technology function since he joined the Company in July 2018. References to the CIO and the CIO's duties refer to our CIO's historical role, Mr. Patel's interim CIO role, and our future CIO's role.


text: Mr. Patel has over 10 years of experience overseeing an Information Technology function. Our VP of Information Security has over 25 years of experience in leading cybersecurity functions across strategy, architecture, engineering, and operations.


text: The CIO and VP of Information Security supervise efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include, but are not limited to, risk assessments, including with the support of external advisors, briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our Cybersecurity Council, comprised of cross-functional senior leaders from operations, finance, internal audit, product management, and information technology teams, also reviews and assesses security risks and issues from a business and technology perspective across all organizations within Watts on a quarterly basis, with the guidance and input of the CIO and VP of Information Security. Our executive management team is responsible for assessing our material, or reasonably likely to be material, risks from cybersecurity threats with the advice and input of the CIO and VP of Information Security, including based on the above and from external advisors as necessary.


text: Board Oversight of Cybersecurity Our Board considers cybersecurity risks as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks.


text: The Audit Committee oversees management's implementation of our cybersecurity risk management program and receives updates on the cybersecurity risk management program from the CIO and the VP of Information Security at least twice yearly. In addition, management updates the Audit Committee regarding any material or significant cybersecurity incidents, as well as incidents with lesser impact potential as necessary.


text: The Audit Committee reports to the full Board annually regarding cybersecurity. The full Board also receives annual briefings from the CIO and the VP of Information Security on cybersecurity, or from external experts on cybersecurity as part of the Board's continuing education on topics that impact public companies.


text: Strategy, Governance and Risk Management Our Technology Risk Program is designed to proactively identify, monitor, and mitigate technology-related risks across our digital operations and assess cybersecurity risks related to third-party vendors and suppliers. Our Cybersecurity Program and our Technology Risk Program are led by our Chief Information Security Officer ("CISO") a Certified Information Systems Security Professional with two decades of cybersecurity leadership. The CISO and his team are responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. The Technology Risk Oversight Committee chaired by our CISO, with members representing leadership throughout our Company, provides oversight and guidance to technology risks, including cybersecurity. Our Company's Cybersecurity Program is designed to align with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and leading industry practices, and our Cybersecurity Program is integrated into our Company's Enterprise Risk Management framework. Internal and external experts regularly evaluate our Cybersecurity Program, and the results of those reviews are reported to senior management and our Company's Board of Directors. Our Incident Response Committee, which is comprised of leaders in the areas of information security, digital, legal, finance, privacy, compliance and ethics, corporate security and communications, is responsible for leading our Company's response to cyber incidents. Our Cybersecurity Incident Response Plan outlines the processes by which management is informed about and monitors detection and mediation of cyber incidents. We actively engage with key vendors, industry participants, and intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our information security policies and procedures. We have a Data Protection Office that works closely with, and assists, our enterprise Privacy Program, overseen by the Chief Privacy Officer, along with advisory support from appointed Data Protection Officers in Europe and Quebec.

companyName: WASTE MANAGEMENT INC

ticker: WM


text: While we have experienced cybersecurity threats and breaches targeting our information technology systems and networks and those of our third-party providers, including within the last three years, these incidents have not had a material impact on our Company, including our business strategy, results of operations or financial condition. Risks from cybersecurity threats, including previous cybersecurity incidents encountered by the Company and known incidents encountered by third parties with a connection to the Company, are also not currently viewed as reasonably likely to materially impact our Company, including our business strategy, results of operations or financial condition. We are regularly the target of attempted cyber intrusions, have experienced cyber intrusions, and we anticipate continuing to be subject to such attempts as cyber intrusions become increasingly sophisticated and more difficult to predict and protect against. Geopolitical conflicts and developments and technological advancements also increase the risk and likelihood of cyber incidents. As such, we must commit substantial resources to continuously monitor and further develop our networks and infrastructure to prevent, detect, and address the risk of unauthorized access, misuse, computer viruses and other events. Although we have implemented and maintain commercially reasonable security measures and safeguards, including to protect against and identify potential threats, these protections and other systems designed to mitigate cybersecurity risks may not fully defend against an attack or future cybersecurity incident, which can be unpredictable in nature. Although we believe that the probability of occurrence of a significant cybersecurity incident is less than likely, if such an incident were to occur, the impact on the Company could be substantial. See Item 1A. Risk Factors — Significant cybersecurity incidents negatively impact our business and our relationships with customers, vendors and employees and expose us to increased liability for additional discussion.