text: Risk Management and Strategy We have established a cybersecurity risk management program that is integrated into our overall enterprise risk management system and provides us support in assessing, identifying, and managing material risks from cybersecurity threats. Our enterprise risk management program is fully updated annually and periodically updated and supplemented as new risks and opportunities are identified by management, including those related to cybersecurity risks. Our longstanding information security risk program is structured according to the National Institute of Standards and Technology Cybersecurity Framework, industry best practices, privacy legislation, and other global and local standards and regulations. This program includes a defense-in-depth approach with multiple layers of security controls, including network segmentation, security monitoring, endpoint protection, and identity and access management, as well as data protection best practices and data loss prevention controls.

companyName: RALPH LAUREN CORP

ticker: RL


text: Our cybersecurity awareness program includes regular phishing simulations, annual general cybersecurity awareness training, and data protection modules, as well as more contextual and personalized modules for targeted users and roles. We incorporate external expertise and guidance in all aspects of our cybersecurity program. We complete annual internal security audits and vulnerability assessments of the Company's information systems and related controls, including systems affecting personal data. In addition, we leverage cybersecurity specialists to complete annual external audits and objective assessments of our cybersecurity program and practices, including our data protection practices, as well as to conduct targeted attack simulations. We continually enhance our information security capabilities in order to protect against emerging threats, while also increasing our ability to detect and respond to cyber incidents and maximize our resilience to recover from potential cyber-attacks. We have a robust incident response plan in place that provides a documented runbook for handling high severity cybersecurity incidents and facilitates coordination across various corporate functions. We also perform simulations and drills at both a technical and leadership level at least annually. Additionally, we have purchased network security and cyber liability insurance in order to provide a level of financial protection should a data breach occur.

secItem: Item 1C


text: Our cybersecurity framework incorporates a robust third-party information technology ("IT") risk management program to ensure our vendors meet our high security standards. We leverage industry best practices like Standardized Information Gathering ("SIG") and recognized security certifications, including SOC 2, ISO 27001, and PCI-DSS, to assess our vendors. We also conduct thorough penetration testing and require vendors to adopt appropriate security controls through contractual agreements.


text: We thoroughly assess potential vendors based on their role and the sensitivity of the IT resources they access. All vendors follow a consistent risk management process, ensuring every vendor meets our high standards. We select vendors who prioritize data protection and comply with relevant privacy regulations. Furthermore, we enforce strict protocols, including limiting access to necessary information, ensuring data usage is confined to agreed-upon purposes, and mandating the deletion or return of data upon service termination. Through these measures, we collaborate with third-party vendors while implementing controls to safeguard our information.


text: Our business strategy, results of operations, and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of any previous cybersecurity incidents; however, we cannot assure that cybersecurity threats will not be material to us in the future. During the three fiscal years presented within this Form 10-K, we have not experienced a known material information security breach nor incurred material breach-related expenses. For a detailed discussion of significant risk factors regarding cybersecurity threats, see Item 1A — "Risk Factors — Risks Related to Information Systems and Data Security."


text: Our Board of Directors is responsible for overseeing management's overall approach to risk management, including cybersecurity risk. In addition, the Committees of the Board report to the full Board at regularly scheduled Board meetings on any identified material risks within that Committee's area of responsibilities and oversight, as well as when new risks arise. The Audit Committee has responsibility for oversight of the Company's cybersecurity risks.


text: The Audit Committee reviews our cybersecurity program on a quarterly basis, including through review of a quarterly enterprise risk management report, and periodically convenes special meetings to conduct deeper preparedness, enterprise risk and business continuity reviews. These special meetings are open to the full Board to attend. In addition, the full Board receives a regular cybersecurity update at least once annually. All of these meetings include our Chief Digital and Technology Officer ("CDTO") and Chief Information Security Officer ("CISO").


text: Our cybersecurity program is led by our CISO, a seasoned leader in the cybersecurity field with over 25 years of extensive experience across cybersecurity, IT, risk management, and regulatory compliance. Holding both a master's in computer engineering and business administration, our CISO is also a Certified Information Systems Security Professional ("CISSP"). Reporting directly to our CDTO, our CISO leads a dedicated team of information security and risk professionals. Together, they are entrusted with the crucial task of managing our information security and data protection operations.


text: Collaborating closely with business stakeholders, our CISO shapes a comprehensive cybersecurity strategy that serves as the cornerstone of our information security programs, supporting effective cybersecurity risk management. Leading the cybersecurity risk assessment process, our CISO utilizes a robust incident response plan to handle high-severity cybersecurity incidents promptly. In cases of potentially material cyberattack incidents, or a series of smaller similar incidents, our CISO promptly engages a cross-functional incident response team to determine the materiality of the incident and whether public disclosure is necessary.


text: The CISO informs our management leadership team on security matters and fosters a strong partnership with our corporate legal team to ensure compliance with legal, regulatory, privacy, and contractual security requirements.


text: We thoroughly assess potential vendors based on their role and the sensitivity of the IT resources they access. Our vendors follow a consistent risk management process in order to meet our high standards. We select vendors who prioritize data protection and comply with relevant privacy regulations. Furthermore, we enforce strict protocols, including limiting access to necessary information, ensuring data usage is confined to agreed-upon purposes, and mandating the deletion or return of data upon service termination. Through these measures, we collaborate with third-party vendors while implementing controls to safeguard our information.


text: The Audit Committee reviews our cybersecurity program on a quarterly basis, including through review of a quarterly enterprise risk management report, and periodically convenes special meetings to conduct deeper preparedness, enterprise risk and business continuity reviews. These special meetings are open to the full Board to attend. In addition, the full Board periodically receives cybersecurity updates. Our Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO") attend all of these meetings and provide updates during them.


text: Our cybersecurity program is led by our CISO, a seasoned leader in the cybersecurity field with over 25 years of extensive experience across cybersecurity, IT, risk management, and regulatory compliance. Holding both a master's in computer engineering and business administration, our CISO is also a Certified Information Systems Security Professional ("CISSP"). Reporting directly to our CIO, the CISO leads a dedicated team of information security and risk professionals. Together they are entrusted with the crucial task of managing our information security and data protection operations.


text: We rely on our technology infrastructure and information systems to interact with suppliers, sell our products and services, fulfill orders, support our customers, and bill, collect, and make payments. Our internally developed system and processes, as well as those systems and processes provided by third-party vendors, may be susceptible to damage or interruption from cybersecurity threats, such as terrorist or hacker attacks, the introduction of malicious computer viruses, ransomware, falsification of banking and other information, insider risk, or other security breaches. Such attacks have become more and more sophisticated over the years and in some cases have been conducted or sponsored by governmental actors with significant means. We have implemented robust processes to assess, identify, and manage cybersecurity risks, including potentially material risks, related to our internal information systems, our products, and our business. Our Board of Directors has direct oversight of our enterprise risk management process, including the management of cybersecurity risks, as described below.

companyName: METTLER TOLEDO INTERNATIONAL INC/

ticker: MTD


text: Under the direction and supervision of our Chief Financial Officer, we conduct an annual comprehensive enterprise risk assessment, which includes details of our management of enterprise-wide risk topics, such as those related to cybersecurity risks. The Board of Directors receives the full results of the annual enterprise risk assessment, including an evaluation of cybersecurity risks we face, risks more broadly across our peers and industries, and a detailed description of the actions we have taken to mitigate these risks. The Audit Committee of the Board of Directors reviews the results of the enterprise risk assessment in detail with management on an annual basis and reports on its review to the Board of Directors each year. We provide a comprehensive update to the Board of Directors on cybersecurity at least annually, and more frequently as relevant.


text: Our Head of Global Supply Chain and IT, Head of Digital Business Services, and Head of Information Security serve on our Cybersecurity Steering Committee (the "Cyber SteCo"), along with our General Counsel who reports to our Chief Executive Officer, and our Head of Financial Processes who reports to our Chief Financial Officer. The Cyber SteCo, which meets monthly, develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, and receives regular updates on cybersecurity-related matters.


text: Our Head of Global Supply Chain and IT, reporting to our Chief Executive Officer, has principal responsibility for assessing and managing cybersecurity risks and preparing updates for the Board of Directors. Our Head of Digital Business Services reports to our Head of Global Supply Chain and IT and is responsible for the operation of our cybersecurity program. Our Head of Digital Business Services is educated in business computing sciences and has over twenty years working in leadership, management, and consulting roles in digitalization, application management, and cybersecurity. Our Head of Digital Business Services also has experience implementing and leading global governance frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and ISO 27001. An Advisory Board, comprised of the Chief Executive Officer, Chief Financial Officer, Head of Global Supply Chain and IT, and Head of Digital Business Services, meets quarterly to discuss digital initiatives and investments, inclusive of cybersecurity topics. An experienced team of IT security professionals reports to our Head of Digital Business Services.


text: The Cyber SteCo oversees activities related to the monitoring, prevention, detection, mitigation, and remediation of cybersecurity risks. We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, and periodic assessments of third-party service providers to assess the cyber preparedness of key vendors. To enhance our threat preparedness, we perform monthly vulnerability scans, annual penetration testing with a third-party, and annual disaster recovery and cyber response drills, including third-party facilitated drills. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a third party operated security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. As noted above, our Cyber Steco also has implemented comprehensive incident response plans that define the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cyber SteCo escalates events, including to the Chief Executive Officer and Board of Directors, as deemed necessary.


text: The Cyber SteCo oversees our engagement with reputable third parties, which we utilize in connection with our established processes to assess, identify, and manage potential and actual cybersecurity threats, to actively monitor our systems internally using widely accepted digital applications, processes, and controls, and to provide forensic assistance to facilitate system recovery in the case of an incident.


text: If there is a cybersecurity incident, we may suffer interruptions in service, loss of assets or data, or reduced functionality. Many of our systems are not redundant, and our disaster recovery planning may not be sufficient for every eventuality a cybersecurity incident could cause. Security breaches of our systems which allow inappropriate access to or inadvertent transfer of information and misappropriation or unauthorized disclosure of confidential information belonging to us or to our employees, customers, or suppliers could result in our suffering significant financial and reputational damage. Customers may use our products and/or software to generate or manage critical information. Though we take steps to ensure our products and/or software are secure, it is possible that a cyber attack could result in the loss or compromise of critical information. If a customer alleges that a cyber attack causes or contributes to a loss or compromise of critical information, whether or not caused by us, we could face harm to our reputation and financial condition as it could cause us to incur legal liability and increased costs to respond to such events.


text: Our Head of Global Supply Chain and IT, Chief Information Officer, and Head of Information Security serve on our Cybersecurity Steering Committee (the "Cyber SteCo"), along with our Chief Legal Officer, who reports to our Chief Executive Officer, and our Head of Financial Processes, who reports to our Chief Financial Officer. The Cyber SteCo, which meets regularly, develops and implements cybersecurity risk mitigation strategies and activities throughout the year, including the management of comprehensive incident response plans, and receives regular updates on cybersecurity-related matters.


text: Our Head of Global Supply Chain and IT, reporting to our Chief Executive Officer, has principal responsibility for assessing and managing cybersecurity risks and preparing updates for the Board of Directors. Our Chief Information Officer reports to our Head of Global Supply Chain and IT and is responsible for the operation of our cybersecurity program. Our Chief Information Officer is educated in business computing sciences and has over twenty years working in leadership, management, and consulting roles in digitalization, application management, and cybersecurity. Our Chief Information Officer also has experience implementing and leading global governance frameworks, including the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and ISO 27001. An Advisory Board, comprised of the Chief Executive Officer, Chief Financial Officer, Head of Global Supply Chain and IT, and Chief Information Officer, meets quarterly to discuss digital initiatives and investments, inclusive of cybersecurity topics. An experienced team of IT security professionals reports to our Chief Information Officer.


text: The Cyber SteCo oversees activities related to the monitoring, prevention, detection, mitigation, and remediation of cybersecurity risks. We have adopted the National Institute of Standards and Technology ("NIST") Cybersecurity Framework to continually evaluate and enhance our cybersecurity procedures. Activities include mandatory quarterly online training for all employees, technical security controls, enhanced data protection, the maintenance of backup and protective systems, policy review and implementation, the evaluation and retention of cybersecurity insurance, and periodic assessments of third-party service providers to assess the cyber preparedness of key vendors. To enhance our threat preparedness, we perform monthly vulnerability scans, annual penetration testing with a third party, and annual disaster recovery and cyber response drills, including third-party-facilitated drills. We use automated tools that monitor, detect, and prevent cybersecurity risks and have a third party operated security operations center that operates 24 hours a day to alert us to any potential cybersecurity threats. As noted above, our Cyber SteCo also has implemented comprehensive incident response plans that define the appropriate communication flow and response for certain categories of potential cybersecurity incidents. The Cyber SteCo escalates events, including to the Chief Executive Officer and Board of Directors, as deemed necessary.


text: AMETEK's cybersecurity risk management practices are based on the widely recognized National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (The NIST Cybersecurity Framework and the NIST 800-171 Revision 2 Standard). This guidance was developed with private sector input and provides a framework and toolkit for organizations to manage cybersecurity risk.

companyName: AMETEK INC/

ticker: AME


text: We utilize a broad team of in-house information technology and security personnel, as well as third-party consultants, services and software, to help manage our cybersecurity efforts and initiatives. We regularly assess our threat landscape and monitor our systems and other technical security controls. Additionally, we maintain information security policies and procedures, including a breach response plan and maintenance of backup and protective systems.


text: We regularly review our policies, practices, and plans with assistance from third-party experts and advisors. Our Chief Information Officer is responsible for corporate-wide data security. Our management team is actively engaged in regular reviews of cyber risks. Additionally, our full Board of Directors receives quarterly briefings on enterprise-wide cybersecurity risk management and our overall cybersecurity risk environment.


text: We have implemented two risk management groups, the Enterprise Risk Management Committee, and the Cybersecurity Steering Committee. These committees meet quarterly. They are responsible for the overall governance of our cyber management. The implementation of the Cyber polices and strategy is the responsibility of the Chief Information Officer and the Director of Cyber Security. The CIO reports to the Chief Administrative Officer and the Director of Cyber Security reports to the CIO. We also have a team of full-time cybersecurity specialists who hold various industry technology accreditations. The CIO has more than 35 years in Senior IT Leadership positions, and the Director of Cyber Security has more than 30 years IT experience overall, 15 of which are in leadership roles.


text: Operationally, we deploy multiple layers of cyber defenses including multiple tools and processes that identify security risks across our global networks, largely in real time. We also maintain good relationships with law enforcement agencies to remain informed on potential cyber risks.


text: Mandatory cybersecurity training is conducted eight times a year for all of AMETEK's employees with email access. The training provides critical information on how employees can protect themselves and AMETEK against cybersecurity risks. AMETEK financial professionals receive additional training due to the nature of their roles.


text: To respond to the threat of security breaches and cyberattacks, we have developed a cybersecurity program, the implementation of which is led by our Global Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"). Our cybersecurity program is designed to protect and preserve the confidentiality, integrity and continued availability of all information and systems owned by us, or in our care. The Audit and Risk Committee of our Board of Directors has oversight of cybersecurity per its charter and as disclosed in our proxy statement. In addition, cybersecurity is reviewed as part of our overall enterprise risk management program, led by our Director of Enterprise Risk Management, which assesses our significant enterprise risks, provides a summary of those risks and primary mitigations, identifies control improvement projects for our significant risks, and regularly reports on the progress of control improvement projects for those risks to our GEB and the Audit & Risk Committee of our Board of Directors. Our Director of Enterprise Risk Management regularly meets with our CISO and CIO to assess our cybersecurity risks, cybersecurity program mitigants and status of control improvement projects.

companyName: JONES LANG LASALLE INC

ticker: JLL


text: Like other companies with a large technology footprint and high-profile client base, we are regularly subject to cyberattacks. While certain attacks have been successful, thus far none have had a material impact to our operations or clients. In the future, it is possible such attacks could be successful and have a material impact on our operations or our clients' operations. Our cybersecurity program strategy is to implement layered controls to reduce our cybersecurity risk by minimizing both the likelihood and potential impact of cybersecurity events. These controls are aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework.


text: Our CISO leads our cybersecurity program, holds a master's degree in computer and network forensics and has over twenty years of relevant experience, including cybersecurity and enterprise security leadership roles for large global organizations and within the U.S. government. Our CISO leads a global team of cybersecurity professionals with relevant prior employment experience at global financial services firms, leading technology companies, cybersecurity providers, the government and the military.


text: Our CISO reports to our CIO who is responsible for the development and implementation of our technology, data and information management strategy. Our CIO has over twenty years of experience in technology, data management, data science and analytics, earned a bachelor's degree in mechanical engineering and a master's degree in industrial engineering – operations research. Before joining JLL, our CIO previously held positions as Chief Data Officer, Global Head of Customer Intelligence, Head of Global Analytics and Head of Product Management for a large global financial services institution.


text: We engage third-party consultants in connection with our cybersecurity program for assessing, identifying and managing material risks from cybersecurity threats. These third-parties provide testing and advisory services to identify risks, improve the quality of controls, and ensure JLL is well-positioned to respond to cybersecurity incidents.


text: Our cybersecurity program also includes assessments of cybersecurity threats associated with our use of certain third-party service providers. JLL leverages pre-procurement security assessments and post-procurement continuous monitoring to evaluate the security risk of certain third-party service providers. We regularly engage third-parties to provide technology and/or to perform facilities management and project management services to our clients, where we have imperfect visibility into our third-parties' susceptibility to cybersecurity threats and/or their controls.


text: We maintain a robust cyber incident response plan that includes controls and procedures designed to allow timely and accurate reporting of any material cybersecurity incident. We view cybersecurity as a shared responsibility, and we periodically perform simulations and tabletop exercises at a management level and incorporate external resources as well. We provide at least annual information security training program for employees who have access to JLL or client related sensitive or personal information and regularly conduct phishing tests and education.


text: In 2023, we established a management executive committee that consists of our CISO, Chief Financial Officer, Chief Legal Officer, and Chief Accounting Officer that is responsible for determining if a cybersecurity incident is material to the Company and requires disclosure. In the event of an incident, we intend to follow our detailed incident response playbook, which outlines the steps to be followed from incident detection to mitigation, recovery and notification.


text: Although we have not experienced any material cybersecurity events to date, cybersecurity threats could materially affect our business strategy, results of operations, or financial condition, as further discussed in our "Operational Risk Factors" in Item 1A, Risk Factors, of this report. Our business is highly dependent on our ability to collect, use, store and manage organizational and client data. If any of our significant information and data management systems do not operate properly or are disabled, we could suffer a material disruption of our businesses, liability to clients, loss of client or other sensitive data, loss of employee data, regulatory intervention, breach of confidentiality or other contract provisions, or reputational damage. These systems may fail to operate properly or become disabled as a result of events wholly or partially beyond our control, including disruptions of electrical or communications services, natural disasters, political instability, terrorist attacks, sabotage, computer viruses, deliberate attempts to disrupt our computer systems through "hacking," "phishing," or other forms of both deliberate or unintentional cyber-attack, or our inability to occupy one or more of our office locations. As we outsource significant portions of our information technology functions to third-party providers, such as cloud computing, we bear the risk of having less direct control over the security and performance of those systems.


text: Our cybersecurity risk is affected by cyber threats that are proliferating and advancing their ability to identify and exploit vulnerabilities, requiring continuous evaluation and improvements to our security architecture and cyber defenses. We also face increased cybersecurity risk as we deploy additional mobile and cloud technologies. We are continuously hardening our infrastructure built on these technologies, monitoring for threats, and evaluating our capability to respond to any incidents to minimize any impact to our systems, data, or business operations. Because we service clients across multiple industry verticals — many of which are higher-profile cyber targets themselves — including financial services, technology, government institutions, healthcare and life sciences, this also may increase the risk that we are subject to cyber-attack incidents.


text: As noted above, we have experienced various types of cyber-attack incidents which thus far have been contained and not material to us. We continue to implement new controls, governance, technical protections and other procedures to mitigate against the risks of a cybersecurity event. We also maintain a cyber risk insurance policy but the costs related to cybersecurity threats or disruptions may not be fully insured. We may incur substantial costs and suffer other negative consequences such as liability, reputational harm and significant remediation costs and experience material harm to our business and financial results if we, or vendors or suppliers we engage on behalf of our clients, fall victim to other successful cyberattacks.


text: Our Management and the Board of Directors provide significant oversight of risks from cybersecurity threats and are informed about and closely monitor the prevention, detection, mitigation and remediation of cybersecurity incidents. In May 2022, in furtherance of ensuring appropriate oversight of our cybersecurity and information technology readiness, the Board adopted an amended charter of the Audit Committee which added cybersecurity and information technology readiness as part of the committee's purpose. In addition, the Audit Committee was renamed to the "Audit and Risk Committee" to more accurately align with its responsibility to assist the Board in overseeing our policies, program and related risks identified as part of the enterprise risk management framework and cybersecurity and information technology.


text: The Audit and Risk Committee and management's Cyber Governance Committee receive regular reports from our CIO and CISO on our information security program including our top cybersecurity risks, cybersecurity strategy, information system controls and related security measures and improvements, cyber incident response plan, cyber incidents and cyber defense metrics, and cyber security protocols and trainings. These regular reports also are shared with the full Board of Directors.


text: Our cybersecurity program, led by our Global Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), is designed to protect and preserve the confidentiality, integrity and availability of all information and systems owned by us or in our care. The Audit and Risk Committee of our Board of Directors oversees cybersecurity, as outlined in its charter and disclosed in our proxy statement.


text: In addition, cybersecurity is reviewed as part of our enterprise risk management program led by our Director of Enterprise Risk Management, which assesses our significant enterprise risks, provides a summary of those risks and primary mitigations, identifies control improvement projects for our significant risks, and regularly reports on the progress of control improvement projects for those risks to our GEB and the Audit and Risk Committee of our Board of Directors.


text: Our cybersecurity strategy implements layered controls aligned with the National Institute of Standards and Technology (NIST) cybersecurity framework to minimize both the likelihood and potential impact of cybersecurity events.


text: Our CISO, who holds advanced qualifications and has extensive experience in cybersecurity, leads a global team of cybersecurity professionals. Our CISO reports to our CIO who is responsible for the Company's technology, data and information management strategy, and brings over two decades of relevant experience to the role.


text: We engage third-party consultants for assessing, identifying and managing material cybersecurity risks, including those associated with certain third-party providers. We maintain a cyber incident response plan and regularly conduct simulations and tabletop exercises.


text: In 2023, we established an executive management group responsible for determining the materiality of cybersecurity incidents and necessary disclosures. This group consists of our CISO, Chief Financial Officer, Chief Legal Officer and Chief Accounting Officer.


text: Like other companies with a large technology footprint and high-profile client base, we are regularly subject to cyberattacks. While certain attacks have been successful, thus far none have had a material impact on our or our clients' operations. In addition, we acknowledge that cybersecurity threats could significantly impact our business strategy, operations, or financial condition. As such, we continue to enhance our infrastructure, monitor for threats, and evaluate our response capabilities as we deploy additional mobile and cloud technologies. Also refer to our discussion of material cybersecurity risks in the "Operational Risk Factors" section of Item 1A, Risk Factors, of this report.


text: Our Management and the Board of Directors provide significant oversight of cybersecurity risks. In May 2022, the Board expanded the Audit Committee's charter to include cybersecurity and information technology readiness. In addition, the Audit Committee was renamed to the "Audit and Risk Committee" to more accurately align with its responsibility to assist the Board in overseeing our policies, program and related risks identified as part of the enterprise risk management framework and cybersecurity and information technology. Further enhancing our cybersecurity governance, in 2024, the Cybersecurity Subcommittee of the Audit and Risk Committee was formally established. This subcommittee generally meets on a quarterly basis and regularly reports to the Audit and Risk Committee, providing an additional layer of specialized oversight on cybersecurity matters.


text: The Audit and Risk Committee, its Cybersecurity Subcommittee, and management's Cyber Governance Committee receive regular reports on our information security program, including top risks, strategy, controls, incident response plans, metrics, and training protocols. Reports are also shared with the full Board of Directors.


text: We maintain a cyber risk insurance policy, but costs related to cybersecurity threats or disruptions may not be fully insured. We acknowledge that successful cyberattacks could result in substantial costs, liability, reputational harm, and significant remediation expenses.


text: Risk Management and Strategy Our Board of Directors oversees our risk management program, and because information security is a top priority and an important component of our day-to-day operations, cybersecurity is part of our overall approach to enterprise risk management. The scope of cybersecurity risk management encompasses all aspects of business operations, including supply chain risks and production manufacturing operations. Our cybersecurity practices are based on industry practices and frameworks such as those established by the International Organization for Standardization and the National Institute of Standards and Technology. We recognize the importance of the continued protection of our employee, customer, supplier and partner data and address operational risks from cybersecurity threats through a cross-functional approach focused on preserving the confidentiality, integrity and availability of the information that we collect, process and store.

companyName: SILICON LABORATORIES INC.

ticker: SLAB


text: We have implemented cybersecurity policies, processes, and controls to assist management in our assessment, identification and management of risks from cybersecurity threats. Our Security Operations team scans the infrastructure, monitors events, analyzes threats, and coordinates our incident response pursuant to our incident response plan, which includes the process to be followed for reporting of incidents. Our cybersecurity risk management involves identifying information assets, their sensitivity and potential threats, followed by assessing and prioritizing risks. We employ various tools and techniques like threat modeling, vulnerability scanners, and penetration testing. Based on the assessment, security measures are planned, prioritized and implemented. We have implemented regular security awareness training programs for employees to educate them on cybersecurity best practices and to recognize social engineering and phishing attempts. We also assess and manage cybersecurity risks associated with relevant third-party service providers, including those in our supply chain or who have access to our data or systems. Our cybersecurity process is iterative, with regular reviews and updates to help improve and keep abreast of a dynamic and continuously evolving threat landscape.


text: We describe whether and how risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, our business strategy, results of operations, or financial condition under the headings "We may be the victim of business disruptions and security breaches, including cyber-attacks, which could lead to liability or could damage our reputation and financial results" and "We may be subject to information technology failures that could damage our reputation, business operations and financial condition" included as part of our risk factors disclosures in "Risk Factors" above.


text: In the last three fiscal years, we have not identified material cybersecurity incidents, and the expenses we have incurred from cybersecurity incidents were immaterial, including penalties and settlements, of which there were none.


text: Our Board of Directors is responsible for risk management oversight and has delegated to our Audit Committee oversight responsibility for reviewing the effectiveness of our governance and management of cybersecurity risks. The Audit Committee regularly reviews our policies and practices with respect to risk management, including cybersecurity risks, and reports to the full Board of Directors based on these reviews. The Audit Committee also receives a report containing information security risk posture details, remediation plan execution progress and pertinent threat intelligence updates from the Chief Security Officer ("CSO") on a quarterly basis. At least annually, but more frequently as necessary, threats from cybersecurity risks and our action plans relating to those risks also are considered by the full Board during meeting discussions of enterprise risks. Members of management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer may also report directly to the Board of Directors on significant risk management issues, including cybersecurity threats and incidents.


text: We have an Executive Security Steering Council (the "ESC") comprised of members of our executive team, our Chief Information Officer, and CSO. Our CSO, in coordination with the ESC, works collaboratively to implement our enterprise-wide cybersecurity strategy, policy, standards, architecture, and processes. Our Security Operations, Security Engineering, and Governance teams communicate with and report to the CSO, enabling the CSO and the ESC to monitor the detection, mitigation, and remediation of cybersecurity incidents. Our CSO has over 27 years of security experience in multiple relevant technology and leadership disciplines, including prior work experience leading cybersecurity teams, business strategies and security solution architecture. He also holds several relevant degrees and certifications, including as a Certified Information Systems Security Professional ("CISSP") and a Certified Secure Software Lifecycle Professional ("CSSLP"), and holds Honors BSc degrees in Computer Science and Physics.


text: As an oil and gas producer, the Company is dependent on digital technology in many areas of its business and operations. Additionally, the Company gathers and safeguards sensitive information in its regular business activities. The Company continually evaluates and integrates new processes, systems and resources to enhance its defenses against cybersecurity threats. The Company has implemented and maintains the following processes to assess, identify and manage cybersecurity risks:

companyName: PIONEER NATURAL RESOURCES CO


text: Risk management policies. The Company has developed and implemented an information security program (the "Cyber Program") and an incident response plan (the "IRP"), which include various processes and controls intended to protect the integrity and availability of the Company's systems and information. These processes and controls were primarily designed and assessed based on the cybersecurity framework published by the National Institute of Standards and Technology. The Company retains or engages various third-parties in connection with design, implementation and monitoring of certain processes and controls. In addition, the Company maintains business continuity and disaster recovery plans.


text: Key aspects of the Cyber Program include: • risk assessments designed to help identify material cybersecurity risks to critical systems and the company-wide information technology environment; • continuous monitoring of Company systems and the conduct of periodic penetration tests; • the IRP that includes procedures for responding to cybersecurity incidents; • required cybersecurity trainings for employees, incident response personnel, and Company management related to physical security of assets, data privacy and other information security policies and procedures; and • a third-party risk management process for its service providers, suppliers, vendors and other business associates.


text: The Cyber Program is integrated into the Company's overall enterprise risk management process and shares common methodologies, reporting channels, and governance processes that apply across the enterprise risk management process to other legal, compliance, strategic, operational, and financial risk areas. Cyber risks identified in the overall enterprise risk management process are reviewed annually by the Board.


text: Governance. The Company's cybersecurity risk management and strategy processes are managed by the Chief Information Security Officer ("CISO") and the Vice President of Technology Solutions, who have 24 and eight years of work experience, respectively, in various roles involving systems security, operations and compliance. These individuals are informed about and monitor the prevention, detection, mitigation and remediation of cybersecurity incidents through their management of internal information technology personnel and retained third-party personnel involved in the cybersecurity risk management and strategy processes described above, including the operation of the IRP. If a cybersecurity incident occurs, it is reviewed by the information technology team to determine whether further escalation to the CISO or Vice President of Technology Solutions is required. Any cybersecurity incident assessment that results in the possibility of a material impact to the Company is reported to the appropriate designated members of management and, when appropriate, outside counsel, to make final materiality determinations, as well as disclosure and other compliance decisions. Additionally, the Company's cyber security governance includes a Cybersecurity Steering Committee which is comprised of a subset of the Company's Executive Committee and other key officers, leaders and subject matter experts from various disciplines across the Company. The Cybersecurity Steering Committee meets quarterly to receive updates from the CISO and/or Vice President of Technology Solutions on Company-related cyber risks, monitor compliance with the Company's Cyber Program and to review cybersecurity policies.


text: The Board is responsible for overseeing the Company's enterprise risk management processes and has delegated oversight of cybersecurity and other information technology risks to the Audit Committee, a standing committee of the Board. The Audit Committee oversees management's implementation and execution of the Company's Cyber Program and IRP. The Audit Committee receives in-depth annual reports from the CISO or the Vice President of Technology Solutions detailing relevant cybersecurity risks to the Company and, as necessary, timely periodic updates based on circumstances, regarding any significant cybersecurity incidents or developments. The Audit Committee reports to the Board regarding its activities, including those related to cybersecurity.


text: Risks from Cybersecurity Threats. As of the date of this Annual Report on Form 10-K, the Company has not identified any cybersecurity incidents, including any prior cybersecurity incidents, that have materially affected the Company's operations, business strategy, results of operations and cash flows. The Company faces various ongoing risks from cybersecurity threats that, if realized, are reasonably likely to lead to losses of sensitive information, critical infrastructure or capabilities essential to the Company's operations and could have a material adverse effect on the Company's reputation, financial position, results of operations and cash flows. See "Item 1A. Risk Factors - The Company's business could be materially and adversely affected by security threats, including cybersecurity threats, and other disruptions" for additional information.


text: Risk Management and Strategy Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors Operational Risk" for a discussion of such risks.

companyName: PRUCO LIFE INSURANCE OF NEW JERSEY


text: Cybersecurity risk management is integrated within our risk management framework. See Item 7. "Management's Discussion and Analysis of Financial Condition and Results of Operations - Risk Management" for additional information on our risk management. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.


text: In order to respond to the threat of security breaches and cyber-attacks, Prudential Financial has developed an information security program designed to protect and preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company. This information security program provides for the coordination of various corporate functions and governance groups, including global technology, risk, legal, compliance and corporate audit, and serves as a framework for the execution of responsibilities across businesses and operational roles. Among other things, the information security program establishes security standards for our technological resources and includes training for employees, contractors and third-parties. Employees with access to our Company's systems are subject to comprehensive annual training on responsible information security, data security, and cybersecurity practices and how to protect data against cyber threats.


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader security community and monitor cyber threat information.


text: To address risks associated with third-parties, Prudential Financial has established an enterprise-wide Third-Party Risk Management Program. This program's features include, among other things, identifying, assessing and managing cybersecurity risks throughout the life of our third-party relationships.


text: We also maintain an incident response plan, which specifies escalation and evaluation processes for cyber events. This plan is executed in close coordination with our corporate functions, including a dedicated cyber and privacy law function, external affairs, and risk management, and is designed to ensure, among other things, appropriate and timely reporting and disclosure.


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors Operational Risk" for a discussion of risks related to cybersecurity.


text: Prudential Financial's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Chief Information Officer ("CIO"). We believe that Prudential Financial's employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques, including intrusion detection, malware analysis and penetration testing. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional.


text: Prudential Financial's Audit Committee of the Board of Directors which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the CIO and Operational Risk Management throughout the year. At least annually, Prudential Financial's Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential Financial's annual external integrated audit.


text: Prudential Financial's Audit Committee regularly briefs the full Board of Directors on these matters, and the full Board of Directors also receives periodic briefings on cyber threats in order to enhance our directors' literacy on cyber issues.


text: Risk Management and Strategy Because of the size and scope of our business, we are subject to numerous and evolving cybersecurity risks, any of which, if it materializes, could affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors— Operational Risk" for a discussion of such risks.


text: Cybersecurity risk management is integrated within our risk management framework. We conduct risk identification through several processes at the business unit, corporate, senior management, and Board levels. This framework includes escalation points to Prudential's risk committees, allowing cyber risk and control matters to be elevated to the Board of Directors or its Audit Committee for oversight.


text: As part of the information security program, we conduct periodic exercises with independent outside advisors to assess the effectiveness of our program and our internal response preparedness. We regularly engage with the broader cybersecurity community and monitor cyber threat information.


text: During the period covered by this Report, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. See "Item 1A. Risk Factors—Operational Risk" for a discussion of risks related to cybersecurity.


text: Prudential Financial's information security program is overseen by the Chief Information Security Officer ("CISO") and Information Security Office, as well as the Head of Global Technology and Operations ("HGTO"). The CISO and Information Security Office are responsible for monitoring for, and informing management of, cybersecurity incidents impacting Prudential's systems. We believe that Prudential Financial's employees responsible for managing cybersecurity risk have the skills and knowledge to assess and manage the Company's material risks from cybersecurity threats, and their qualifications include degrees and certifications typical for cybersecurity professionals. We expect these employees to, among other things, understand computer systems, networks, and security technologies and be proficient in a variety of security tools and techniques. The CISO has served in various roles in information technology and information security for over 25 years, including serving as the head of information technology risk at two large public companies. The CISO holds a graduate degree in technology management and has attained the professional certifications of Certified Information Systems Security Professional and Certified Information Privacy Professional.


text: Prudential Financial's Audit Committee of the Board of Directors which is responsible for oversight of certain risk issues, including cybersecurity, receives reports from the CISO, the HGTO and Operational Risk Management throughout the year. At least annually, Prudential Financial's Board and the Audit Committee also receive updates about the results of program reviews, including exercises and response readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness. To the extent cybersecurity controls are related to internal control over financial reporting, such controls are considered in the context of Prudential Financial's annual external integrated audit.


text: Risk Management and Strategy - We are an essential critical infrastructure business, and cybersecurity is a high priority for our leadership and Board of Directors. In 2021, the Transportation Security Administration (TSA) began releasing security directives establishing cybersecurity requirements for our industry. We promptly responded to these directives when released and continue to work collaboratively with our government counterparts to improve security throughout our technology systems.

companyName: ONEOK INC /NEW/

ticker: OKE


text: We engage in an annual comprehensive Enterprise Risk Management (ERM) process designed to identify and manage risk. Our annual ERM assessment is designed to enable our Board of Directors to establish a mutual understanding with management of the effectiveness of our risk-management practices and capabilities, to review our risk exposures and to elevate certain key risks for discussion at the board level. Our ERM program is overseen by our chief financial officer. Our ERM process encompasses the identification and assessment of a broad range of risks, including cybersecurity, and the development and testing of controls to mitigate these risks.


text: In order to manage these cybersecurity risks, including our use of third-party software and cloud vendors, we have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and information. We take a cross-disciplinary approach to cybersecurity and physical security. Our cybersecurity risk management program is integrated with our ERM program and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal compliance, strategic, operational and financial risk areas. Our program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements. In addition, we conduct risk assessments of third-party software and cloud vendors by utilizing security questionnaires prior to procurement. On a regular basis, we engage consultants to conduct penetration tests and architecture design reviews. As of the date of this report, we are not aware of any cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, may materially affect us, including our operations, business strategy, results of operations or financial condition. See Part 1, Item 1A "Risk Factors" for a discussion of risks factors related to cybersecurity.


text: Governance - Security is governed by the Security Advisory team, an executive advisory committee composed of company officers, including our chief executive officer, our chief financial officer and our chief enterprise services officer, who meet regularly to evaluate ongoing security threats and incidents, to define policy and to prioritize initiatives. This advisory team is chaired by our vice president of cybersecurity and physical security, who has more than twenty years of relevant experience in the field of cyber and physical security. In his role, our vice president of cybersecurity and physical security also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, alerts and reports produced by security tools deployed in our technology infrastructure and threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers. Identified cybersecurity threats and incidents are monitored and assessed for materiality by this cross-functional Security Advisory team. This assessment includes whether our Board of Directors should be informed of a threat or incident.


text: Cybersecurity risks are communicated and discussed with our Board of Directors at least annually in conjunction with our overall ERM program. As part of its oversight responsibilities, our Board of Directors also receives frequent updates from executive management on our company's physical and cybersecurity efforts.


text: Risk Management and Strategy - We take a cross-disciplinary approach to cybersecurity and physical security. Our annual Enterprise Risk Management (ERM) process encompasses the identification and assessment of a broad range of risks, including cybersecurity, and the development and testing of controls to mitigate these risks. Our ERM assessment is designed to enable our Board of Directors to establish a mutual understanding with management of the effectiveness of our risk-management practices and capabilities, to review our risk exposures and to elevate certain key risks for discussion at the board level. Our ERM program is overseen by our chief financial officer.


text: Our cybersecurity risk management program is integrated with our ERM program and shares common methodologies, reporting channels and governance processes that apply across the ERM program to other legal compliance, strategic, operational and financial risk areas. Our security program generally incorporates the guidelines of the widely utilized National Institute of Standards and Technology Cybersecurity Framework, though this does not imply we meet any particular technical standards, specifications or requirements. In addition, we conduct risk assessments of enterprise third-party software and cloud vendors by utilizing security questionnaires prior to procurement. On a regular basis, we engage consultants, including external counsel and cybersecurity firms, to conduct penetration tests and architecture design reviews.


text: As of the date of this report, though the Company and third parties have experienced certain non-material cybersecurity incidents, we are not aware of any cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, may materially affect us, including our operations, business strategy, results of operations or financial condition. See Part 1, Item 1A "Risk Factors" for a discussion of risks factors related to cybersecurity.


text: Governance - Security is governed by the Security Advisory team, an executive advisory committee composed of company officers, including our chief executive officer, our chief financial officer and our chief enterprise services officer. The Security Advisory team meets regularly to evaluate ongoing security threats and incidents, to define policy and to prioritize initiatives. Identified cybersecurity threats and incidents are monitored and assessed for materiality by this cross-functional Security Advisory Team. This assessment includes whether our Board of Directors should be informed of a threat or incident.


text: The Security Advisory team is chaired by our vice president of cybersecurity and physical security who has more than twenty years of relevant experience in the field of cyber and physical security. In his role, our vice president of cybersecurity and physical security also supervises efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel, alerts and reports produced by security tools deployed in our technology infrastructure and threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers. Our vice president of cybersecurity and physical security reports to our executive vice president and chief enterprise services officer, responsible for cybersecurity, information technology, enterprise optimization and innovation, among other responsibilities. Before joining ONEOK, our executive vice president and chief enterprise services officer held information technology positions of increasing responsibility.


text: Cybersecurity risks are communicated and discussed with our Board of Directors at least annually in conjunction with our overall ERM program. Internal Audit provides periodic updates to the Audit Committee on testing completed to meet TSA requirements. As part of its oversight responsibilities, our Board of Directors also receives frequent updates from executive management on our company's physical and cybersecurity efforts.


text: Risk Management and Strategy; Governance American Equity maintains a documented Information Security Risk Management Program ("Program") that includes risk assessments regularly conducted by American Equity and third-party experts, assessors and auditors to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. The Program is integrated into the Company's overall risk management system. The Program is informed by industry standards and frameworks and is evaluated on an ongoing basis to address the evolving cyber threat landscape and seek alignment with industry standards such as applicable legal and regulatory guidance and mandates. In addition, the Company regularly self-assesses the Program against its internal policies.

companyName: American National Group Inc.

ticker: ANG-PD


text: As part of the Program, the Company: deploys technical and organizational safeguards designed to protect the Company's networks, systems, and data from cybersecurity threats; maintains a threat management program that continuously monitors evolving cybersecurity risks; has established and maintains incident response plans that address the Company's response to a cybersecurity incident; maintains a third-party risk management program that includes a due diligence and ongoing assessment process for service providers based on the risk they present and the adequacy of their safeguards; and provides ongoing education and training to employees regarding information security threats. The Company also conducts periodic penetration testing and tabletop exercises.


text: The American Equity Chief Information Security Officer provides oversight and direction for the Program and communicates the information security risk posture and the prevention, detection, mitigation, and remediation of cybersecurity incidents to the American Equity executive team and American Equity's Board of Directors. The Board oversees the Program and management of risks from cybersecurity threats and reviews and monitors American Equity's business and technology strategy.


text: As of the reporting date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: Risk Management and Strategy; Governance The Company maintains a documented Information Security Risk Management Program ("Program") that includes risk assessments regularly conducted by the Company and third-party experts, assessors and auditors to evaluate potential security threats that may have a negative impact on the organization, detect potential vulnerabilities and mitigate any identified security risks. The Program is integrated into the Company's overall risk management system. The Program is informed by industry standards and frameworks and is evaluated on an ongoing basis to address the evolving cyber threat landscape and seek alignment with industry standards such as applicable legal and regulatory guidance and mandates. In addition, the Company regularly self-assesses the Program against its internal policies.


text: As part of the Program, the Company deploys technical and organizational safeguards designed to protect the Company's networks, systems, and data from cybersecurity threats; maintains a threat management program that continuously monitors evolving cybersecurity risks; has established and maintains incident response plans that address the Company's response to a cybersecurity incident; maintains a third-party risk management program that includes a due diligence and ongoing assessment process for service providers based on the risk they present and the adequacy of their safeguards; and provides ongoing education and training to employees regarding information security threats. The Company also conducts periodic penetration testing and tabletop exercises.


text: The Company's Chief Information Security Officers, experienced information systems security professionals with many years of experience across a variety of technology sub-specialties, provide oversight and direction for the Program and regularly communicates the information security risk posture and the prevention, detection, mitigation, and remediation of cybersecurity incidents to the Company's executive team and the Company's Audit and Risk Management Committee. Our Chief Information Security Officers and The Audit and Risk Management Committee oversees the Program and management of risks from cybersecurity threats and reviews and monitors the Company's business and technology strategy.


text: As of the reporting date, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See also Item 1A "Risk Factors - Risks Relating to Our Business and Industry - We rely on the use of technology, and as a result, we are exposed to the risks of cybersecurity attacks and other systems disruptions."


text: We have an enterprise-wide information security program designed to assess, identify, and manage the Company's information security risks and identify, evaluate, respond to and resolve information security incidents. To protect our information systems from information security incidents, we use various processes and tools to identify, prevent, detect, escalate, investigate, resolve and recover from identified vulnerabilities and threats. These include, but are not limited to, reporting, monitoring and detection tools that are widely used in the industry, and internal solutions. We have an enterprise-wide Incident Response Policy and Incident Response Procedure, which outlines the various points and detailed processes and procedures to be followed when a suspected incident is identified. The overall Incident Response Objectives are to: a. Accurately investigate and validate the incident b. Minimize damage or loss of data and services for the Company, our clients, users,employees, and other potentially affected individual data subjects, as appropriate c. Preserve and/or collect evidence pursuant to the incident in a legally sound manner e. Review evidence to determine next steps, including notifications where necessary or advisable f. Document and implement post incident actionable recommendations to prevent incident reoccurrence and improve the incident response process We assess our cybersecurity maturity and readiness utilizing the CIS (Center for Internet Security) Critical Security Controls, and measure our ongoing progress against this framework to identify areas of opportunity for improvement to our overall cybersecurity readiness.

companyName: PETMED EXPRESS INC

ticker: PETS


text: We continually evaluate cybersecurity threats and our ability to monitor for or mitigate against these threats based on information from our vendors, partners, and our own internal research and exposures. As we are undergoing multiple system upgrades and digital transformation efforts, we will be further evaluating and implementing security measures and best practices in our new systems as we phase out legacy systems. We conduct regular scans, penetration, and vulnerability testing as part of our overall security practice, and as part of our Payment Card Industry Digital Security Standard (PCI-DSS) compliance. Our auditors perform an independent analysis on parts of our information security practices, predominantly in their assessment of our PCI compliance. We regularly conduct cybersecurity training for our employees, including training for some of the most common breach vectors seen in the industry. For our key partners who help develop or key vendors who provide information systems or have access to our information systems, we require security training or review their information security practices.


text: We from time to time use our Incident Response Procedures to respond to potential cybersecurity incidents and threats, as our systems and users identify areas of potential incidents during the course of normal operations, none of which to date we believe have been material. We cannot provide assurance that there will not be future incidents that may materially impact us, our financials, our strategy, or our operations. For more cybersecurity risks, see "Our failure or the failure of third-party service providers to protect our websites, networks, and systems against cybersecurity incidents, or otherwise to protect our confidential information, could damage our reputation and brands and substantially harm our business, financial condition, and results of operations" under Item 1A "Risk Factors."


text: The Company's Board of Directors, as a whole, has oversight responsibility for our strategic and operational risks. The Audit Committee of the Board of Directors is responsible for board-level oversight of cybersecurity risk, and the Audit Committee regularly reports risks and compliance actions to the Board. As part of its' oversight role, the Audit Committee receives reporting about the Company's strategy, programs, incidents and threats, and other developments and action items. These action items include receiving updates on the status of remediation efforts for any non-compliance or risk items related to cybersecurity regularly throughout the year, including through periodic updates from management.


text: PetMed Express, Inc. ("PetMeds") and PetCareRx maintains an enterprise-wide cybersecurity program designed to identify, assess, manage, and mitigate information security risks across the organization. Our program encompasses governance, policy, prevention, detection, incident response, and recovery mechanisms in alignment with industry standards.


text: Cybersecurity Risk Management and Oversight Our cybersecurity risk management program is built to protect our systems, data, and customers from a wide range of cyber threats. This includes internal protocols and controls, as well as third-party oversight. Our cybersecurity practices are guided by the National Institute of Standards and Technology (NIST) CSF (Cyber Security Framework), and categorizes cybersecurity tasks into five key functions: identify, protect, detect, respond, and recover. This functional orientation helps organizations make informed decisions about reducing cyberattacks.


text: Oversight of cybersecurity risk is formally overseen by the Audit Committee of our Board of Directors. The Audit Committee receives regular briefings from management on cybersecurity topics, including strategy, threats, incident trends, remediation activities, and updates on material developments, as appropriate.


text: Incident Detection and Response We have implemented an Incident Response Policy and detailed procedures that govern how potential cybersecurity events are identified, escalated, investigated, contained, and remediated. The objectives of our incident response program include: • Timely investigation and validation of incidents • Minimization of data loss or service disruption • Evidence preservation in accordance with legal and regulatory requirements • Restoration of affected systems and services • Post-incident review and implementation of corrective actions • Notification to affected parties and regulators, where appropriate These procedures are tested and exercised periodically to ensure preparedness and adaptability.


text: Security Measures and Monitoring We deploy a layered defense model using widely adopted technologies and internal solutions for threat monitoring, detection, and response. Our efforts include: • Regular system scans, vulnerability assessments, and penetration testing • Ongoing compliance with the Payment Card Industry Data Security Standard (PCI DSS) • Deployment of endpoint detection and response (EDR) tools and real-time monitoring solutions • Secure development practices and controls embedded within our digital transformation initiatives As we modernize our digital platforms and phase out legacy systems, we are embedding advanced security practices into our infrastructure. This includes improving controls around identity management, access, encryption, and software development life cycles.


text: Third-Party and Vendor Risk Management Our vendor and partner management processes include security due diligence, contractually required safeguards, and—in relevant cases—direct review of their cybersecurity practices. We require certain vendors with access to sensitive systems or data to undergo security training or meet specific security certification requirements.


text: Training and Awareness Cybersecurity awareness is a foundational element of our risk management approach. We conduct recurring cybersecurity training for employees across the company, with tailored modules that address evolving threat vectors such as phishing, ransomware, and social engineering. Additional targeted training is provided to users in high-risk roles.


text: Cybersecurity Incidents We maintain an active process to detect and respond to cybersecurity incidents. While we have experienced routine threats and minor incidents in the normal course of operations, to date, we have not identified any cybersecurity incidents that have materially impacted our business, operations, or financial results.


text: Nevertheless, we recognize that cybersecurity risks are dynamic and continually evolving. We cannot guarantee that future events will not have a material impact. For more information on cybersecurity-related risks, see Item 1A, "Risk Factors", including the risk titled: "Our failure or the failure of third-party service providers to protect our websites, networks, and systems against cybersecurity incidents, or otherwise to protect our confidential information, could damage our reputation and brands and substantially harm our business, financial condition, and results of operations."


text: We place the utmost importance on the security of our systems and the data we handle. We maintain a comprehensive process for identifying, assessing, and managing material risks from cybersecurity threats as part of our broader risk management system and processes.

companyName: PIXELWORKS, INC

ticker: PXLW


text: To identify and assess risks from cybersecurity threats, we evaluate a variety of developments including threat intelligence, vulnerabilities of third parties, including any auditors or consultants who advise on our cybersecurity systems, evolving regulatory requirements, and observed cybersecurity incidents, among others. We regularly conduct risk assessments to evaluate the maturity and effectiveness of our systems and processes in addressing cybersecurity threats and to identify any areas for remediation and opportunities for enhancements. The results of such assessments are evaluated by management and reported to our board of directors and the audit committee, and we adjust our cybersecurity policies, standards, processes, and practices as necessary.


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The audit committee receives regular reports and updates on cybersecurity matters from the leaders of our dedicated security team and management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the audit committee reviews and discusses with management our policies and programs with respect to the audit committee's oversight of cybersecurity threats, which enable the audit committee's effective oversight of our overall cybersecurity risk and compliance posture. The audit committee regularly reports to the board of directors on these matters.


text: We have a dedicated security team led by our Director of Worldwide IT, who, in coordination with management, including our Chief Executive Officer, Chief Financial Officer, and Chief Legal Officer, monitors the prevention, detection, mitigation, and remediation of cybersecurity threats and incidents in accordance with our incident response and recovery plans. Threats and incidents that are identified as potentially significant are promptly reported to the audit committee. Our dedicated security team has over 20 years of experience in managing and monitoring corporate cybersecurity programs.


text: While risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for further information regarding cybersecurity risks.


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats and directly oversees our cybersecurity policies and practices, internal controls regarding information security, and compliance with legal and regulatory requirements regarding cybersecurity risks. The audit committee receives regular reports and updates on cybersecurity matters from the leaders of our dedicated security team and management, including developments on existing and new cybersecurity risks and how management is addressing and/or mitigating such risks, cybersecurity and data privacy incidents (if any), the status of key information security initiatives, vulnerability assessments, as well as on existing and emerging threat landscapes. Additionally, on at least an annual basis, the audit committee reviews and discusses with management our policies and programs with respect to the audit committee's oversight of cybersecurity threats, which enable the audit committee's effecting oversight of our overall cybersecurity risk and compliance posture. The audit committee regularly reports to the board of directors on these matters.


text: While risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition, We cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. See "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K for further information regarding cybersecurity risks.


text: Risk Management and Strategy The Company's business and proprietary information, information technology and operational technology assets are important to its success. The Company's cybersecurity program is designed to protect its information assets and operations from external and internal cyber threats by seeking to mitigate and manage risks while helping to ensure business resiliency. The program is applied across all levels of the Company.

companyName: SL GREEN REALTY CORP

ticker: SLG


text: The Company takes a risk-based approach to cybersecurity and has implemented policies that are designed to address cybersecurity threats and incidents, including those related to third-party service providers. The Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities and tests those systems pursuant to the Company's cybersecurity standards, processes and practices, as part of the Company's overall risk management system. The Company also leverages external resources and advisors as needed to reinforce its cybersecurity capacity. External consultants perform testing exercises to further assess the Company's cybersecurity program on an annual basis, or more frequently if circumstances warrant such testing.


text: The Company's cybersecurity strategy is guided by prioritized risk, the National Institute for Standards and Technology (NIST) Cybersecurity Framework, and emerging business needs. The Company maintains a cybersecurity incident response plan, as well as a monitoring program, to support senior leadership and the Board.


text: The Company's cybersecurity team manages its incident response plan and monitoring program. Company employees are provided cybersecurity awareness training, which includes topics on the Company's policies and procedures for reporting potential incidents. The Company's cybersecurity team is focused on evaluating emerging risks, regulations, and compliance matters and updating the policies and procedures accordingly.


text: To date, cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and we believe are not reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Our business and operations would suffer in the event of system failures or cyber security attacks" in Part I, Item 1A. "Risk Factors" for additional description of cybersecurity risks and potential related impacts on the Company.


text: The Board oversees the Company's risk management process directly and through its committees. Pursuant to the Audit Committee Charter, the Audit Committee of the Board provides compliance oversight to the Company's risk assessment and risk management policies and the steps management has taken to monitor and mitigate such exposures and risks.


text: The Company's Senior Director, Information Security & Network Systems, in coordination with the Senior Vice President, Information Technology, is responsible for leading the assessment and management of cybersecurity risks. The Senior Director, Information Security & Network Systems and Senior Vice President, Information Technology regularly review and assess cybersecurity initiatives and are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents through briefings with internal and external personnel as well as alerts from security measures deployed in the Company's IT environment. These individuals collectively have over 30 years of experience in information security. The Senior Vice President, Information Technology reports to the Board, the Audit Committee and management on cybersecurity risk assessment, policies, incident prevention, detection, mitigation, and remediation of cybersecurity incidents on an as needed basis.


text: Risk Management and Strategy The Company's business and proprietary information, information technology and operational technology assets are important to its success. The Company's cybersecurity program is designed to protect its information assets and operations from external and internal cyber threats by seeking to mitigate and manage risks while helping to ensure business resilience. The program is applied across all levels of the Company.


text: Cybersecurity Risk Management Program Information security and data privacy have been and remain of the utmost importance to the Company in light of the value we place on maintaining the trust and confidence of our consumers, employees and other stakeholders.

companyName: YUM BRANDS INC

ticker: YUM


text: We have a risk-based cybersecurity risk management program (the "Program") in place designed to assess, identify and manage material risks from cybersecurity threats. The Program falls under the oversight of our Chief Information Security Officer ("CISO") and defines controls for access management, data protection and vulnerability detection, in addition to incident response protocols which are discussed further in the "Governance" section herein. The Program incorporates customized elements from industry-leading standards to drive robust and comprehensive protection.


text: To supplement our own internal processes and controls, we regularly engage consultants and other third parties as part of our Program, including to periodically: • Test our information security defenses and to perform external penetration assessments; • Review and assess the Program and its maturity; and • Advise our Board of Directors and management regarding the structure and oversight of the program, incident response services and various cybersecurity related matters We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers and their information systems. As part of these processes, we conduct cybersecurity due diligence around significant third-party service providers who access our information technology systems before their engagement. We require third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations. Additionally, we obtain System and Organization Controls ("SOC") 1 or SOC 2 reports on an annual basis from vendors that host our significant financial applications to aid in our assessment of information security risk associated with our relationship with the host vendor. If a host vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess information security risk associated with the relationship.


text: Over 98% of our restaurants are owned and operated by franchisees who themselves are at risk of cyber-attacks or security incidents. There is limited direct connectivity between the Company's network and the networks on which our franchisees operate. We have established minimum information security standards for our franchisees, which are in process of being adopted.


text: Despite the security measures implemented as part of our Program, the current cyber threat environment presents increased risks for all companies, and we are a frequent target of cyber-attacks and have experienced security incidents. For example, on January 18, 2023, the Company announced a ransomware attack that impacted certain Information Technology ("IT") systems. This incident resulted in the closure of fewer than 300 restaurants in one market for one day, and certain of the Company's IT systems and data were affected. In addition, although data was taken from our network, the affected data was limited to certain personal information of former and current employees, and we have no evidence that customer databases were accessed.


text: We have incurred, and may continue to incur, certain expenses related to this attack, including expenses to respond to, remediate and investigate this matter. In addition, several separate putative class actions have been filed in U.S. federal and state court by current and/or former employees alleging violations of privacy and other rights in connection with the ransomware incident.


text: We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For additional information regarding the risks to us associated with cybersecurity incidents, see Item 1A. "Risk Factors".


text: The Company's cybersecurity risk management processes are integrated into the Company's overall risk management processes. The Board of Directors has overall responsibility for the oversight of the Company's risk management and has delegated the oversight of specific risk-related responsibilities to certain Board committees. The Audit Committee oversees the Company's business and financial technology risk exposure, which includes data privacy and data protection, information security and cybersecurity, as well as the controls in place to monitor and mitigate these risks.


text: At a management level, our Program is led by our CISO, who reports to the Company's Chief Digital and Technology Officer. Our CISO has expertise in cybersecurity risk management through, among other things, his past service in information security roles at the Company, prior IT and security leadership positions at other public companies, and certain technology and information security matters certifications. Additionally, we have a formal data privacy management committee made up of privacy professionals, operational experts and specialist legal counsel which is overseen by our Chief Legal Officer.


text: We have a Data Incident Response Plan ("the Plan") which provides for controls and procedures in connection with cybersecurity events including escalation procedures as summarized below. Under the Plan, we have established a Data Incident Response Team (the "Response Team"), a cross-functional group comprised of certain members of senior management, including our Chief Legal Officer and CISO. The Plan provides that the Response Team is responsible for assessing, investigating and responding to any cybersecurity event elevated for its consideration by our CISO.


text: In addition, under the Plan, we have established a cross-functional management group comprised of our Chief Legal Officer, Chief Financial Officer, Vice President Internal Audit, Vice President Compliance, Senior Vice President Finance & Corporate Controller and CISO. The Plan provides that any cybersecurity incident that is elevated for the review of the Response Team will also be reviewed by this group to determine whether any such incident is material for securities laws purposes and whether public disclosure is required or advisable in connection therewith, following any necessary consultation with the Company's senior management, Disclosure Committee, Audit Committee and/or Board of Directors.


text: Our CISO and Chief Digital and Technology Officer advise the Audit Committee at least four times a year, and the Board of Directors regularly, on our management and oversight of information security risks, including data privacy and data protection risks. The Audit Committee also receives periodic updates on data privacy from members of management within our data privacy group in addition to the regular updates from our CISO. The Audit Committee provides a summary to the full Board at each regular Board meeting of the information security risk review together with any other risk related subjects discussed at the Audit Committee meeting.


text: To supplement our own internal processes and controls, we regularly engage consultants and other third parties as part of our Program, including to periodically: • Test our information security defenses and to perform external penetration assessments; and • Review and assess the Program and its maturity We also have processes to oversee and identify material cybersecurity risks associated with our use of third-party service providers and their information systems. As part of these processes, we conduct cybersecurity due diligence around significant third-party service providers who access our information technology systems before their engagement. We require third-party service providers to promptly notify us of any actual or suspected breach impacting our data or operations. Additionally, we obtain Type 1 and Type 2 System and Organization Controls ("SOC") 2 reports on an annual basis from vendors that host our significant financial applications to aid in our assessment of information security risk associated with our relationship with the host vendor. If a host vendor is not able to provide a SOC 2 report, we take additional steps to assess information security risk associated with the relationship.


text: The vast majority ( 98 %) of our restaurants are owned and operated by franchisees who themselves are at risk of cyber-attacks or security incidents. Whilst some of those franchisees do operate their restaurants utilizing the Company's networks and systems, many use networks and systems which they manage themselves. In such instances, there is limited direct connectivity between the networks that the Company manages and the networks which our franchisees manage. We have established minimum information security standards for our franchisees through our Franchise Agreement Policy Manuals and Brand Standards and those minimum information security standards are in the process of being adopted.


text: At a management level, our Program is led by our CISO, who reports to the Company's Chief Digital and Technology Officer. Our CISO has expertise in cybersecurity risk management through, among other things, over 30 years of information security experience, prior CISO and security leadership positions at other public companies, and certain technology and information security matters certifications. Additionally, we have a formal data privacy management committee made up of privacy professionals, operational experts and specialist legal counsel which is overseen by our Chief Legal Officer.


text: In addition, under the Plan, we have established a cross-functional management group comprised of our Chief Legal Officer, Chief Financial Officer, Chief Digital and Technology Officer, Vice President Internal Audit, Chief Compliance Officer, Senior Vice President Finance & Corporate Controller and CISO. The Plan provides that any cybersecurity incident that is elevated for the review of the Response Team will also be reviewed by this group to determine whether any such incident is material for securities laws purposes and whether public disclosure is required or advisable in connection therewith, following any necessary consultation with the Company's senior management, Disclosure Committee, Audit Committee and/or Board of Directors.


text: Our CISO and Chief Digital and Technology Officer advise the Audit Committee at least four times a year, and the Board of Directors regularly, on our management and oversight of information security risks and data protection risks. The Audit Committee also receives periodic updates on data privacy from members of management within our data privacy group in addition to the regular updates from our CISO. The Audit Committee provides a summary to the full Board at each regular Board meeting of the information security risk review together with any other risk related subjects discussed at the Audit Committee meeting.


text: Urban One has implemented a structured approach to assessing, identifying, and managing cybersecurity risks. This framework includes ongoing monitoring of threats, the implementation of security controls, and proactive adaptation to evolving risks. Our cybersecurity strategy is designed to safeguard corporate assets, data, and critical systems while ensuring operational resilience.

companyName: URBAN ONE, INC.

ticker: UONE