text: MGIC's Information Risk Management (IRM) team is responsible for safeguarding the organization's information assets, data, and technology infrastructure from security threats and vulnerabilities. The IRM team's primary focus is the protection of the confidentiality, integrity, and availability of sensitive information and compliance with relevant laws, regulations, and industry standards. The IRM team is overseen by the Company's Chief Information Security Officer (CISO).


text: Our ISP is benchmarked against the National Institute of Standards and Technology (NIST) Cybersecurity Framework. Additionally, various aspects of the ISP are subject to periodic audit by the Company's Internal Audit department or third-party professionals engaged by the Internal Audit department. Such audits vary from year-to-year but are generally focused on compliance with stated control activities, standards, and internal policies, as well as maintaining the integrity and independence of the audit process. Cybersecurity risk reviews such as SOC2, SOX controls, penetration tests, and regulatory controls are conducted by independent third parties.

companyName: MGIC INVESTMENT CORP

ticker: MTG

secItem: Item 1C


text: The ISP also incorporates a vendor due diligence process that is designed to assess vendor control environments and evaluate risks associated with vendor access to the Company's confidential data and systems. The process includes assessing and managing the cyber risks associated with engaging third-party vendors and reviewing their information security practices.


text: In the event of a suspected or threatened cybersecurity incident, the CISO determines whether to activate the Company's Cyber Incident Response Team ("CIRT"), composed of different subject matter experts from applicable domains such as network, infrastructure, and application areas in order to evaluate the technical issues relative to the incident. The CIRT is overseen by the CISO. If necessary, the CIRT may engage third-party cybersecurity experts to evaluate and/or remediate the incident. If and when the CIRT is activated, the CISO will inform the Company's Chief Information Officer (CIO). In the event that the CIRT confirms that the incident relates to a cybersecurity incident or compromise of MGIC's computer systems, the CISO will notify the General Counsel, who will advise the Chief Executive Officer ("CEO"), who is a member of the Board of Directors. In addition to advising the CEO, the General Counsel will also convene an established committee whose members include the General Counsel, Chief Financial and Risk Officer, Senior Vice President of Investor Relations, and Chief Accounting Officer in order to determine if the event is a material cybersecurity incident so as to trigger an Item 1.05 filing on Form 8-K. If a determination is made that the event is material, or if the CEO or General Counsel otherwise determines it advisable, the CEO or General Counsel, or a delegate thereof, shall notify the Chairman of the Board, Lead Independent Director, and Chairpersons of the Board's Business Technology and Transformation Committee (the "BTTC") and Audit Committee.


text: To our knowledge, during the reporting period there were no cybersecurity incidents that materially affected or are reasonably likely to materially affect our business strategies, results of operations, or financial condition. For additional information about risks related to cybersecurity, see our risk factors titled "Information technology system failures or interruptions may materially impact our operations and/or adversely affect our financial results" and "We could be materially adversely affected by a cybersecurity breach or failure of information security controls."


text: The CISO reports to the CIO and partners with the Company's Risk, Audit, Legal and Compliance Departments to promote alignment of cybersecurity risk management strategy with the broader risk management strategy for the organization. The integration of information security into the overall enterprise risk management framework enables collaboration on the identification, assessment, mitigation and monitoring of cybersecurity risks that have the potential to materially impact the operation of the Company.


text: The Risk Management Committee of the Board coordinates with the Board and other Board committees regarding the assignment to the Board and Committees of oversight responsibilities for all identified key risks to the Company. Risks related to cybersecurity are overseen by the BTTC. The BTTC monitors cybersecurity risks associated with both internal and external actors, including third-party vendors and service providers. Additional information about the BTTC's role in overseeing risks related to cybersecurity and information technology generally can be found in the Committee's Charter at mtg.mgic.com/corporate-governance/highlights.


text: The CISO provides quarterly updates about the Company's cybersecurity program to the BTTC. Updates may include topics such as management's efforts to identify and monitor risks, investments to improve the Company's detection and response systems, the results of risk assessments, compliance with controls, vendor oversight, strategic technology planning, and if necessary, the status of any new, ongoing, or prior cybersecurity incident. The CISO also periodically attends the BTTC meetings; the CIO regularly attends the meetings.


text: MGIC Investment Corporation and Subsidiaries The Company's current CISO, Jennifer Westphal, is responsible for assessing and managing the material risks posed by cybersecurity threats. Ms. Westphal has over 25 years of experience in information technology, with 18 of those years focused on cybersecurity. Ms. Westphal has been with the Company for more than ten years and was promoted to the position of CISO in January 2021. Prior to 2021, Ms. Westphal served as the Deputy CISO and before that, as the Director of Information Risk Management.


text: The Company's current CIO, Robert Candelmo, has over 38 years of experience in information technology, with 20 of those years in senior leadership positions. Prior to becoming CIO in 2019, he served as the Company's Chief Technology Officer for approximately five years. Before joining the Company, Mr. Candelmo served as Senior Vice President of Enterprise Information Services for a large banking company. Mr. Candelmo has a Bachelor of Science in Computer Science.


text: Cybersecurity Risk Management and Strategy We face various cybersecurity risks, including those related to unauthorized access to and misuse of data, system interruptions, ransomware, malicious software and other threats. Our cybersecurity program incorporates information technology, retail technology and customer products designed to mitigate cyber risks. Our security measures are customized to meet our unique business requirements and encompass firewalls, intrusion detection and prevention systems, encryption and multi-factor authentication. We also engage external experts to enhance and assess our cybersecurity measures in the form of maturity assessments, incident response, penetration testing and other advisory services. We adhere to the practices and standards outlined by the National Institute of Standards and Technology Cyber Security Framework.

companyName: EZCORP INC

ticker: EZPW


text: We employ continual monitoring of our systems and data, managed by an external detection and response firm. In the event of a cyber incident, we maintain an incident response plan coordinated across multiple departments. This strategy is designed for rapid and effective incident management to minimize operational disruption. Our response protocol includes steps for detection, containment, eradication, recovery and post-incident review, including impact on safety, data loss, operational disruption, cost and potential reputational damage.


text: Recognizing our employees as a vital defense mechanism, we provide cybersecurity, privacy and information-handling training. Additionally, we conduct regular phishing exercises to enhance employee vigilance. Our educational programs aim to raise awareness about cyber risks and teach employees to safeguard the Company, our customers and themselves against cyber threats. These programs inform our workforce about the latest cybersecurity dangers and safe online practices, including secure access, phishing awareness, remote work security and reporting suspicious activities.


text: Cybersecurity Governance and Oversight Our cybersecurity governance framework is structured to promote accountability and ongoing enhancement of cybersecurity measures. Management of the cybersecurity program involves cross-functional resources, our Cyber and Technology Risk Committee, an internal multi-departmental committee formed to address cyber and data privacy matters. The cybersecurity program is led by our Chief Information Security Officer ("CISO") who reports to the Chief Legal Officer. The Internal Audit Department monitors and reviews our cybersecurity initiatives.


text: The Board of Directors is responsible for overseeing and monitoring the material risks facing the Company. The Audit and Risk Committee of the Board is charged with overseeing our risk management framework, including cybersecurity risks. The CISO reports directly to the Audit and Risk Committee on cybersecurity risks on a quarterly basis.


text: To date, we have not identified any cybersecurity threats or incidents that have had or are likely to have a material impact on our business, financial condition or results of operations. Nonetheless, the escalation of cybersecurity threats poses a risk to our systems, networks and products and services, which, despite our efforts to mitigate these risks, may not protect against all incidents. For a detailed discussion on how cybersecurity risks could materially impact our business, see "Part I, Item 1A — Risk Factors."


text: Cybersecurity Governance and Oversight Our cybersecurity governance framework is structured to promote accountability and ongoing enhancement of cybersecurity measures. Management of the cybersecurity program involves cross-functional resources, our Cyber and Technology Risk Committee, an internal multi-departmental committee formed to address cyber and data privacy matters. The cybersecurity program is led by our Chief Information Security Officer ("CISO") who has 20 years of relevant work experience and, together with other members of our information technology, security, and compliance teams, maintains expertise in overseeing cybersecurity programs and in leading internal teams and third-party consultants and providers. This expertise includes designing and implementing cybersecurity strategies, identifying risks, and managing incident response, with requisite knowledge of security standards. The CISO reports to our Chief Legal Officer, and our Internal Audit Department monitors and reviews our cybersecurity initiatives.


text: The Board of Directors is responsible for overseeing and monitoring the material risks facing the Company. The Audit and Risk Committee of the Board is charged with overseeing our risk management framework, including cybersecurity risks. The CISO provides reports on cybersecurity matters and risks directly to the Audit and Risk Committee on a quarterly basis.


text: Cybersecurity Risk Management and Strategy Our approach to risk management is designed to identify, assess, prioritize and manage major risk exposures, including material risks from cybersecurity threats, that could affect our ability to execute our corporate strategy and fulfill our business objectives. We have implemented, and incorporated into our operations, cybersecurity risk management processes and technologies to protect the integrity, availability and confidentiality of our critical systems and information.

companyName: Stagwell Inc

ticker: STGW


text: Key aspects of our cybersecurity risk management program include: • Risk assessments designed to identify risks to our systems and information; • An internal security team principally responsible for managing our cybersecurity risk assessment processes, response to cybersecurity incidents, and information technology security controls; • Engaging third-party service providers to assist with network, endpoint and cloud system monitoring; • Monitoring emerging data protection laws and implementing responsive changes to our processes; • Annual cybersecurity awareness training for employees and enhanced cybersecurity management and incident response training for employees involved in systems or processes that handle sensitive data; • Regular audits and tests of our information systems (including review and assessment by independent third-party advisors, who help identify areas for continued focus and improvement); • Regular phishing email simulations for employees and contractors with access to our email systems; • A third-party risk management process for service providers, suppliers and vendors, including those with access to our customer data, employee data, or our systems; and • A cybersecurity incident response plan that includes detailed procedures for responding to cybersecurity incidents, including processes to triage, assess severity, escalate, contain, investigate and remediate cybersecurity incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. In addition, we maintain insurance to protect against potential losses arising from cybersecurity incidents.


text: Cybersecurity Governance and Oversight Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to its Audit Committee oversight of our cybersecurity risk management program. The Audit Committee receives quarterly reports from management on cybersecurity risks, risk assessment and risk management, and discusses those matters with management. In addition, management updates the Audit Committee on cybersecurity incidents. The Audit Committee also receives and discusses quarterly reports from management on the effectiveness of our information technology security controls.


text: Our information security team, including our Chief Technology Officer and our Senior Vice President Information Security, is responsible for day-to-day identification, assessment and management of the cybersecurity risks we face. The information security team also has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. The leaders of our information security team have over 40 years of combined experience in managing information security, developing cybersecurity strategy and implementing cybersecurity programs. The Chief Technology Officer is informed of and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents through management of the cybersecurity risk management program described above, including our cybersecurity incident response plan. Our incident response plan is also designed, depending on the circumstances, to escalate cybersecurity incidents to other members of management, report cybersecurity incidents to the Audit Committee, and support public disclosure and reporting of material incidents.


text: Risks from Cybersecurity Threats Cybersecurity threats and attacks are becoming more sophisticated and pose a risk to our systems and information. While, to date, we have not been subject to cybersecurity incidents that, individually or in the aggregate, have been material to our operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For more information regarding the cybersecurity-related risks we face, see "Risk Factors - Risks Related to Data Privacy and Cybersecurity."


text: Cybersecurity Risk Management and Strategy Our approach to risk management is designed to identify, assess, prioritize and manage major risk exposures, including material risks from cybersecurity threats, which could affect our ability to execute our corporate strategy and fulfill our business objectives. We have implemented and incorporated into our operations, cybersecurity risk management processes and technologies to protect the integrity, availability and confidentiality of our critical systems and information.


text: Zebra takes a comprehensive approach to managing cybersecurity risk, starting with the integration of cybersecurity risk into our overall enterprise risk management framework, among other significant risks to the Company.

companyName: ZEBRA TECHNOLOGIES CORP

ticker: ZBRA


text: Our Board of Directors is responsible for oversight of risks to the Company, and is assisted by the Audit Committee in the oversight of cybersecurity risks. Management updates the Board on at least an annual basis on key cybersecurity activities. In connection with this oversight, the Audit Committee monitors the quality and effectiveness of the Company's cybersecurity program covering security of its internal information technology systems and its products and solutions as well as our cyber incident response plan and resources. The Audit Committee regularly receives updates from management about prevention, detection, mitigation and remediation of cyber threats, including the overall status of the Company's cyber security program, results of third-party assessments, and recent cyber threats. In addition, the Audit Committee reviews the Company's cyber security investment methodology to determine whether cyber maturity improvements and risk reductions are being made.


text: Management's Role Management is responsible for day-to-day cyber risk management activities, including proactively identifying, assessing, prioritizing, managing and mitigating enterprise cybersecurity risks. Our Chief Financial Officer ("CFO") is the accountable leader in executive management for Zebra's IT and cybersecurity programs.


text: The Chief Security Officer ("CSO") is the senior-most security professional responsible for the implementation of the Company's cybersecurity, product security, and corporate/physical security programs, and reports to the CFO. The CSO also recommends to the Company's executive management regarding the Company's cyber risk mitigation priorities. The Company's current CSO has served in that role for Zebra since 2018. He is a recognized leader in the field of cyber security with over 14 years of global executive cybersecurity experience.


text: The Chief Information Officer ("CIO") is a peer to the CSO, also reporting to the CFO. The CIO and his team are responsible for executing cybersecurity risk mitigation plans. Zebra's current CIO was appointed to the role in March 2022 and has nearly 20 years of experience in managing IT functions.


text: The Chief Information Security Officer ("CISO") reports to the CSO and oversees the Company's Security Operations Center ("SOC"). The CISO establishes and oversees the execution of prioritized cybersecurity mitigation plans for the Company. Zebra's current CISO was appointed to the role in June 2018 and has held multiple leadership roles overseeing IT functions during his 14 years with the Company, including driving efforts within the cybersecurity function.


text: Cybersecurity Risk Management The underlying controls of our cyber risk management program are based on recognized best practices and standards for cyber security and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. Our approach to cybersecurity risk management includes the following key elements: • Defense and On-going Monitoring – Our SOC is responsible for the on-going monitoring and analysis of cyber threats to the Company. The SOC evaluates cyber security incidents according to the Company's cyber incident response plan, appropriate cyber incident playbook, and crisis communications cyber incident plan. The Company also utilizes endpoint detection and response services as well as data forensic investigation services for additional detection capability and timely assistance with potential cyber security incidents. • Technical Safeguards – The Company utilizes various tactics for cyber threat prevention. We periodically perform vulnerability assessments, remediate vulnerabilities, review log and access, perform system maintenance, manage network perimeter protection, and implement and manage disaster recovery testing. Further, Zebra relies on its information security management system supported by a comprehensive set of policies that directly align with ISO 27001 and are supported by System and Organization Controls 2 (SOC2) reports and external ISO 27001:2013 certification for certain parts of our business. • Education and Awareness – To foster employee awareness of cyber threats, we provide periodic educational sessions to our employees, including annual training on general cybersecurity concepts and educational opportunities that include real-life simulation and "tabletop exercises." We also regularly conduct privacy and security summits that involve training and information sessions conducted by employees and by third parties. • Third-Party Risk Management ("TPRM") – Our TPRM function focuses on mitigating cyber risk from specific third-party vendor categories. This function performs initial TPRM assessments as part of the vendor selection process and regularly reassess vendors based on vendor type and risk factors.


text: While we have experienced and expect to continue to experience cybersecurity threats and incidents, there have been no material incidents incurred to-date at the Company. However, there can be no guarantee that our policies and procedures will be followed in every instance or that those policies and procedures will be effective. Cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in the risk factors in Part I, Item 1A of this report.


text: Our Board of Directors is responsible for oversight of risks to the Company and is assisted by the Audit Committee in the oversight of cybersecurity risks. Management provides regular updates to the Board regarding the Company's key cybersecurity activities. In connection with its oversight, the Audit Committee monitors the quality and effectiveness of the Company's cybersecurity program, including security of its internal information technology systems and its products, services, and software solutions as well as our cybersecurity incident response plan and resources. Management provides quarterly updates to the Audit Committee about cybersecurity threat protection, detection, mitigation and remediation, including the overall status of the Company's cybersecurity program, results of third-party assessments, and recent cybersecurity threats. In addition, the Audit Committee reviews the Company's cybersecurity investment methodology to determine whether cybersecurity maturity improvements and risk reductions are being made.


text: Management's Role Management is responsible for day-to-day cybersecurity risk management activities, including proactively identifying, assessing, prioritizing, managing and mitigating enterprise cybersecurity risks. Our Chief Financial Officer ("CFO") is the accountable leader in executive management for Zebra's IT and cybersecurity programs.


text: The Chief Security Officer ("CSO") is the senior-most security professional responsible for the implementation of the Company's cybersecurity, product security, and corporate/physical security programs, and reports to the CFO. The CSO also makes recommendations to the Company's executive management regarding the Company's cybersecurity risk mitigation priorities. The Company's current CSO has served in that role for Zebra since 2018. He is a recognized leader in the field of cybersecurity with over 15 years of global executive cybersecurity experience.


text: The Chief Information Officer ("CIO") is a peer to the CSO, also reports to the CFO. The CIO and his team are responsible for executing cybersecurity risk mitigation plans. Zebra's current CIO was appointed to the role in 2022 and has nearly 20 years of experience in managing IT functions.


text: The Chief Information Security Officer ("CISO") reports to the CSO and oversees the Company's Security Operations Center ("SOC"). The CISO establishes and oversees the execution of prioritized cybersecurity mitigation plans for the Company. Zebra's current CISO was appointed to the role in 2018 and has held multiple leadership roles overseeing IT functions since joining the Company in 2004, including driving efforts within the cybersecurity function.


text: Cybersecurity Risk Management The underlying controls of our cybersecurity risk management program are based on recognized industry practices and standards for cybersecurity and information technology, including the National Institute of Standards and Technology Cybersecurity Framework. Our approach to cybersecurity risk management includes the following key elements: • Defense and On-going Monitoring – Our SOC is responsible for the on-going monitoring and analysis of cybersecurity threats to the Company. The SOC evaluates cybersecurity incidents according to the Company's cyber incident response plan, appropriate cybersecurity incident playbook, and crisis communications cybersecurity incident plan. The Company also utilizes endpoint detection and response services as well as data forensic investigation services for additional capability and timely assistance with potential cybersecurity incidents. • Technical Safeguards – The Company utilizes various tactics for cybersecurity threat protection. We periodically perform vulnerability assessments, remediate vulnerabilities, review logs and access, perform system maintenance, manage network perimeter protection, and implement and manage disaster recovery testing. Further, Zebra relies on its information security management system supported by a comprehensive set of policies that directly align with ISO 27001 and are supported by System and Organization Controls 2 (SOC2) reports and external ISO 27001:2013 certification for certain parts of our business. • Education and Awareness – To foster employee awareness of cybersecurity threats, we provide periodic educational sessions to our employees, including annual training on general cybersecurity concepts and targeted educational opportunities that include real-life simulation and "tabletop exercises." We also regularly conduct privacy and security summits that involve training and information sessions conducted by employees and by third parties. • Third-Party Risk Management ("TPRM") – Our TPRM function focuses on mitigating cybersecurity risk from specific third-party vendor categories. This function performs initial TPRM assessments as part of the vendor selection process and regularly reassesses vendors based on vendor type and risk factors.


text: While we have experienced and expect to continue to experience cybersecurity threats and incidents, there have been no material incidents incurred to-date at the Company. However, there can be no guarantee that our policies and procedures will be followed in every instance or that those policies and procedures will always be effective. Cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in the risk factors in Part I, Item 1A of this report.


text: Risk Management and Strategy The Board recognizes the importance of maintaining the trust and confidence of our tenants/borrowers/operators and employees to safeguard sensitive information and the integrity of our information systems. We have systems in place to assess, identify and manage cybersecurity incidents and we invest in technology and third-party support to identify, mitigate, and quickly respond to cybersecurity incidents. We have maintained a strong focus in consistently reviewing our cybersecurity practices. We also conduct periodic information security and awareness training to ensure that employees are aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we also take steps designed to provide appropriate guidance regarding security to our executive management and employees, including any employee who may come into possession of confidential financial information.

companyName: NATIONAL HEALTH INVESTORS INC

ticker: NHI


text: We have engaged the services of various third-party service providers to, among other things, review and evaluate our processes and procedures designed to control access to our information systems, perform penetration testing on our cybersecurity systems on a biannual basis, and provide regular information technology reviews based upon the NSIT Cybersecurity Framework. In addition, we contracted with a third-party managed detection and response security company in the fourth quarter of 2023 to commence testing for cyber vulnerabilities on a continual basis.


text: In order to identify and mitigate cybersecurity threats related to our use of material third-party vendors, we conduct periodic reviews of internal controls of certain third-party service providers to assess their procedures to mitigate material security risks.


text: Board & Management Responsibilities We have formed an Information Technology Steering Committee comprised of employees from multiple departments within the Company including the Chief Executive Officer ("CEO"); the Chief Financial Officer; the Chief Accounting Officer; the Vice President, Controller; the Vice President, Investor Relations & Finance; and the Vice President of Human Resources and Compliance & Information Security Officer ("ISO") to more effectively prevent, detect and respond to information security threats. The ISO has served in various roles in corporate compliance for over 20 years and reports directly to the Company's CEO. To enhance our cybersecurity capabilities, we actively collaborate with third-party vendors. Notably, we engage a Managed Service Provider ("MSP") and another service provider who specializes in cybersecurity issues. Our MSP plays a critical role in supporting our IT infrastructure, offering expertise and resources that complement our in-house capabilities. The third party cybersecurity specialist provides advanced cybersecurity solutions, including continuous monitoring and threat detection services, which are integral to our cybersecurity program.


text: The ISO is responsible for overseeing a company-wide information security strategy, including policy, standards, architecture, and processes, and managing many of the security services that run on personal computers and servers. The Audit Committee meets with the ISO at least annually to review and discuss the Company's cyber risks and threats, incident responses, technology, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program and the emerging threat landscape.


text: The Company periodically conducts cybersecurity "tabletop" exercises administered by an independent third party with respect to breach and other problematic information security scenarios. The administrator poses questions to participants and advises on typical responses to similar situations. Participants include various executives and other officers of the Company as well as the ISO, other information systems and security personnel, and relevant third-party vendors.


text: To date, no attempted cyber-attack or other attempted intrusion on our information technology networks has resulted in a material adverse impact on our consolidated operations or financial results, or in any penalties or settlements. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues. However, there can be no assurance that our cyber risk insurance coverage will be sufficient in the event of a cyber-attack.


text: Risk Management and Strategy The Board of Directors recognizes the importance of maintaining the trust and confidence of our tenants/borrowers/operators and employees to safeguard sensitive information and the integrity of our information systems. We have systems in place to assess, identify and manage cybersecurity incidents and we invest in technology and third-party support to identify, mitigate, and quickly respond to cybersecurity incidents. We have maintained a strong focus on consistently reviewing our cybersecurity practices. We also conduct periodic information security and awareness training to ensure that employees are aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we also take steps designed to provide appropriate guidance regarding security to our executive management and employees, including any employee who may come into possession of confidential financial information.


text: We have engaged the services of various third-party service providers to, among other things, review and evaluate our processes and procedures designed to control access to our information systems, perform penetration testing on our cybersecurity systems on a biannual basis, and provide regular information technology reviews based upon the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. In addition, we contracted with a third-party managed detection and response security company ("MDR") in the fourth quarter of 2023 to commence testing for cyber vulnerabilities on a continual basis.


text: Board & Management Responsibilities We have formed an Information Technology Steering Committee comprised of employees from multiple departments within the Company including the Chief Executive Officer ("CEO"); the Chief Financial Officer; the Chief Accounting Officer; the Vice President, Controller; the Vice President, Investor Relations & Finance; and the Vice President of Human Resources and Compliance & Information Security Officer ("ISO") to more effectively prevent, detect and respond to information security threats. The ISO has served in various roles in corporate compliance for over 20 years and reports directly to the Company's CEO. To enhance our cybersecurity capabilities, we actively collaborate with third-party vendors. Notably, we engage a Managed Service Provider ("MSP") and an MDR provider who specializes in cybersecurity issues. Our MSP plays a critical role in supporting our IT infrastructure, offering expertise and resources that complement our in-house capabilities. The MDR provides advanced cybersecurity solutions, including continuous monitoring and threat detection services, which are integral to our cybersecurity program.


text: In the event of an incident that jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize a regularly updated information security incident response plan ("IRP"). The IRP is overseen by the Information Technology Steering Committee and sets forth the processes for containment, review, escalation, recovery from and remediation of any cybersecurity incidents identified by the Company. Pursuant to our IRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. The IRP also specifies the approach to reporting findings and keeping senior management and other key stakeholders (including the Audit Committee and the Board of Directors for certain incidents) informed and involved as appropriate and specifies the use of third-party experts for legal advice, consulting and cyber incident response.


text: The Company periodically conducts cybersecurity "tabletop" exercises administered by an independent third-party in which members of a cross-functional team and relevant third-party vendors engage in simulated cybersecurity incident scenarios. These exercises are intended to provide hand-on training for the participants and assists the Company with assessing its processes and capabilities in addressing cybersecurity threats.


text: As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including as a result of any previous cybersecurity incidents or threats, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. We also maintain cyber liability insurance to help mitigate potential liabilities resulting from cyber issues. However, there can be no assurance that our cyber risk insurance coverage will be sufficient to cover incurred losses in the event of a cyber-attack.


text: Incyte is committed to maintaining robust oversight and governance of potential cybersecurity risks and to implementing processes and controls that help us identify, assess and manage such risks. To date, we have not experienced a cybersecurity threat or incident that has resulted in a material adverse impact to our business or operations. However, we cannot guarantee that we will not experience such a threat or incident in the future, given the increasing sophistication of those responsible for cybersecurity incidents. While we seek to detect and investigate unauthorized attempts and attacks against our network and to prevent their occurrence where practicable through our internal processes and tools, we remain potentially vulnerable to known or unknown threats. In some instances, we can be unaware of a threat or incident or its magnitude and effects. Further, there is increasing regulation regarding responses to cybersecurity incidents, including reporting to regulators, which could subject us to additional liability and reputational harm. See "Item 1A. Risk Factors" for more information on our cybersecurity risks.

companyName: INCYTE CORP

ticker: INCY


text: We aim to incorporate and align with industry best practices throughout our cybersecurity program. Our cybersecurity strategy focuses on implementing effective and efficient controls, technologies and other processes to assess, identify, manage and mitigate material cybersecurity risks. These include, among other things, having mechanisms in place to detect and monitor unusual network activity, utilizing vulnerability assessment scans and tools, and conducting external and internal penetration tests and security assessments using the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We engage third party experts to assist with numerous aspects of our cybersecurity program, including vulnerability assessment scans, penetration tests and security assessments. These outside experts are utilized on a rotating basis to enable us to receive multiple viewpoints on the security of our technological resources. Additionally, from time to time, our internal audit function, reviews and assesses various aspects of our cybersecurity program. We also engage in threat intelligence monitoring, including monitoring the dark web and zero-day vulnerability and attack information, and have processes in place to assess the potential cybersecurity impact or risk of any identified threats on our company, including potential impacts on our business partners and other parties with whom we share information. We actively engage with industry groups for peer benchmarking purposes and to stay current on best practices. We rely heavily on our vendors and other third party service providers in our clinical development activities as well as to manufacture and deliver our products, and a cybersecurity incident at a vendor or other third party service provider could have a material and adverse impact on our business, results of operations and financial condition. We have further processes in place to assess the cybersecurity risks associated with our vendors and other third-party service providers, and we require such providers to take appropriate precautions to protect our data and to notify us promptly in the event of any known or suspected data breach or cyber incident.


text: Our cybersecurity program is integrated into our broader approach to risk management, and ultimate oversight for the program sits with our Board of Directors. The Board of Directors is aided by its Audit and Finance Committee, which regularly reviews our cybersecurity program with management and reports to the Board of Directors. Cybersecurity reviews by the Audit and Finance Committee or the Board of Directors generally occur at least twice annually, or more frequently as determined to be necessary or advisable.


text: Incyte's Chief Information Security Officer (CISO) runs our cybersecurity program. Our CISO, who holds numerous cybersecurity and related certifications, including Certified Information Systems Security Professional, reports in to our Chief Information Officer (CIO). Our CISO and CIO have extensive experience assessing and managing cybersecurity programs and cybersecurity risk. They regularly report directly to the Audit and Finance Committee or the Board of Directors on our cybersecurity program and our efforts to prevent, detect, mitigate and remediate cybersecurity incidents. In addition, we have an escalation process in place to inform senior management and the Board of Directors of any material issues as they arise.


text: The Company maintains a cybersecurity program, with direct oversight from senior management and the Audit Committee (the "Audit Committee") of the Board of Directors (the "Board"), to manage information, data, and technology security. The cybersecurity program is informed in part by the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) and is designed to help identify, assess, and manage cybersecurity risks relevant to the Company's business. The Company's cybersecurity program has been developed in light of the nature of the Company's business, resource availability, requirements from stakeholders, and industry trends. The Company has formed an internal cross-functional Technology Risk Management Committee comprised of representative leaders from various aspects of the Company's business to broadly implement its cybersecurity program.

companyName: ARROWHEAD PHARMACEUTICALS, INC.

ticker: ARWR


text: The Company's cybersecurity program prioritizes vulnerability management, risk reduction, detection, and prevention to help protect against material risks from cybersecurity threats to its information systems. The Company periodically conducts internal and third-party cybersecurity risk assessments and penetration tests and incorporates relevant findings and recommendations into its overall cybersecurity strategy, as appropriate. Through these assessments, the Company develops targeted strategies intended to address the most significant cybersecurity risks.


text: The Company's cybersecurity program emphasizes defense, rapid detection, and remediation of cybersecurity threats and incidents, including the use of various security tools and systems based on defense-in-depth and zero-trust principles that are intended to meet control requirements. The cybersecurity program also encompasses crisis incident response guidelines that detail the processes for the detection, response, mitigation, and remediation of cybersecurity incidents, in order to support the effective management of, response to, communication during, and recovery from any such incidents.


text: A key element of the Company's strategy is fostering training and awareness through annual cybersecurity training and role-based phishing tests for employees and certain third parties having access to the Company's information systems. The Company also utilizes a third-party cybersecurity operations monitoring center to help identify threats and incidents to the Company's servers and computers. The Company's cybersecurity program includes specific requirements and guidelines for the information security team relating to the Company's computer emergency response preparedness, intrusion response preparedness, and incident response preparedness.


text: When a potential cybersecurity threat or incident is identified, our processes require that the Senior Director of Information Security be promptly notified of the incident, who then is to conduct an initial investigation to determine the probability and potential of the threat or incident to have a material impact on key business systems and processes. If there is a reasonable possibility for a material impact to the Company's business or information systems, the cybersecurity program requires that the Technology Risk Management Committee be promptly notified, which then assigns a risk level to the threat or incident. All threats and incidents identified as high-risk are promptly escalated to Company leadership and the legal department, who, in collaboration with the Company's Information Security department, are tasked with activating and implementing a high-risk information security incident mitigation and response plan, which details the roles, responsibilities, and strategies to respond. Our cybersecurity program also requires that high-risk cybersecurity incidents or threats be reported to the Company's Materiality Committee and the Audit Committee within 24 hours of their designation as high-risk by the Technology Risk Management Committee.


text: Cybersecurity risks are incorporated into our overall risk management program. If a cybersecurity risk is identified as high-risk, a response and mitigation plan is developed, and progress updates on the plan are routinely reported to the Technology Risk Management Committee and tracked by the Audit Committee as part of our overall risk management process.


text: The Company is not aware of any cybersecurity threats or incidents in the last fiscal year, including as a result of any prior cybersecurity incidents, that have had a material impact on the Company, including its business strategy, operations, or financial condition. However, we face certain ongoing cybersecurity risks and threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors," under the heading "Our business and operations could suffer in the event of a cybersecurity incident or other information technology system failures."


text: Execution of the Company's cybersecurity program is delegated by the Board to the Senior Director of Information Security, who has over 25 years of relevant experience in information security, including 14 years at the Company, and is further supported by a team of security professionals within the Information Systems & Informatics department. The Senior Director of Information Security reports to the Vice President, Treasury & Head of Information Systems, and they meet periodically with senior leadership and the Audit Committee to review metrics on cybersecurity preparedness, incidents, mitigations and remediation efforts.


text: The Company has also established a management-level Technology Risk Management Committee, which includes leaders from finance, legal, operations, quality & compliance, and information systems & informatics, who are responsible for overseeing the execution of high-risk incident response and mitigation plans. This committee actively reviews technology strategies, physical and cybersecurity threat assessment, and emerging issues and related initiatives. It is also responsible for evaluating the materiality of information for SEC filings and, as required or as otherwise appropriate, coordinates with the Company's Materiality Committee to support timely disclosure of relevant information.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are fully integrated into the Company's ERM program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: WABASH NATIONAL Corp

ticker: WNC


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas:


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly interacts with the Company's General Counsel, ERM committee, the Sr. Director, IT, and executive leadership. The ERM committee is a cross-functional team of high-level leaders that meet at least quarterly to anticipate, identify, prioritize, and manage material risks to the Company's strategic objectives. It conducts an extensive bi-annual survey and interview process to identify the material risks, and it continues to monitor for any emerging material risks between surveys. The ERM Committee reports on its findings and activities twice annually to the Audit Committee of the Board.


text: Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures, including an incident response team, that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. Senior leadership also briefs the Board on information security matters with quarterly updates.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, like artificial intelligence platforms with an array of technologies, extensive encryption, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company's cybersecurity controls are incorporated into our internal control environment, managed and tested in accordance with the Sarbanes-Oxley Act.


text: Incident Response Planning: The Company has established, maintains and regularly tests incident response plans that address the Company's response to a cybersecurity incident. The Company also has a cybersecurity risk insurance policy.


text: Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: Education and Awareness: The Company employs a variety of security-focused training/awareness practices to equip the Company's personnel with effective tools to address cybersecurity threats. Information Technology ("IT") and cybersecurity-based training is performed during employee on-boarding to communicate the Company's evolving information security policies, standards, processes and practices. Phishing simulations are performed on a monthly basis and Company-wide notifications and/or cyber awareness messages are sent on an as-needed basis. The Audit Committee also surveys data and factors that impact costs and incident response efforts.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks from the Sr. Director, IT. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. On an annual basis, the Board and the Audit Committee discuss the Company's approach to cybersecurity risk management with members of management.


text: The Sr. Director, IT, in coordination with management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. Risks are evaluated with cross functional input using external guidance, risk matrices, governmental guidelines, and other cybersecurity best practices. This evaluation is shared with executive leadership via the ERM committee and through regular updates provided by the Sr. Director, IT.


text: To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary processes and controls are in place to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with the ERM committee and the cybersecurity team, management monitors the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and reports such threats and incidents to the Audit Committee when appropriate.


text: The Sr. Director, IT holds a chief information security officer certification from Heinze College at Carnegie Mellon and has over 15 years of cybersecurity experience. The Company has not experienced a material information security breach in the last three years. The Company has not experienced a material third-party information security breach.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. For a discussion of whether and how any risks from cybersecurity threats are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition, refer to Part I, Item 1A, "Risk Factors" - "We rely significantly on information technology to support our operations and if we are unable to protect against service interruptions or security breaches, it could have a material adverse effect on our business, financial condition, cash flows and results of operations," which is incorporated by reference into this Item 1C.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes, and practices are aligned with the National Institute of Standards and Technology Cybersecurity Framework and are fully integrated into the Company's ERM program. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: Governance: The Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly interacts with the Company's General Counsel, ERM committee, the Sr. Director, IT and executive leadership. The ERM committee is a cross-functional team of high-level leaders that meet at least quarterly to anticipate, identify, prioritize and manage material risks to the Company's strategic objectives. It conducts an extensive bi-annual survey and interview process to identify the material risks and continues to monitor for any emerging material risks between surveys. The ERM committee reports on its findings and activities twice annually to the Audit Committee of the Board. The Company conducts a self-assessment on an annual basis to evaluate performance against the National Institute of Standards and Technology Cybersecurity Framework's categories and subcategories to help the Company adapt and improve its management of cybersecurity risks.


text: Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, like artificial intelligence platforms with an array of technologies, extensive encryption, firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company's cybersecurity controls are incorporated into our internal control environment, managed and tested in accordance with the Sarbanes-Oxley Act. When a weakness in the Company's technical safeguards is identified, the Company works to mitigate and prevent exploitation of the Company's information.


text: Incident Response Planning: The Company has developed a comprehensive incident response plan. This plan outlines specific protocols for identifying, containing and eradicating cybersecurity incidents and threats to minimize their impact on our operations and stakeholders. A dedicated internal incident response team is responsible for executing this plan. The plan is regularly tested and updated to address evolving threats and industry best practices. Additionally, the Company works with relevant authorities and third-party specialists, as needed, to enhance cybersecurity threat response capabilities. The Company also has a cybersecurity risk insurance policy.


text: Third-Party Risk Management: The Company leverages third parties that support various operational and technical functions, some of which require limited access to internal systems and data. The Company has implemented a comprehensive third-party risk management program that includes vendor assessments, contractual requirements and ongoing third-party monitoring to mitigate these risks and ensure compliance with security policies and industry standards. All third-party access is protected and managed by the same security controls, processes and policies used by the Company for internal accounts.


text: Education and Awareness: The Company employs a variety of security-focused training/awareness practices to equip the Company's personnel with effective tools to address cybersecurity threats. Information Technology ("IT") and cybersecurity-based training is performed during employee on-boarding to communicate the Company's evolving information security policies, standards, processes and practices. Additional personnel training occurs on an ongoing basis. The Company also regularly conducts tabletop exercises for security scenarios, including both leadership-focused exercises and IT-driven exercises. Phishing simulations are performed on a monthly basis and Company-wide notifications and/or cyber awareness messages are sent on an as-needed basis. The Audit Committee also surveys data and factors that impact costs and incident response efforts.


text: The Board, in coordination with the Audit Committee, oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board and the Audit Committee each receive regular presentations and reports on cybersecurity risks from the Sr. Director, IT. The Board and the Audit Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. The Board and the Audit Committee regularly discuss topics that include regulatory compliance, incident response and data privacy and on at least an annual basis, discuss the Company's approach to cybersecurity risk management with members of management.


text: Mid Penn places an emphasis on managing risks effectively to achieve its business goals and maintain the confidence of its shareholders. Cybersecurity is one of the company's most critical risks and is an integral part of our Risk Management program. We are open about our willingness to take risks and regularly review and update our risk management policies to keep up with the ever-changing financial landscape. Our risk committees, made up of experienced professionals, carefully evaluate the risks associated with our business activities, ensuring that our risk-taking aligns with our overall corporate goals.

companyName: MID PENN BANCORP INC

ticker: MPB


text: Mid Penn engages a team of external assessors, auditors, and consultants to support our cybersecurity and risk management efforts. We seek information and guidance from reputable third-party organizations such as CISA, RMA, and FS-ISAC to aid in making responsible decisions and mitigating risks. We utilize threat detection and prevention technologies to analyze network traffic and identify atypical behavior that may indicate a potential cyber threat. This proactive approach is intended to enable us to detect threats before they can cause harm to our systems or compromise sensitive information. Additionally, we conduct regular penetration testing and vulnerability assessments to identify and remedy potential deficiencies in our systems.


text: Mid Penn protects and monitors its technology environment with industry leading security tools including next-generation firewalls with intrusion prevention services, intrusion detection and response tools, email security gateway, log and event monitoring software, and an industry-leading antivirus solution. Each system is administered and monitored by members of our Information Technology and Information Security staff. Real-time alerts received from these systems are responded to by staff and worked until the threat is determined to be mitigated. Impactful computer security events would be subject to the guidance provided in our Incident Response Program, that is tested annually so we are ready to respond if needed.


text: Mid Penn relies on several reputable service providers who provide systems or support to our technology environment. Service providers are selected carefully and monitored closely through our Vendor Management program. With routine, ongoing service provider reviews that exist throughout the relationship with the service provider, and with alerting for notable events for our service providers in place, we can quickly identify potential threats and mitigate threats with our service providers as needed.


text: We have created a robust Information Security Awareness Program to deliver our employees pertinent and timely educational content. Mindful that human error can be a significant factor in cybersecurity incidents, our employees undergo regular training to stay informed about the latest threats and best practices. This reduces the risk of inadvertent security breaches and cultivates a culture of security throughout the organization. Additionally, we regularly conduct social engineering tests on our employees to keep them sharp and alert for threats through email, text messages, and voice calls. Mid Penn did not experience a material incident to our computer systems or networks in 2023.


text: Mid Penn's Information Technology and Security management team is responsible for implementing and executing the company's cybersecurity strategy on a day-to-day basis. This team of cybersecurity experts specializes in managing risks for financial services providers. The Chief Information Security Officer has 20 years of experience and is accompanied by an Information Security Officer with ten years of experience in the field. With over twenty years of experience providing secure networks for the banking industry, the Information Technology Operations Manager is highly skilled in network security and risk mitigation. Information Technology and Security management hold a monthly meeting to assess the organization's cybersecurity position and distributes information to the Board of Directors.


text: The Board of Directors oversees the risk management process, while executive leadership implements risk mitigation and cybersecurity strategies. The company's cybersecurity strategy is actively overseen and guided by the Board of Directors through a quarterly subcommittee meeting with the full Board engaged annually. Executive management provides cybersecurity and risk management updates to the Board through the Risk Committee and the Technology Steering Committee. Information Technology knowledge is considered a core competency by eight of fifteen Board members. They guide the full Board in setting cybersecurity objectives, approving policies, and allocating resources.


text: We acknowledge that risk is a natural part of the financial industry. The threat landscape is ever-changing, and with increasingly sophisticated techniques, threat actors pose a greater risk to Mid Penn and its customers, leaving us vulnerable to cyberattacks and information security incidents. However, our commitment is to maintain a careful balance between innovation and risk mitigation. To achieve this, we have developed a risk appetite that aligns with our strategic goals and regulatory requirements. This framework encourages innovation while ensuring our risks are well-understood, measured, and managed. MID PENN BANCORP, INC.


text: We have created a robust Information Security Awareness Program to deliver our employees pertinent and timely educational content. Mindful that human error can be a significant factor in cybersecurity incidents, our employees undergo regular training to stay informed about the latest threats and best practices. This reduces the risk of inadvertent security breaches and cultivates a culture of security throughout the organization. Additionally, we regularly conduct social engineering tests on our employees to keep them sharp and alert for threats through email, text messages, and voice calls. Mid Penn did not experience a material incident to our computer systems or networks in 2024.


text: Mid Penn's Information Technology and Security management team is responsible for implementing and executing the company's cybersecurity strategy on a day-to-day basis. This team of cybersecurity experts specializes in managing risks for financial services providers. The Chief Information Security Officer has 20 years of experience and is accompanied by an Information Security Officer with eleven years of experience in the field. With more than 15 years of experience in information technology and network security, the Information Technology Operations Manager is highly skilled in network security and risk mitigation. Information Technology and Security management hold a monthly meeting to assess the organization's cybersecurity position and distributes information to the Board of Directors.


text: The Board of Directors oversees the risk management process, while executive leadership implements risk mitigation and cybersecurity strategies. The company's cybersecurity strategy is actively overseen and guided by the Board of Directors through a quarterly subcommittee meeting with the full Board engaged annually. Executive management provides cybersecurity and risk management updates to the Board through the Risk Committee and the Technology Steering Committee. Information Technology knowledge is considered a core competency by eight of eleven Board members. They guide the full Board in setting cybersecurity objectives, approving policies, and allocating resources.


text: Cybersecurity Program Overview FLIAC prioritizes the security of its electronic information systems and the data residing therein. In order to respond to the risks posed by a variety of cybersecurity threats, including security breaches, cyber-attacks, and other cybersecurity incidents, FLIAC has implemented a Cybersecurity Program (the "Program") managed by our Chief Information Security Officer ("CISO") and the CISO's Information Security Team. The Program is designed to protect and preserve the confidentiality, integrity, and continued availability of the electronic information systems that we own or use, and all electronic information owned by or in the care of the Company. The Program is based on industry leading frameworks including the National Institute of Standards and Technology ("NIST") Cyber Security Framework ("CSF") and NIST 800-53. The NIST CSF provides standards, guidelines, and best practices on managing cybersecurity risk and for the organization, improvement, and assessment of the Program.

companyName: FORTITUDE LIFE INSURANCE & ANNUITY CO


text: The Program governs all FLIAC internal systems, as well as third parties providing service to the Company, and is based on the following five pillars: • Identify - The first pillar of the Program is to identify the organization's critical assets, vulnerabilities, and potential threats. This involves conducting a thorough quantitative and qualitative risk assessment and asset inventory based on the organization's information systems, data repositories, and network infrastructure. Additionally, it involves categorizing and classifying the importance of different assets, assessing their potential impact on the organization if compromised, and identifying applicable regulatory compliance requirements. • Protect - After identifying the assets and vulnerabilities, FLIAC applies comprehensive asset protection methods allowing for accurate risk mitigation techniques. This includes deploying a range of security controls such as firewalls, intrusion detection systems, antivirus software, encryption mechanisms, and access controls. The goal is to establish multiple layers of defense to prevent unauthorized access, data breaches, cyber-attacks, and other cybersecurity incidents. Employee awareness training and secure coding practices also fall under this component to ensure a culture of security throughout the Company. • Detect – The Program focuses on the timely detection of any suspicious activities or security breaches. This involves implementing security monitoring systems, intrusion detection systems, and log analysis tools to continuously monitor network traffic, system logs, and user behavior. Real-time alerts and security incident management processes help in identifying potential security incidents promptly. • Respond – If a security incident is detected, a response plan is triggered to minimize the impact and contain the threat. This component involves establishing an incident response team and defining incident response procedures. The team is trained to respond promptly, investigate the incident, mitigate the damage or harm, and restore normal operations. Communication plans, legal considerations, regulatory requirements, and coordination with external entities, like regulators, law enforcement, vendors and other key stakeholders, are also part of the response process. • Recover - The final pillar of the Program focuses on recovering from a security incident and restoring normal operations. This includes activities such as system restoration, data recovery, and analyzing the incident to identify lessons learned and improve future incident response capabilities. It also involves assessing residual risks, updating security controls, and continuously monitoring and testing the Company's security posture to ensure readiness for potential future incidents.


text: Cybersecurity risk management under the Program is an integrated part of the Company's overall management of operational risk, as described further below under "Cybersecurity Risk Management Governance." The Company did not experience any material cybersecurity incidents during the period covered by this report. Nor did the Company identify any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. However, the Company recognizes that cybersecurity risks are constantly evolving, and the Company continuously monitors and adapts to these risks to protect its systems and data. It is possible that the Company will experience a material cybersecurity incident in the future. For more information on operational and cybersecurity risks, see "Item 1A. Risk Factors – Operational Risk" earlier in this report.


text: Vendor Risk Management The Program seeks to ensure that each vendor (or third-party service provider) with whom the Company does business meets the Company's standards for protecting and preserving the confidentiality, integrity, and continued availability of electronic information systems and data. The Company requires vendors to meet threshold requirements for cybersecurity controls, such as access controls, logging and monitoring, and encryption. The Company's contracts with vendors require the implementation and maintenance of such controls, and obligate vendors to promptly report all cybersecurity incidents to the Company. Based on the overall risk level associated with a particular vendor, the Company's contract with a service provider may require enhanced or heightened controls. The CISO's Information Security Team performs risk-based initial and periodic due diligence of vendors, during which the Information Security Team evaluates, assesses, and otherwise reviews vendor cybersecurity controls. The results of such reviews are reported to the CISO. Any cybersecurity incidents involving vendors will be escalated and acted upon in accordance with the Program.


text: Cybersecurity Risk Management Governance The CISO is responsible for managing the Program. The CISO reports to the Company's Chief Information Officer and regularly engages with the Chief Risk Officer on matters related to the Program. Cybersecurity risks are evaluated by Company management alongside and consistent with other operational risks, with the CISO and the Information Security Team providing subject matter expertise on the identification, assessment, and tracking of cybersecurity risks under the Program. In addition, the Company regularly engages external consultants in connection with evaluating and enhancing the Program and the Company's overall management of cybersecurity threats. For example, the Company engages external consultants to assist the Company in identifying evolving technologies and threats, developing action plans, performing penetration tests, conducting exercises, and conducting periodic reviews.


text: The Board of Directors (the "Board") is responsible for oversight of the Company's management of operational risks, including cybersecurity threats. The Board receives a comprehensive report at least annually from the Chief Information Officer and the CISO. The comprehensive annual report covers matters related to the Program, such as enhancements, incident reporting, performance metrics, status reports, oversight of third-party service providers, and the results of Program reviews, including exercises and response readiness assessments led by external consultants. The report also includes information about significant and emerging cybersecurity threats that may affect the Company. In addition to a comprehensive annual cybersecurity report, the Board receives periodic interim reports from the Chief Information Officer and the CISO. To the extent cybersecurity controls are related to internal controls over financial reporting, such controls are also considered in the context of Management's annual assessment of the effectiveness of internal controls over financial reporting.


text: The CISO, supported by the Information Security Team, is responsible for implementing and managing the Program. The CISO has served in various roles in information technology and information security for over 25 years and has broad and extensive experience in multiple industries including financial services, healthcare, and higher education. The CISO holds a graduate degree in IT management and has attained the professional certifications of Certified Information Systems Security Professional (CISSP), Certified Information Security Manager (CISM), Boardroom Certified Qualified Technology Expert (QTE), and is a Distinguished Fellow with the Information Systems Security Association (ISSA).


text: The Program governs all FLIAC internal systems, as well as third parties providing service to the Company, and is based on the following five pillars: • Identify - The first pillar of the Program is to identify the organization's critical assets, vulnerabilities, and potential threats. This involves conducting a thorough quantitative and qualitative risk assessment and asset inventory based on the organization's information systems, data repositories, and network infrastructure. Additionally, it involves categorizing and classifying the importance of different assets, assessing their potential impact on the organization if compromised, and identifying applicable regulatory compliance requirements. This pillar of the Program also involves regular engagement with the broader security community and monitoring of new and emerging cyber threat information. • Protect - After identifying the assets and vulnerabilities, FLIAC applies comprehensive asset protection methods allowing for accurate risk mitigation techniques. This includes deploying a range of security controls such as firewalls, intrusion detection systems, antivirus software, encryption mechanisms, and access controls. The goal is to establish multiple layers of defense to prevent unauthorized access, data breaches, cyber-attacks, and other cybersecurity incidents. Employee awareness training (including phishing simulation exercises to train employees to recognize and report phishing attacks) and secure coding practices also fall under this component to ensure a culture of security throughout the Company. • Detect – The Program focuses on the timely detection of any suspicious activities or security breaches. This involves implementing security monitoring systems, intrusion detection systems, and log analysis tools to continuously monitor network traffic, system logs, and user behavior. Real-time alerts and security incident management processes help in identifying potential security incidents promptly. • Respond – If a security incident is detected, a response plan is triggered to minimize the impact and contain the threat. This component involves establishing an incident response team and defining incident response procedures. The team is trained to respond promptly, investigate the incident, mitigate the damage or harm, and restore normal operations. Communication plans, escalation protocols, legal considerations, regulatory requirements, (including appropriate and timely reporting and disclosure of cybersecurity incidents to regulators and affected individuals), and coordination with external entities, like regulators, law enforcement, vendors and other key stakeholders, are also part of the response process. • Recover - The final pillar of the Program focuses on recovering from a security incident and restoring normal operations. This includes activities such as system restoration, data recovery, and analyzing the incident to identify lessons learned and improve future incident response capabilities. It also involves assessing residual risks, updating security controls, and continuously monitoring and testing the Company's security posture to ensure readiness for potential future incidents.


text: Risk Assessment and Management Our approach to managing material risks from cybersecurity threats, which is informed in part by the National Institute of Standards and Technology ("NIST") Cybersecurity Framework (though we do not imply that we meet any particular technical standards, specifications or requirements), is designed to detect, identify, respond to, recover from and protect from cybersecurity incidents.

companyName: GILEAD SCIENCES, INC.

ticker: GILD


text: Our security governance function, which includes key employees who work in Information Security, Legal, and Privacy teams such as our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our enterprise incident response plan ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.


text: Additionally, we assess our cybersecurity maturity annually using the NIST framework and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed. We also execute employee cybersecurity training and awareness programs around various key cybersecurity topics including reporting incidents, phishing, ransomware, remote working, cloud security, privileged access, and removable media.


text: Our process for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall risk management process. We have a robust enterprise risk management ("ERM") program that plays an important role in seeking to manage and address existing and emerging risks, including cybersecurity risks, which are critical to our overall business goals and objectives. The ERM team updates our CEO and his leadership team on cybersecurity risks as well as their potential impact, likelihood, potential mitigation plan, and status.


text: Incident Response We have a dedicated Information Security team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including teams within information technology ("IT"), Legal and Privacy, in identifying, analyzing, and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements.


text: We have an IRP to prepare for and respond to cybersecurity incidents. The process is tested in annual tabletop exercises to help identify strengths and areas for improvement.


text: Engagement of Third Party Advisors We engage third party advisors, including assessors, cybersecurity consultants, and auditors to assess, validate, and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools, and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks, and review cybersecurity strategy, trends, and threat landscape.


text: Third-Party Service Provider Risk Management We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company uses an external risk management software program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity, and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which help inform the appropriate level of additional due diligence and ongoing compliance monitoring. The third-party risk assessment is a cross-functional effort involving our end-user, Legal, Privacy, and Information Security teams.


text: Material Risks from Cybersecurity Threats The company has not identified any risks from cybersecurity threats that have materially affected us. We do not believe that risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, over the long term. Like many companies, we have experienced cybersecurity incidents, including data breaches and temporary service interruptions. However, as of the end of 2023, known cybersecurity incidents, individually or in aggregate, have not had a material impact. Nevertheless, there can be no assurance that our efforts in response to cybersecurity incidents, as well as our investments to protect our IT infrastructure and data, will shield us from significant losses, brand and reputational harm and potential liability or prevent any future interruption or breach of our systems. Such cybersecurity incidents can cause the loss of critical or sensitive information, including personal information, and could give rise to legal liability and regulatory action under data protection and privacy laws. For additional information on cybersecurity risks we face, see Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K under the heading "Information system service interruptions or breaches, including significant cybersecurity incidents, could give rise to legal liability and regulatory action under data protection and privacy laws and adversely affect our business and operations."


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Our Board of Directors plays an important role in overseeing cybersecurity risks. Our Board of Directors has established an oversight structure for monitoring the effectiveness of and risks related to the cybersecurity program. Designated by the Board to oversee cybersecurity and information technology risks, the Audit Committee receives quarterly cybersecurity updates from our CISO, and the chair of the Audit Committee meets with the CISO individually on a quarterly basis. These updates often address topics such as ongoing efforts to improve our cybersecurity posture, operational metrics, incident metrics, and mitigation actions, and may include key metrics such as those related to cybersecurity maturity, risk reduction, cybersecurity program health, and audit and compliance activities. The Audit Committee updates the Board on its activities at each regularly scheduled Board meeting. Risks related to cybersecurity events are provided to the Board on an annual basis as part of an overall ERM update. In addition to this regular reporting, significant cybersecurity risks may also be escalated on an as-needed basis through the company's organizational structure in accordance with the IRP.


text: Management's Role in Assessing and Managing Materials Risks from Cybersecurity Threats Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate. Management, including the CIO and CISO, is involved in assessing and managing our cybersecurity risks. The CISO reports to the CIO (who in turn reports to our Chief Financial Officer, who in turn reports to the CEO), and both the CIO and CISO participate in global leadership team meetings. With over 26 years of experience, including over three years with the company, the CIO has been recognized externally for his leadership in technology innovation in the industry, and provides strategic leadership for the company's IT organization. The CISO has over 30 years of IT and cybersecurity experience in large biopharmaceutical, life sciences, financial and technology industries, including over ten years with the company, and is responsible for managing the security architecture, engineering, technology operations, monitoring, incident response, risk, governance, quality and compliance at the company.


text: The company's Information Security function is comprised of teams that engage in a range of cybersecurity activities such as security operations, security engineering, data privacy controls, validation, compliance, and audit readiness. Leaders of each team are expected to collaborate to help increase visibility of key issues and alignment with strategy. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CISO. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.


text: Risk Assessment and Management We manage material risks from cybersecurity threats through a cross-functional and layered approach that is designed to detect, identify, respond to, recover from and protect from cybersecurity incidents and is informed by industry recognized standards.


text: Our security governance function, which includes key employees who work in Information Security, Legal, and Privacy teams, such as our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), are responsible for establishing and implementing cybersecurity policies and procedures, which includes developing and updating our enterprise Incident Response Plan ("IRP"), managing incident response, and overseeing any policy exceptions and potential compensating controls.


text: Additionally, we assess our cybersecurity maturity annually and implement and maintain controls that are designed to evaluate and improve our cybersecurity program, such as vulnerability assessments and penetration tests, as needed. We also execute employee cybersecurity training and awareness programs around various key cybersecurity topics, including reporting incidents, phishing, ransomware, remote working, cloud security, privileged access and removable media.


text: Our process for assessing, identifying and managing material risks from cybersecurity threats is integrated into our overall risk management process. We have a robust enterprise risk management ("ERM") program that plays an important role in seeking to manage and address existing and emerging risks, including cybersecurity risks, which are critical to our overall business goals and objectives. The ERM team updates our Chief Executive Officer ("CEO") and his leadership team on cybersecurity risks as well as their potential impact, likelihood, potential mitigation plan and status.


text: Engagement of Third-Party Advisors We engage third-party advisors, including assessors and cybersecurity consultants, to assess, validate and enhance our cybersecurity program. We benefit from engaging third parties to provide specialized skills, knowledge, tools and resources. These third parties also help reduce costs, increase efficiency, improve quality, mitigate risks and review cybersecurity strategy, trends and threat landscape.


text: Incident Response We have a dedicated Information Security team responsible for managing and coordinating incident response efforts. This team collaborates closely with other teams within the company, including teams within information technology ("IT"), Legal and Privacy, in identifying, analyzing and responding to cybersecurity incidents, which includes tracking cybersecurity incidents to help identify any related incidents. When cybersecurity incidents are identified, our practice is to respond to and address them utilizing incident classifications and escalation protocols, in accordance with applicable governmental regulations and other legal requirements. Where necessary or appropriate, we also engage third-party advisors to assist in the incident response process.


text: We have an IRP to prepare for and respond to cybersecurity incidents. Our IRP processes are tested in annual tabletop exercises to help identify strengths and areas for improvement. Under the IRP, cybersecurity incidents are escalated based on a defined incident severity to management as appropriate.


text: Third-Party Service Provider Risk Management We have a process in place to oversee and identify risks from cybersecurity threats associated with our use of key third-party service providers during the course of engagement. The company uses an external risk management software program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Our vendor security assessment process evaluates key vendors and, where appropriate, assesses vendor's controls for IT security, privacy, business continuity and other third-party risks. Following an evaluation, the company determines and prioritizes risks based on their potential impact, which helps inform the appropriate level of additional due diligence and ongoing compliance monitoring. The third-party risk assessment is a cross-functional effort involving our end-user, Legal, Privacy and Information Security teams.


text: Material Risks from Cybersecurity Threats Like many companies, we face cybersecurity threats and have experienced cybersecurity incidents, including data breaches and temporary service interruptions. However, since the beginning of fiscal year 2024, the company has not identified risks from known cybersecurity threats or incidents that have materially affected us or are reasonably likely to materially affect us. Nevertheless, there can be no assurance that our efforts in response to cybersecurity incidents, as well as our investments to protect our IT infrastructure and data, will shield us from significant losses, brand and reputational harm and potential liability or prevent any future interruption or breach of our systems. Such cybersecurity incidents can cause the loss of critical or sensitive information, including personal information, and could give rise to legal liability and regulatory action under data protection and privacy laws. For additional information on cybersecurity risks we face, see Part I, Item 1A. Risk Factors of this Annual Report on Form 10-K under the heading "Information system service interruptions or breaches, including significant cybersecurity incidents, could give rise to legal liability and regulatory action under data protection and privacy laws and adversely affect our business and operations."


text: Cybersecurity Governance Board Oversight of Risks from Cybersecurity Threats Our Board of Directors plays an important role in overseeing cybersecurity risks. Our Board of Directors has established an oversight structure for monitoring the effectiveness of and risks related to the cybersecurity program. The Audit Committee has been designated by the Board to oversee cybersecurity and information technology risks. The Audit Committee receives quarterly cybersecurity updates from our CISO, and the chair of the Audit Committee meets with the CISO individually on a quarterly basis. These updates often address topics such as ongoing efforts to improve our cybersecurity posture, operational metrics, incident metrics and mitigation actions, and may include key metrics such as those related to cybersecurity maturity, risk reduction, cybersecurity program health, and audit and compliance activities. The Audit Committee updates the Board on its activities at each regularly scheduled Board meeting. Updates related to cybersecurity are provided to the Board on an annual basis as part of an overall ERM update. In addition to this regular reporting, significant cybersecurity events may also be escalated on an as-needed basis through the company's organizational structure in accordance with the IRP.


text: Management's Role in Assessing and Managing Material Risks from Cybersecurity Threats Our CISO, supported by a cross-functional team, has primary responsibility for assessing and managing our cybersecurity program and the related risks. Details of the risk management and escalation processes are discussed in "Cybersecurity Risk Management and Strategy" above. The CISO has over 30 years of IT and cybersecurity experience in large biopharmaceutical, life sciences, financial and technology industries, including over ten years with the company, and is responsible for managing the security architecture, engineering, technology operations, monitoring, incident response, risk, governance, quality and compliance at the company.


text: The company's Information Security function is comprised of teams that engage in a range of cybersecurity activities such as security operations, security engineering, data privacy controls, validation, compliance and audit readiness. Leaders of each team are expected to collaborate to help increase visibility of key issues and alignment with strategy. As noted above, the company's IRP includes standard processes for escalating significant cybersecurity incidents to management, including the CISO. The company's incident response team also coordinates with external legal advisors, cybersecurity forensic firms, communication specialists, and other outside advisors and experts, as appropriate.


text: Risk Management and Strategy We have processes in place for assessing, identifying, and managing risks from cybersecurity threats that may result in material adverse effects to the confidentiality, integrity and availability of our systems, operations and data. These processes are a part of our overall risk assessment process. Risks from cybersecurity threats include, among other things, unauthorized access, data theft, computer viruses, ransomware, malicious software and other disruptions. We have implemented systems and processes utilizing a multilayered, proactive approach to identify, evaluate, mitigate and prevent potential cybersecurity threats. Each of these layers contain multiple levels of protection and leverage industry standard framework including the National Institute of Standards and Technology (NIST) Cybersecurity Framework. At the management level, these systems and processes are overseen primarily by our Chief Information Officer (CIO) and our Cyber Security Risk Officer (CSRO).

companyName: HORTON D R INC /DE/

ticker: DHI