text: Cybersecurity oversight begins with the Information Technology & Information Security Committee ("IT/IS Committee") of the Wintrust Board of Directors. The Wintrust Chief Security Officer ("CSO") and Deputy Chief Information Security Officer ("Deputy CISO") oversee the cybersecurity program. The CSO has a dual reporting structure, reporting to both the IT/IS Committee and the Vice Chairman/Chief Operating Officer of Wintrust. The CSO and Deputy CISO, each with extensive industry experience, manage a team of skilled professionals with cybersecurity expertise. This team governs our cybersecurity program that follows seven pillars: strategy; prevention, detection, response, measurement, compliance, and training. Our cybersecurity program employs a wide range of technological, administrative, and physical security measures designed to address the confidentiality, integrity, and availability of the information and data of both Wintrust and our customers. We have established policies, processes and procedures to monitor, report and respond to suspected or actual security events. A critical function of the cybersecurity program is the Security Operations Center, which is constantly monitoring Wintrust systems to detect threats. If any credible threats are detected, the Security Operations Center notifies both the CSO and Deputy CISO, and the appropriate response plan is initiated. The CSO will advise executive management and other relevant stakeholders as necessary. We coordinate with our third parties and vendor partners through assessments and due diligence before sharing or allowing the hosting of data. We also work with our outside partners to investigate security events that may have impacted our confidential and other information, and to leverage lessons learned during those investigations. In addition, we contractually require our third-party service providers that possess or process any Wintrust or customer information to adhere to certain security requirements, controls and responsibilities based on the risk profile of the relationship.


text: Wintrust also recognizes that individual employees are frequent targets of threat actors. We regularly engage with employees on the importance of protecting the information and data of Wintrust, our customers and employees through monthly newsletters, posters and ad-hoc communications. If specific threats are identified, management may communicate those threats directly to employees for heightened awareness. Our cybersecurity program requires employees to review information security and privacy policies annually, complete multiple cybersecurity training courses throughout the year, and participate in monthly mock phishing campaigns. We also communicate with our customers about their role in enhancing cybersecurity.

companyName: WINTRUST FINANCIAL CORP

ticker: WTFC

secItem: Item 1C


text: Governance In addition to our dedicated cybersecurity team, Wintrust's approach to cybersecurity is supported by dedicated risk management and internal audit teams. Our governance program maintains policies and standards, which are validated through risk-based assessments, reviews and testing. The CSO reports at regular intervals to the Wintrust Enterprise Risk Management Committee, the IT/IS Committee, and the Audit Committee of the Wintrust Board of Directors, as well as the full Wintrust Board of Directors, as necessary. The Audit Committee performs an annual review of our cybersecurity program, which includes a discussion of management's actions to identify and detect threats and incident plans in the event of a response or recovery situation. The Audit Committee receives an annual review that includes enhancements to the cybersecurity program and management's progress on its cybersecurity strategic roadmap. In addition, the Board of Directors receives quarterly cybersecurity reports, which include a review of key performance indicators, test results and related remediation, and an overview of recent threats and how the Company is managing those threats. For more information on the material risks that cybersecurity threats pose to us, please see our risk factor disclosures under Item 1A of this Annual Report on Form 10-K.


text: Notwithstanding the extensive approach we take to cybersecurity, Wintrust continues to face risks and accompanying threats that could have a material adverse effect on the enterprise. We work to manage these risks and threats on a daily basis. To date, we have not realized any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have, or are reasonably likely to, materially affect us, our business strategy, results of operation or financial condition. We continue to invest in our cybersecurity program, the resiliency of our networks and work to enhance our internal controls.


text: Protection of Client Information Data privacy and cybersecurity laws and regulations concerning the collection, storage, handling, use, disclosure, transfer, protection and other processing of client information (including personal information) affect many aspects of the Company's business, and are continuing to evolve. Data privacy and cybersecurity are currently areas of considerable legislative and regulatory attention, with new or modified laws, regulations, rules and standards frequently being adopted and potentially subject to divergent interpretation or application in a manner that may create inconsistent or conflicting requirements for businesses.


text: We are, or may in the future become, subject to a variety of complex federal, state and local laws, regulations, rules and standards regarding data privacy and cybersecurity, including the privacy and information safeguarding provisions of the Gramm-Leach-Bliley Act ("GLB Act"), the Fair Credit Reporting Act ("FCRA") and the amendments adopted by the Fair and Accurate Credit Transactions Act of 2003, as well as various state laws and regulations. The GLB Act requires a financial institution to, among other things, disclose its privacy policy to certain customers and, in some circumstances, enables certain customers to opt-out of certain sharing of the customers' nonpublic personal information with nonaffiliated third parties. The GLB Act also requires financial institutions to implement a comprehensive information security program that includes administrative, technical and physical safeguards to ensure the security and confidentiality of customer information. In accordance with these requirements, we and each of our banks and operating subsidiaries provide a written privacy notice to each affected customer when the customer relationship begins and, to the extent required, on an annual basis. As described in the privacy notice, we endeavor to protect the security of information (including personal information) about our customers, educate our employees about the importance of protecting customer privacy, and allow affected customers to opt-out of certain types of information sharing. We and our subsidiaries also require business partners with which we share information (including personal information) to have adequate security safeguards and to follow the requirements of the GLB Act. The GLB Act, as interpreted by the federal banking regulators, and state laws and regulations require us to take certain actions, including providing notice under certain circumstances to affected customers, in the event that sensitive or personal customer information is compromised. We and/or each of the banks and operating subsidiaries may need to amend our privacy policies and adapt our internal procedures in the event that these legal requirements, or the regulators' interpretation of them, change, or if new requirements are added. Additionally, the federal banking regulators, as well as the SEC and related self-regulatory organizations, regularly issue guidance regarding cybersecurity that is intended to enhance cyber risk management among financial institutions.


text: Data privacy and cybersecurity also are areas of increasing state legislative focus. For example, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA") applies to covered businesses that conduct business in California and meet certain revenue or personal information collection thresholds. The CCPA contains several exemptions, including that many, but not all, requirements of the CCPA are inapplicable to personal information that is collected, processed, sold or disclosed pursuant to the GLB Act. The CCPA imposes obligations on covered companies, broadly defines personal information, expands California residents' rights with respect to personal information, and provides for civil penalties for violations. The CCPA may be interpreted or applied in a manner inconsistent with our understanding, resulting in further uncertainty and potentially requiring us to incur additional costs and expenses in an effort to comply with these requirements. Similar laws have been adopted by other states where we do business, or may in the future do business. At least four such laws (in Virginia, Colorado, Connecticut and Utah) took effect in 2023. In addition, laws in all 50 U.S. states generally require businesses to provide notice under certain circumstances to consumers whose personal information has been disclosed as a result of a data breach. Moreover, the federal government has recently considered, and is currently considering, various proposals for more comprehensive data privacy and cybersecurity legislation, to which we may be subject if passed.


text: Like other lenders, the banks and several of our operating subsidiaries use credit bureau data in their underwriting activities. Use of such data is regulated under the FCRA, and the FCRA also regulates, among other things, reporting information to credit bureaus, prescreening individuals for credit offers, sharing of information (including personal information) between affiliates, and using affiliate data for marketing purposes. Similar state laws and regulations may impose additional requirements on us, the banks and our operating subsidiaries.


text: Further, in the spring of 2022, the Federal Reserve, OCC, and FDIC adopted a new regulation that requires a banking organization to notify its primary federal regulators as soon as possible and within 36 hours after identifying a "computer-security incident" that the banking organization believes in good faith is reasonably likely to materially disrupt or degrade its business or operations in a manner that would, among other things, jeopardize the viability of its operations, result in customers being unable to access their deposit and other accounts, result in a material loss of revenue, profit or franchise value, or pose a threat to the financial stability of the United States. The rule also imposes requirements on bank service providers to notify their affected banking organization customers of certain computer-security incidents.


text: Violation of these laws, rules, regulations and standards may expose us to regulatory action and private litigation, including claims for damages and penalties. For more information regarding the risks associated with data privacy and cybersecurity laws and regulations, see "We are subject to complex and evolving laws, regulations, rules, standards and contractual obligations regarding data privacy and cybersecurity, which could increase the cost of doing business, compliance risks and potential liability" and "We face cybersecurity risks from cyber-attacks, information security breaches and other similar incidents that could result in the disclosure of confidential and other information (including personal information), all of which could adversely affect our business or reputation, and create significant legal and financial exposure" under Risk Factors in Item 1A.


text: Cybersecurity is a significant and integrated component of the Company's risk management strategy, designed to protect the confidentiality, integrity, and availability of sensitive information contained within the Company's information systems. The Company is exposed to cybersecurity threats and incidents that are aimed at gaining unauthorized access to bank systems as a way to misappropriate assets and sensitive information, corrupt and destroy data, or cause operational disruptions. While we have experienced and identified cybersecurity threats, there has been no incident which has had a material effect on the Company's business strategy, results of operations or financial condition.

companyName: CARVER BANCORP INC

ticker: CARV


text: The Company maintains a comprehensive information technology and cybersecurity program which includes frameworks, policies, and procedures to prevent or limit the impact of cybersecurity threats and incidents. The program includes administrative, technical and physical safeguards to help ensure the security and confidentiality of customer records and information. The Bank's Information Security Officer and Vice President of Information Technology is responsible for implementation of the information technology security program, while the management team is responsible for administering and enforcing the policies and procedures in the program. Third party vendors are utilized to help validate our security posture and controls, and we have developed a third party vendor management program to assess and monitor risks arising from third party vendor systems. In addition, the Board of Directors and Information Security Planning Committee (ISPC) is responsible for the risk management oversight and ensuring that the processes are being implemented and functioning as designed. The ISPC Committee provides monthly reports and updates to the Board of Directors. The Board of Directors and/or ISPC Committee approves updates relating to substantial changes in technology related policies and procedures and reviews the status of Business Continuity Programs, Testing plans and results on no less than an annual basis.


text: While the Company, with the help of third-party service providers, has implemented security technology and established operational procedures designed to prevent or limit the impact of cybersecurity threats and incidents, such events may still occur and safeguards may not fully protect our systems from comprises or breaches which could have a material adverse effect on Carver's financial condition and results of operations.


text: RISK MANAGEMENT AND STRATEGY The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, employee and customer data. Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. Our team maintains processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management approach. Our team regularly reviews significant risks to our Company, including significant cybersecurity risks and the potential for future cybersecurity incidences. Through these reviews, we discuss the identified risks, describe the likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external third-party service provider to support our cybersecurity team, continuously monitoring and identifying potential threats with the ability to take immediate mitigation actions when required. In addition to these services we conduct periodic network penetration tests conducted by an independent third party.

companyName: CARRIAGE SERVICES INC

ticker: CSV


text: We undertake to align our cybersecurity approach, which encompasses both enterprise security and operational security, along with the standards of the National Institute of Standards and Technology Cybersecurity Framework. We maintain continuous cyber threat-detection systems and have established an incident response plan, which contains playbooks for addressing and recovering from potential material cyberattacks and breaches of data security. We also have controls in place to ensure any third-party access to our internal systems adhere to internal cybersecurity safeguards, as well as firewalling any access from such third-parties, including service providers, through a secure virtualization layer. In addition to security measures for third-party service providers, we require periodic training covering cybersecurity and information management and conduct regular cybersecurity awareness campaigns.


text: Except with respect to our previously disclosed ransomware attack to our information technology system in January 2021, which we determined, based on our assessment of the information known to us, did not have, nor do we expect it will have, a material impact on our business, operations or financial results, we are not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on our business operations. Given the rapid evolution of cyber-related attack techniques, cybersecurity risks associated with our information technology systems and the systems of our vendors continue to grow. Notwithstanding our cybersecurity management processes, a future cybersecurity incident could have a material adverse effect on our business or on our financial position, results of operations or cash flows. See "Item 1A. Risk Factors - General Risks – Information Technology and Internal Controls - We rely significantly on information technology and any failure, inadequacy, interruption or security lapse of that technology, including any cybersecurity incidents could harm our ability to operate our business effectively."


text: We involve multiple levels of oversight as a part of our approach to cybersecurity risk management. Our Board oversees and regularly reviews risks to our Company, including cybersecurity, along with related policies and procedures. These reviews include updates from our management team and periodic executive sessions with our Chief Information Officer ("CIO") covering cybersecurity matters, such as developments to our program, key risk indicators, emerging risks, and identified incidents.


text: In addition, our CIO, who has more than 25 years of industry experience and over 10 years of experience with the development, training and controls of effective enterprise cybersecurity programs, oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes: (i) reviewing our enterprise risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities; and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. Additionally, we maintain an experienced information technology team at the employee level that supports our CIO in implementing our cybersecurity program and internal reporting, security and mitigation functions.


text: RISK MANAGEMENT AND STRATEGY The Company's cybersecurity program is designed to secure the continuity of operations and protect the privacy of company, employee and customer data. Our approach to managing cybersecurity risk and safeguarding information across our organization embeds data protection and cybersecurity risk management throughout our enterprise and daily operations. Our team maintains processes for identifying, assessing and managing material risks, including such risks from cybersecurity threats, and such processes are integrated into our overall risk management approach. Our team regularly reviews significant risks to our Company, including significant cybersecurity risks and the potential for future cybersecurity incidences. Through these reviews, we discuss the identified risks, describe the likelihood of occurrence and assess its potential impact, including the materiality thereof. As part of this exercise, mitigating measures are planned and implemented into action as necessary. As an additional feature of our cybersecurity risk management process, we have engaged an external third-party service provider to support our cybersecurity team, continuously monitoring and identifying potential threats with the ability to take immediate mitigation actions when required. In addition to these services, we conduct periodic network penetration tests conducted by an independent third-party.


text: In addition, our CIO, who has more than 25 years of industry experience and over 15 years of experience in designing and implementing cyber threat detection and mitigation strategies that adhere to NIST and ISO 27001 standards, along with the development, training and controls of effective enterprise cybersecurity programs. Additionally, our CIO oversees the implementation and compliance of our cybersecurity program and mitigation of information security related risks. Such oversight includes: (i) reviewing our enterprise risk register; (ii) maintaining adequate processes to manage the identified risks under our cybersecurity program; (iii) regularly analyzing logs of cybersecurity threats and vulnerabilities; and (iv) overseeing prevention, detection, mitigation and remediation efforts in general, including the development and maintenance of the above-mentioned incident response plan. We also maintain an experienced information technology team at the employee level that supports our CIO in implementing our cybersecurity program and internal reporting, security and mitigation functions.


text: We acknowledge the increasing importance of cybersecurity in today's digital and interconnected world. Cybersecurity threats pose significant risks to the integrity of our systems and data, potentially impacting our business operations, financial condition and reputation.

companyName: Wenyuan Group Corp.

ticker: WYGC


text: As a smaller reporting company, we currently do not have formalized cybersecurity measures, a dedicated cybersecurity team or specific protocols in place to manage cybersecurity risks. Our approach to cybersecurity is in the developmental stage, and we have not yet conducted comprehensive risk assessments, established an incident response plan or engaged with external cybersecurity consultants for assessments or services.


text: Given our current stage of cybersecurity development, we have not experienced any significant cybersecurity incidents to date. However, we recognize that the absence of a formalized cybersecurity framework may leave us vulnerable to cyberattacks, data breaches and other cybersecurity incidents. Such events could potentially lead to unauthorized access to, or disclosure of, sensitive information, disrupt our business operations, result in regulatory fines or litigation costs and negatively impact our reputation among customers and partners.


text: We are in the process of evaluating our cybersecurity needs and developing appropriate measures to enhance our cybersecurity posture. This includes considering the engagement of external cybersecurity experts to advise on best practices, conducting vulnerability assessments and developing an incident response strategy. Our goal is to establish a cybersecurity framework that is commensurate with our size, complexity and the nature of our operations, thereby reducing our exposure to cybersecurity risks.


text: In addition, the Board will oversee any cybersecurity risk management framework and a dedicated committee of the Board or an officer appointed by the Board will review and approve any cybersecurity policies, strategies and risk management practices.


text: Despite our efforts to improve our cybersecurity measures, there can be no assurance that our initiatives will fully mitigate the risks posed by cyber threats. The landscape of cybersecurity risks is constantly evolving, and we will continue to assess and update our cybersecurity measures in response to emerging threats.


text: For a discussion of potential cybersecurity risks affecting us, please refer to the "Risk Factors" section of this Annual Report.


text: As its reliance on information technology systems and data has increased, the Company obtained cybersecurity insurance and utilizes third party risk assessments.

companyName: SPINDLETOP OIL & GAS CO

ticker: SPND


text: Cyber Risk Management & Strategy As part of its overall risk management system, the Company utilizes a third party to assess the Company's processes and practices for managing and mitigating cybersecurity risks.


text: The Company focuses on building cybersecurity awareness with its employees and other end-users through training and security exercises and communicates the Company's expectations of employees and contractors with respect to cybersecurity matters. The Company uses third-party cybersecurity professionals to review and assess the Company's cybersecurity controls and procedures.


text: Although the Company has implemented policies and procedures to try to protect against cyber-attacks, there can be no assurance that they will be effective in avoiding disruption and business impacts. See Item 1A, Risk Factors for related discussion.


text: Cyber Expertise and Experience The Company relies on third party cybersecurity professionals to provide risk assessments to help assess cybersecurity risks.


text: Cyber Governance & Oversight Members of management report to the Company's Board of Directors regarding cybersecurity matters, including the cyber risk assessments performed for the Company. As part of its risk oversight responsibility, the Board oversees our policies and strategies for mitigating cybersecurity risks.


text: SecureTech's Board of Directors actively oversees risks, including cybersecurity threats, as part of its risk management function. However, currently, there are no dedicated processes or committees specifically informing the Board of Directors about these risks. Given our company's size and current operations, we consider the risk of significant cybersecurity incidents to be minimal.

companyName: Securetech Innovations, Inc.

ticker: SCTH


text: SecureTech believes it has adequate processes and systems to maintain the confidentiality of its communications and records. Given our current level of sales and small number of employees, we do not perceive cybersecurity threats as a material risk at this time. However, SecureTech presently lacks formal processes for assessing, identifying, and managing cybersecurity risks directly or through third-party service providers. Additionally, we have not engaged any assessors, consultants, auditors, or other third parties concerning cybersecurity matters.


text: As of May 1, 2024, we have not encountered any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. Nevertheless, we acknowledge that complete risk elimination is challenging, and undetected incidents may still occur.


text: Board Oversight: SecureTech's Board of Directors actively oversees risks, including cybersecurity threats, as part of its risk management function. However, there are no dedicated processes or committees specifically informing the Board of these risks. Given our company's size and current operations, we consider the risk of significant cybersecurity incidents minimal.


text: Current Processes: We believe we have adequate processes and systems to maintain the confidentiality of our communications and records. Given our current sales level and small number of employees, we do not perceive cybersecurity threats as a material risk at this time. However, SecureTech lacks formal processes for assessing, identifying, and managing cybersecurity risks directly or through third-party service providers. Additionally, we have not engaged any assessors, consultants, auditors, or other third parties regarding cybersecurity matters.


text: Incident History: As of March 31, 2025, we have not encountered any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business, results of operations, or financial condition. Nevertheless, we acknowledge that completely eliminating risk is challenging, and undetected incidents may still occur.


text: Cyber Risk Management & Strategy As part of its overall risk management system, the Company utilizes a third party to help assess the Company's processes and practices for managing and mitigating cybersecurity risks.


text: The Company focuses on building cybersecurity awareness with its employees and other end-users through training and security exercises and communicates the Company's expectations of employees and contractors with respect to cybersecurity matters.


text: The Company uses third-party cybersecurity professionals provided in conjunction with its cybersecurity insurance to review and assess the Company's cybersecurity controls and procedures.


text: Cyber Expertise and Experience The Company relies on third party cybersecurity professionals to provide risk assessments to help assess cybersecurity risks. The Company provides cybersecurity training for its employees through a third party.


text: Cybersecurity Risk Management and Strategy Our cybersecurity strategy prioritizes detection, analysis, and response to known, anticipated or unexpected cybersecurity threats; effective management of cybersecurity risks; and resiliency against incidents. Our cybersecurity risk management processes include technical security controls, policy enforcement mechanisms, monitoring systems, team member training, contractual arrangements, tools and related services from third-party providers, and management oversight to assess, identify and manage material risks from cybersecurity threats. We implement risk-based controls to protect our information, the information of our customers, vendors, and other third parties, our information systems and our business operations. Multi-factor authentication and principles of "Zero Trust" are integral to our control environment. We have adopted security-control principles based on the Payment Card Industry Data Security Standard and the CIS Critical Security Controls Cybersecurity Framework, other industry-recognized standards, and contractual requirements, as applicable. We leverage industry associations, third-party benchmarking, results from internal and third-party audits, threat intelligence feeds, and other similar resources to inform our cybersecurity processes and plans.

companyName: HIBBETT INC


text: We maintain cybersecurity programs that include physical, administrative, and technical safeguards, and we maintain plans and procedures with the objective of helping us prevent and timely and effectively respond to cybersecurity threats or cybersecurity incidents. Through our defense strategy and cybersecurity risk management process, we continuously monitor cybersecurity vulnerabilities and potential attack vectors to Company systems. We evaluate the potential operational and financial effects of any threat and of cybersecurity countermeasures made to defend against such threats. We integrate our cybersecurity practices into our Enterprise Risk Management ("ERM") program, which is overseen by our Audit Committee and provides central, standardized frameworks for identifying and tracking cyber-related business and compliance risks across the Company. In addition, we periodically engage third-party consultants to assist us in assessing, enhancing, implementing, and monitoring our cybersecurity risk management programs and responding to any incidents. This process includes regular penetration and vulnerability testing.


text: We have developed a formal Incident Response Plan focused on: 1) preparation, 2) detection and analysis, including determination of materiality, 3) containment, eradication, and recovery, and 4) post-incident analysis. We maintain and enforce Company level information system security policies that include possible disciplinary actions for violations.


text: As part of our cybersecurity risk management process, we conduct "tabletop" exercises during which we simulate cybersecurity incidents to ensure that we are prepared to respond to such an incident and to highlight any areas for potential improvement in our cybersecurity incident preparedness. Third-party specialists may be involved in these exercises, which are conducted at both the technical level and senior management level. Historically, certain members of our Board of Directors have participated as well. Learnings from these exercises are incorporated into our Incident Response Plan. In addition, all team members are required to pass mandatory cybersecurity training courses on a regular basis and receive phishing simulations to provide "experiential learning" on how to recognize phishing attempts. Training is administered and tracked through online learning modules and is supplemented by regular Company communications on cybersecurity topics.


text: We have established a cybersecurity supply chain risk management program, which is a cross-functional program that forms part of our ERM program and is supported by our security, compliance, and supply chain organizations. Through this evolving program, we assess the risks from cybersecurity threats that impact select suppliers and third-party vendors with whom we share personal identifying and confidential information. This cyber risk assessment is performed for applicable third-party vendors during the vendor onboarding process and the results are factored into our risk-based vendor selection decision. We continue to evolve our oversight processes to mature how we identify and manage cybersecurity risks associated with the products or services we procure from such suppliers. We generally require that our suppliers adopt and maintain security-control principles based on industry-recognized standards.


text: We do not believe that any risks we have identified to date from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. However, notwithstanding our processes, policies and procedures designed to monitor and mitigate the risks of cybersecurity threats, there can be no assurance that we or third parties with which we interact will not experience a cybersecurity incident that materially affects us in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise. See "Risks Related to Technology" in "Risk Factors" of this Form 10-K.


text: Our Board of Directors has general oversight responsibility for our strategic and business risk management and has delegated cybersecurity risk management oversight to the Audit Committee, which reports on its activities and findings to the full Board after each quarterly meeting. Our Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which the company is or may be exposed and to implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: Management is responsible for identifying, assessing, and managing cybersecurity risks on an ongoing basis, establishing processes to ensure that cybersecurity risk exposures are monitored, establishing appropriate mitigation measures, maintaining cybersecurity policies and procedures, and providing regular reports to our Board of Directors, including through the Audit Committee. Our Senior Vice President and Chief Information Officer ("CIO"), who has over 30 years of industry experience, leads our cybersecurity program and is supported by our Information Security Officer and team members holding relevant certifications. The CIO reports to the Audit Committee on cybersecurity risks at each of its quarterly meetings. These reports include assessments of cybersecurity risks, the current and emerging threat landscape, updates on any incidents, and reports on our investments in cybersecurity risk mitigation and governance.


text: The Audit Committee has identified two of its members, Ramesh Chikkala and Karen Etzkorn, both with expertise in cybersecurity risk management, as cybersecurity professionals. Furthermore, the Audit Committee has designated Ms. Etzkorn to meet regularly with management to review our cybersecurity strategy, key initiatives and progress toward our objectives. In the event of a potentially material cybersecurity event, the Chair of the Audit Committee would be notified and briefed, and meetings of the Audit Committee and/or full Board of Directors would be held, as appropriate.


text: The Company has policies, controls, and procedures in place for assessing, identifying, and managing material risks from cybersecurity threats, including, but not limited to: • Reviewing financial reporting systems and subsystems to ensure that access is limited to approved users; • Reviewing data recorded, processed, and reported to ensure that the data remains complete, accurate, and valid; • Conducting regular network and endpoint monitoring and vulnerability assessments to improve our information systems; • Reviewing system changes of financial reporting significance to ensure that they have been authorized and appropriately tested before being moved to production; • Monitoring and identifying cybersecurity threats in connection with the use of third-party providers; • Responding to and remediating any incident of damage or interruption to our information technology systems, including cyberattacks, internally and through the use of third-party providers as necessary; • Carrying information security risk insurance that provides protection against potential losses arising from a cybersecurity incident; and • Requiring regular cybersecurity training programs for employees, management, and directors. These approaches vary in maturity across our business, and we work to continually improve them.

companyName: WILLIS LEASE FINANCE CORP

ticker: WLFC


text: The Company's Board of Directors and management have discussions to stay vigilant and engaged as it relates to cyber exposures, risk management strategy, monitoring, and cyber-incident response and recovery plans. Members of the Board of Directors have access to, and relationships with, cybersecurity experts in the organization, including the Company's Head of Information Technology, who has extensive experience in network operations and an understanding of cybersecurity. Additionally, as the dynamic cybersecurity environment is continuously evolving, management has periodic meetings with our cybersecurity insurance providers to reevaluate the Company's cybersecurity risks and related information technology resiliency. The Board of Directors shall be informed of any material information technology breaches that the Company has experienced in a timely manner.


text: RISK MANAGEMENT AND STRATEGY The Company has policies, controls, and procedures in place for assessing, identifying, and managing material risks from cybersecurity threats, including, but not limited to: • Reviewing financial reporting systems and subsystems to ensure that access is limited to approved users; • Reviewing data recorded, processed, and reported to ensure that the data remains complete, accurate, and valid; • Conducting regular network and endpoint monitoring and vulnerability assessments to improve our information systems; • Reviewing system changes of financial reporting significance to ensure that they have been authorized and appropriately tested before being moved to production; • Monitoring and identifying cybersecurity threats in connection with the use of third-party providers; • Responding to and remediating any incident of damage or interruption to our information technology systems, including cyberattacks, internally and through the use of third-party providers as necessary; • Carrying information security risk insurance that provides protection against potential losses arising from a cybersecurity incident; and • Requiring regular cybersecurity training programs for employees, management, and directors. These approaches vary in maturity across our business, and we work to continually improve them.


text: We have developed and implemented a comprehensive multi-layered cybersecurity risk management program, consisting of a dedicated cybersecurity function, risk assessments, policies and procedures managed by internal and external resources, that we believe is reasonably designed to prevent, detect and respond to cyber risks and incidents. We utilize a set of tools and services, including regular network, endpoint and cloud monitoring, vulnerability assessments, penetration testing, SIEM, and tabletop exercises to identify and assess material risks from cybersecurity threats and to evaluate our cyber defense capabilities.

companyName: ENTERPRISE BANCORP INC /MA/


text: Internal security controls are designed to align with standards set by the NIST. We monitor emerging data protection laws, conduct background checks of our employees in specific technology and cybersecurity roles, apply least privilege access to users, test the maturity and readiness of our cybersecurity program, conduct table top exercises based on current threat scenarios to increase awareness, conduct phishing testing, provide cybersecurity training to our Board and employees, and provide cybersecurity alerts to our customers on ongoing threats. We monitor notifications and alerts from the FS-ISAC and other industry cybersecurity sites to stay abreast of the most recent cybersecurity alerts.


text: Enterprise Risk Management Process Integration The Company has implemented layered security approaches for all electronic delivery channels to detect, prevent and respond to rising cybersecurity risks. Management utilizes a combination of third-party information security assessments, key technologies, and ongoing internal and external evaluations to provide a level of protection of non-public personal information, to continually monitor and attempt to safeguard information on its operating systems, in cloud-based solutions, and those of third-party service providers, and to prevent, quickly detect and respond to attacks. The Company also utilizes firewall technology, multi-factor authentication, complex password construction, and a combination of software and third-party monitoring to detect and prevent intrusion, and cybersecurity threats, guard against unauthorized access, and continuously identify and prevent computer viruses on the Company's information solutions. To minimize debit card losses, the Company works with a third-party provider to establish parameters for allowable transaction activity, monitor transactions, and alert customers of potentially fraudulent activity.


text: The Bank maintains a written Information Security Program based on a collection of information security policies, regulatory requirements, standards, guidelines, processes, procedures, third-party recommendations, and industry best practices. The purpose of this Program is to establish a company-wide approach for assessing and protecting the integrity, availability, and confidentiality of the Bank's information assets.


text: Third-party Access The Company has a fully integrated third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Under the program, risk ratings are assigned to each of the vendors based on an assessment of the vendor and its access to networks, systems, and confidential information. An assessment is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to our systems or customer data must have appropriate technical and organizational security measures and security control principles based on commercially acceptable security standards, and we require third parties in this class to agree by contract to manage their cybersecurity risks.


text: In our Risk Factors, we describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition.


text: Material Incidents We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. We, and the third parties that we engage, are subject to constant and evolving threats of attack and cybersecurity incidents may be more difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.


text: Incidents and Risks The Company has developed an Incident Response Plan to guide its actions in responding to real and suspected information security incidents. This includes unlawful, unauthorized, or unacceptable actions that involve a computer system or a computer network such as Distributed Denial of Service attacks, Corporate Account Takeover schemes, or ransomware. Additionally, an event that disrupts one of the Bank's service channels, whether from a security incident or not, is also considered an incident requiring a response under this program. These disclosure controls and procedures compel the Company to make accurate and timely disclosures of material events and incidents to both customers and regulatory authorities. The reaction to an incident aims to reduce potential damage and loss and to protect and restore confidence through timely communication and the restoration of normal operating conditions for computers, services, and information. Management will work closely with its cybersecurity insurance provider, cybersecurity legal counsel, and forensic experts when investigating and responding to cyber or ransomware attacks.


text: Cybersecurity Governance Cybersecurity risk management processes are an integral part of our enterprise risk management which is overseen by the Board and the Technology & Information Security Committee of the Board. The Board oversees the risk management policies of the Company and is responsible for the periodic review and approval of the risk management policies of the company and provides general oversight over the information security and technology programs. The TISC oversees the technology and cybersecurity strategies and their alignment with business strategies, the effectiveness of the information security program, monitors the results of third-party testing and risk assessments and responses to breaches of customer data, among other project management, cybersecurity, and business continuity oversight functions. The Committee meets five times during the year, or more as needed. An information security advisor participates in the meetings and is available to provide additional insights into cybersecurity methodologies, best practices, threat trends, and resource planning.


text: The CISO has over 17 years of banking experience, is a Certified Information Systems Security Professional, and has been involved with the management of information and cybersecurity for over ten years. The CISO regularly reports to the Board Technology & Information Security Committee on information and cybersecurity strategy, testing, training, policies, procedures, cybersecurity insurance, and overall effectiveness of the Information Security Program and would report and discuss material incidents, and ongoing mitigation status, if any should occur. The CISO is the chair of Management's Information Security Committee that meets on a monthly basis to evaluate threats, incidents, defense system effectiveness, accepted risks, results of third-party cyber assessments and engagements, and the overall adequacy of the cybersecurity program. In addition, the Chief Information Officer has over 15 years of experience in managing bank technologies, information security, and risk management, and collaborates in supporting the Information Security Program. The CISO reports directly to the Chief Risk Officer and meets on a monthly basis with the Executive Management team to discuss cybersecurity risk management matters.


text: We have developed and implemented a comprehensive multi-layered cybersecurity risk management program, consisting of a dedicated cybersecurity function, risk assessments, policies and procedures managed by internal and external resources, that we believe is reasonably designed to prevent, detect and respond to cyber risks and incidents. We utilize a set of tools and services, including regular network, endpoint and cloud monitoring, vulnerability assessments, penetration testing, a Security Information and Event Management system, and tabletop exercises to identify and assess material risks from cybersecurity threats and to evaluate our cyber defense capabilities.


text: Internal security controls are designed to align with standards set by the National Institute of Standard and Technology. We monitor emerging data protection laws, conduct background checks of our employees in specific technology and cybersecurity roles, apply least privilege access to users, test the maturity and readiness of our cybersecurity program, conduct table top exercises based on current threat scenarios to increase awareness, conduct phishing testing, provide cybersecurity training to our Board and employees, and provide cybersecurity alerts to our customers on ongoing threats. We monitor notifications and alerts from the Financial Services Information and Analysis Center and other industry cybersecurity sites to stay abreast of the most recent cybersecurity alerts.


text: Third-party Access The Company has a fully integrated third-party risk management program to identify, assess, monitor and mitigate risks associated with third-party relationships, including cybersecurity risks. Under the program, risk ratings are assigned to each of the vendors based on an assessment of the vendor, for a variety of factors, including its access to networks, systems, and confidential information. An assessment is conducted on each vendor to identify and measure the risks from cybersecurity threats that could impact our customer's data and our environment. Third parties that have access to our systems or customer data must have appropriate technical and organizational security measures and security control principles based on commercially acceptable security standards, and we require third parties in this class to agree by contract to manage their cybersecurity risks.


text: Material Incidents We are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. Although we have a robust cybersecurity program that is designed to assess, identify, and manage material risks from cybersecurity threats, we cannot provide absolute surety that we have properly identified or mitigated all vulnerabilities or risks of incidents. We, and the third parties that we engage, are subject to constant and evolving threats of attack and cybersecurity incidents may be difficult to detect for periods of time. A cybersecurity incident could harm our business strategy, results of operations, financial condition, reputation, and/or subject us to regulatory actions or litigation which may result in fines, judgments or indictments.


text: In October 2024, the Company hired a new CISO who is a Certified Information Systems Security Professional with over 12 years in banking experience with a background in cybersecurity, information security, and network administration. The former CISO, who has over 18 years of banking experience, is a Certified Information Systems Security Professional, and has been involved with the management of information and cybersecurity for over ten years, was promoted to the Chief Risk Officer role in October 2024. The CISO regularly reports to the Board Technology & Information Security Committee on information and cybersecurity strategy, testing, training, policies, procedures, cybersecurity insurance, and overall effectiveness of the Information Security Program and would report and discuss material incidents, and ongoing mitigation status, if any should occur. The CISO is the chair of Management's Information Security Committee that meets on a monthly basis to evaluate threats, incidents, defense system effectiveness, accepted risks, results of third-party cyber assessments and engagements, and the overall adequacy of the cybersecurity program. In addition, the Chief Information Officer has over 15 years of experience in managing bank technologies, information security, and risk management, and collaborates in supporting the Information Security Program. The CISO reports directly to the Chief Risk Officer and meets on a monthly basis with the Executive Management team to discuss cybersecurity risk management matters.


text: We have processes in place for assessing, identifying, and managing material risks from potential unauthorized occurrences on or through our electronic information systems that could adversely affect the confidentiality, integrity, or availability of our information systems or the information residing on those systems. These include a wide variety of mechanisms, controls, technologies, methods, systems, and other processes that are designed to prevent, detect, or mitigate data loss, theft, misuse, unauthorized access, or other security incidents or vulnerabilities affecting the data. The data include confidential, proprietary, and business and personal information that we collect, process, store, and transmit as part of our business, including on behalf of third parties. We also use systems and processes designed to reduce the impact of a security incident at a third-party vendor or customer. Additionally, we use processes to oversee and identify material risks from cybersecurity threats associated with our use of third-party technology and systems, including: technology and systems we use for encryption and authentication; employee email; content delivery to customers; back-office support; and other functions.

companyName: AMAZON COM INC

ticker: AMZN


text: As part of our risk management process, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments. We also maintain a variety of incident response plans that are utilized when incidents are detected. We require employees with access to information systems, including all corporate employees, to undertake data protection and cybersecurity training and compliance programs annually.


text: We have a unified and centrally-coordinated team, led by our chief security officer, that is responsible for implementing and maintaining centralized cybersecurity and data protection practices at Amazon in close coordination with senior leadership and other teams across Amazon. Reporting to our chief security officer are a number of experienced chief information security officers responsible for various parts of our business, including AWS, each of whom is supported by a team of trained cybersecurity professionals. In addition to our extensive in-house cybersecurity capabilities, at times we also engage assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and mitigations are also subject to oversight by the Security Committee of our Board of Directors. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We Could Be Harmed by Data Loss or Other Security Breaches," which should be read in conjunction with the information above.


text: The Security Committee, which is comprised of independent directors, oversees our policies and procedures for protecting our cybersecurity infrastructure and for compliance with applicable data protection and security regulations, and related risks. The Security Committee receives reports regarding such risks from management, including our chief security officer, and reports to the Board at least annually. The Security Committee also oversees the Board's response to any significant cybersecurity incidents.


text: Our chief security officer, who has extensive cybersecurity knowledge and skills gained from over 15 years of work experience on the security team at Amazon and an extensive career in the technology and cybersecurity industries as a senior executive in the federal government, heads the team responsible for implementing and maintaining cybersecurity and data protection practices at Amazon and reports directly to the Chief Executive Officer.


text: Our cybersecurity risks and associated mitigations are evaluated by senior leadership, including as part of our enterprise risk assessments that are reviewed by the Audit Committee and our Board of Directors. Such risks and mitigations are also subject to oversight by the Security Committee of our Board of Directors. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "We Could Be Harmed by Data Loss or Other Security Incidents," which should be read in conjunction with the information above.


text: Risk Management and Strategy The Company has established an information security program and related processes for assessing, identifying, and managing material risks from cybersecurity threats to the Company, including governance at the executive and Board level of the Company's cyber risk management strategy and the controls designed to protect its operations. The Company's information security program is established at the executive level, with regular reporting to, and oversight by, the Company's Board of Directors (the "Board") as described below. At the highest level, the Company's program includes multi-layered governance by management, the Audit and Finance Committee of the Board and the Board, as described in greater detail below.

companyName: ABERCROMBIE & FITCH CO /DE/

ticker: ANF


text: The Company's policies and procedures identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated. The Company implements and maintains a set of controls to manage information risk, establishes guidelines for the use of information technology, and defines standards for identifying and mitigating information risks, considering controls from multiple security frameworks, such as the Center for Internet Security's Critical Security Control and the Payment Card Industry Data Security Standard. The Company, internally and through third parties, conducts multiple information risk assessments each year. Risks identified in such assessments are considered for inclusion in the Company's information risk portfolio and are then prioritized and addressed where appropriate through the Company's broader information security programs. Assessments along with risk-based analysis and judgment are used by the Company to determine what the Company believes to be the optimal way to manage these risks.


text: In addition, the Company's Incident Response Plan ("IRP") provides an outline for the Company on how to identify and address a significant cybersecurity incident. The IRP includes certain steps to be taken by the Information Security team to, among other things, assess the severity of an incident, determine the appropriate escalation, and mitigate or remediate the incident. The IRP is intended to serve as a framework to aid the Information Security team and other corporate functions in coordinating the Company's response to an incident in order to minimize the impact on the Company's business and operations, as well as the affected parties.


text: The Company also conducts cybersecurity exercises and training. For example, certain corporate associates and management-level associates in our stores and distribution centers must complete cybersecurity training on an at least annual basis, which educates the associates on the Company's policies and procedures for the handling of customer and employee personal data, incident reporting, and avoiding common cybersecurity threats such as phishing attacks. In addition, targeted training for corporate associates occurs throughout the year, and regular audiences include associates on the Company's marketing, data analytics, and user experience teams. The Company's management holds annual executive data incident tabletop exercises and the information security team holds more frequent technical tabletop exercises.


text: The Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company's information security program, including to conduct risk assessments and penetration testing. The Company uses a variety of processes to address cybersecurity threats related to the use of third-party technology and services, such as conducting risk assessments of third-party vendors where the Company has determined it to be appropriate.


text: The Company (or the third parties on which it relies) may not be able to fully, continuously, and effectively implement security controls as intended. As described above, we utilize a risk-based approach and judgment to determine the security controls to implement and it is possible we may not implement sufficient controls if we do not recognize or underestimate a particular risk. In addition, security controls, no matter how well designed or implemented, may only partially mitigate and not fully eliminate risks. Events, when detected by security tools or third parties, may not always be immediately understood or acted upon.


text: Board Governance and Management Cybersecurity risk is managed as an enterprise risk in the Company's enterprise risk management process. Responsibility for risk oversight and management generally lies with the Company's Board. To effectively manage oversight of our cybersecurity risk management practices, since 2019 the Board has delegated such responsibility to the Company's Audit and Finance Committee. The Company's Chief Information Security Officer ("CISO") and the Information Security team provide reports to either the Audit and Finance Committee or the Board on a quarterly basis on various matters, such as current and emerging cybersecurity risks to the Company, risks and incidents that were escalated to management during the prior quarter (including those that did not require immediate escalation to the Audit and Finance Committee and/or full Board), internal and external assessments of the Company's information security program, and a roadmap of projects and major initiatives to manage its information security posture.


text: At the executive and management level, the CISO has primary responsibility for the architecture, implementation, and management of the Company's information security program. The CISO has approximately two decades of experience in technology risk management, including over a decade with the Company, and has passed examinations and received certifications as a SANS Global Information Security Leader and a Certified Information Systems Auditor. The CISO reports directly to the Company's Chief Digital and Technology Officer. The Company's Information Security team, under the direction of the CISO, implements and provides governance and functional oversight for cybersecurity controls and services. Information Security processes include escalation of certain risks and incidents, including those that originate or occur at third parties, to the CISO and the executive team as appropriate based on the severity or potential severity. In addition, regular updates from the Information Security team, in conjunction with real-time escalation on an as-needed basis, are also used to assess the risk landscape and adjust the Company's strategy and roadmap to address such risk.


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. See ITEM 1A. RISK FACTORS for additional information regarding the Company's cybersecurity risks and which should be read in conjunction with this Item 1C.


text: Risk Management and Strategy The Company has established an information security program and related processes for assessing, identifying, and managing material risks from cybersecurity threats to the Company, including governance at the executive and Board level of the Company's cyber risk management strategy and the controls designed to protect its operations. The Company's information security program is managed at the executive level, with regular reporting to, and oversight by, the Board as described below. The Company's program includes multi-layered governance by management, the Audit and Finance Committee of the Board and the Board, as described in greater detail below.


text: The Company's policies and procedures identify how cybersecurity measures and controls are developed, implemented, and regularly reviewed and updated. The Company implements and maintains a set of controls to manage information risk, establishes guidelines for the use of information technology, and defines standards for identifying and mitigating information risks. The controls are developed based on risk assessments and a review of controls from multiple security frameworks, such as the Center for Internet Security's Critical Security Control and the Payment Card Industry Data Security Standard. The Company, internally and through third parties, conducts multiple information risk assessments each year. Risks identified in such assessments are considered and evaluated for inclusion in the Company's information risk portfolio and are then prioritized and addressed where appropriate to update the Company's information security programs. Assessments, along with risk-based analysis and judgment, are used by the Company to determine how it should manage these risks.


text: The Company leverages third-party security firms in different capacities to implement or operate various aspects of the Company's information assets and information security program, including to conduct risk assessments and penetration testing. The Company uses a variety of processes to address cybersecurity threats associated with third parties, including our use of third-party technology and services, such as conducting risk assessments and reviewing contractual requirements where the Company has determined it to be appropriate.


text: Board Governance and Management Cybersecurity risk is managed as an enterprise risk in the Company's enterprise risk management process. Responsibility for risk oversight and management generally lies with the Company's Board. To manage oversight of our cybersecurity risk management practices, since 2019 the Board has delegated such responsibility to the Company's Audit and Finance Committee. The Company's Chief Information Security Officer ("CISO") and the Information Security team provide reports to either the Audit and Finance Committee or the Board on a quarterly basis on various matters, such as current and emerging cybersecurity risks to the Company, risks and incidents that were escalated to management during the prior quarter (including those that did not require immediate escalation to the Audit and Finance Committee and/or full Board), internal and external assessments of the Company's information security program, and a roadmap of projects and major initiatives to manage its information security posture. Abercrombie & Fitch Co.


text: Although the risks from cybersecurity threats have not materially affected our business strategy, results of operations, or financial condition to date, they may in the future and we continue to closely monitor cyber risk. See " ITEM 1A. RISK FACTORS " for additional information regarding the Company's cybersecurity risks and which should be read in conjunction with this Item 1C.


text: Risk Management Processes. We recognize the importance of assessing, identifying, and managing material risks from cybersecurity threats to our business and operations and developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems. As a result, we have integrated the management of cybersecurity threats into our broader risk management efforts, implementing policies and procedures to promote cybersecurity risk management and enhance mitigation efforts against cyber-attacks and similar threats. To help secure our systems that store or transmit electronic information, we have implemented multi-layered preventive controls which use aggregated intelligence to proactively detect, block and evaluate attacks. We also maintain a Chief Information Officer who is charged with implementing and overseeing our comprehensive written Information Security Program. In connection with our Information Security Program, we perform cybersecurity risk assessments at least annually to analyze the materiality of identified risks, the likelihood of such risks materializing, and the scope and intensity of adverse impacts if such risks result in the compromise of our information systems or sensitive information stored by us or on our behalf.

companyName: PENSKE AUTOMOTIVE GROUP, INC.

ticker: PAG


text: Our Information Security Program includes proactive measures to manage cybersecurity risks and threats, including mandatory annual security awareness training for all personnel with enhanced training for designated information security personnel; enterprise-wide phishing simulations and security assessments; a business continuity and recovery plan in the event of a cybersecurity incident; and the implementation of targeted access controls and various other measures, including multi-factor authentication, with respect to certain systems containing sensitive information. We have also implemented an incident response plan to guide our response to cybersecurity incidents, with a dedicated, cross-functional response team, including senior management from our information technology, information security, finance, risk management, investor relations and legal teams, responsible for overseeing efforts related to detection, containment, threat mitigation and notification, as appropriate. We identify vulnerabilities in our information systems through proactive scanning of system assets for known vulnerabilities. Our outsourced managed security source operates 24/7, identifying threats and vulnerabilities, and our information security team regularly monitors alerts and meets to discuss trends in cybersecurity threats. We proactively manage vulnerabilities from major software publishers through a global patching program. To prevent unauthorized access to our information systems, we have a system of controls in place to manage user access to our information systems. Our employees acknowledge an acceptable use policy and are trained in how to identify information security risks in the workplace.


text: Third Party Engagement and Oversight. We engage third-party service providers, including consultants and auditors, to monitor and protect critical assets from cyber-attacks and to enhance certain components of our Information Security Program, including to assist us with annual security assessments, penetration and vulnerability testing, email and web filtering, endpoint protection, and consultation on certain cybersecurity enhancements. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current. To oversee and identify cybersecurity threats associated with our use of third-party service providers, we periodically audit and review certain information security practices of critical vendors in possession of sensitive information, including through seeking responses to cybersecurity questionnaires. In the ordinary course of business, we also rely on contractual obligations from certain third-party service providers to meet certain information security standards and to notify and cooperate with us in the event of qualifying cybersecurity incidents.


text: Board of Directors Oversight. Our business is managed under the direction of our Board of Directors ("the Board"), which guides our long-term strategy and represents the highest level of oversight at the Company. Our Board views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities. To that end, the Board assures that we maintain robust corporate governance policies designed to promote our culture of uncompromised integrity that have been implemented in a manner that facilitates active oversight and engagement regarding various cybersecurity matters. Consistent with these policies, the Board receives updates regarding cybersecurity threats in connection with its regularly scheduled meetings, as appropriate, and as part of its ongoing strategy and risk management sessions, engages in discussions regarding cybersecurity threats to our operations. In addition to this direct oversight, the Board has delegated oversight responsibilities with respect to cybersecurity risks to the Audit Committee of the Board. In addition to its oversight of the quality and integrity of the Company's financial statements and internal audit functions, the Audit Committee is also responsible for reviewing the Company's key risk areas, including cybersecurity risks.


text: Management's Role in Managing Risk. As noted above, we have a designated Chief Information Officer who is charged with implementing and overseeing our comprehensive written Information Security Program. With over 25 years of experience in the field of information technology and cybersecurity, our Chief Information Officer brings a wealth of expertise to his role and maintains both Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA) certifications and additional personnel on our information security team have cybersecurity experience and certifications. Our Chief Information Officer's background includes extensive experience as an enterprise chief information officer and is well-recognized within our industry. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our Chief Information Officer reviews with senior management, at least quarterly, the status of our Information Security Program, identified threats to our data security, and cyber incidents relevant to our operations and reviews these matters with our Board and/or Audit Committee at least annually, or more frequently when appropriate. Further, at least quarterly, our senior leadership team, including our Chief Financial Officer, General Counsel, Chief Information Officer, Executive Vice President of Financial Services, and Global Risk Management, prepares a comprehensive summary of certain key risks facing the Company (the "Risk Report"). The Risk Report includes feedback from multiple constituencies within the Company, incorporating and evaluating heightened risk areas identified by senior management, functional area teams within the organization, and management at the regional and local dealership levels. In addition to various enterprise-wide risks identified throughout this management-led process, the Risk Report highlights cybersecurity risks, tasking the Chief Information Officer or his designees with the responsibility to monitor such risks and, as appropriate, implement risk mitigation strategies. The Risk Report also clarifies that both the Board and the Audit Committee retain oversight of such risks. The Risk Report is shared and discussed at least quarterly with the Audit Committee and periodically, with the full Board, with certain specified risks and mitigation efforts reported to the Board or designated standing committees on a more frequent basis, as appropriate.


text: We and others across our industry face a number of cybersecurity risks in connection with our business and operations. Although such risks have not materially affected our business strategy, results of operations, or financial condition to date, we have, from time to time, experienced threats to, and incidents in connection with, our information systems. Any security breach or event resulting in the unauthorized disclosure of our information or the information of our customers or the degradation of services provided by our critical business systems, whether by us directly or our third-party service providers, could adversely affect our business operations, sales, reputation with current and potential customers, associates, or vendors as well as other operational and financial impacts derived from investigations, litigation, the imposition of penalties, or other means. For more information about the cybersecurity risks we face, see the risk factors entitled "Information technology," "Cybersecurity" and "Regulatory Issues – Privacy Regulation" in discussed in Item 1A. Risk Factors.


text: Our Information Security Program includes proactive measures to manage cybersecurity risks and threats, including mandatory annual security awareness training for all personnel with enhanced training for designated information security personnel; enterprise-wide phishing simulations and security assessments; a business continuity and recovery plan in the event of a cybersecurity incident; and the implementation of targeted access controls and various other measures, including multi-factor authentication, with respect to certain systems containing sensitive information. We have also implemented an incident response plan to guide our response to cybersecurity incidents, with a dedicated, cross-functional response team, including senior management from our information technology, information security, operations, finance, risk management, investor relations and legal teams, responsible for overseeing efforts related to detection, containment, threat mitigation and notification, as appropriate. We identify vulnerabilities in our information systems through proactive scanning of system assets for known vulnerabilities. Our outsourced managed security source operates 24/7, identifying threats and vulnerabilities, and our information security team regularly monitors alerts and meets to discuss trends in cybersecurity threats. We proactively manage vulnerabilities from major software publishers through a global patching program. To prevent unauthorized access to our information systems, we have a system of controls in place to manage user access to our information systems. Our employees acknowledge an acceptable use policy and are trained in how to identify information security risks in the workplace.


text: Board of Directors Oversight. Our business is managed under the direction of our Board of Directors ("the Board"), which guides our long-term strategy and represents the highest level of oversight at the Company. Our Board views the identification and effective management of cybersecurity threats as a critical component of overall risk management and oversight responsibilities. To that end, the Board assures that we maintain robust corporate governance policies designed to promote our culture of uncompromised integrity that have been implemented in a manner that facilitates active oversight and engagement regarding various cybersecurity matters. Consistent with these policies, the Board receives updates regarding cybersecurity threats and events in connection with its regularly scheduled meetings, as appropriate, and as part of its ongoing strategy and risk management sessions, engages in discussions regarding cybersecurity threats to our operations. In addition to this direct oversight, the Board has delegated oversight responsibilities with respect to cybersecurity risks to the Audit Committee of the Board. In addition to its oversight of the quality and integrity of the Company's financial statements and internal audit functions, the Audit Committee is also responsible for reviewing the Company's key risk areas, including cybersecurity risks, and regularly receives updates regarding cybersecurity threats and incidents involving the Company or our vendors and suppliers.


text: Management's Role in Managing Risk. As noted above, we have a designated Chief Information Officer who is charged with implementing and overseeing our comprehensive written Information Security Program. With over 25 years of experience in the field of information technology and cybersecurity, our Chief Information Officer brings a wealth of expertise to his role and maintains both Certified Information Systems Security Professional (CISSP) and Certified Information Systems Auditor (CISA) certifications and additional personnel on our information security team have cybersecurity experience and certifications. Our Chief Information Officer's background includes extensive experience as an enterprise chief information officer and is well-recognized within our industry. Our Chief Information Officer reviews with senior management, at least quarterly, the status of our Information Security Program, identified threats to our data security, and cyber incidents relevant to our operations and reviews these matters with our Board and/or Audit Committee at least annually, or more frequently when appropriate. Further, at least quarterly, our senior leadership team, including our Chief Financial Officer, General Counsel, Chief Information Officer, Executive Vice President of Financial Services, and Global Risk Management, prepares a comprehensive summary of certain key risks facing the Company (the "Risk Report"). The Risk Report includes feedback from multiple constituencies within the Company, incorporating and evaluating heightened risk areas identified by senior management, functional area teams within the organization, and management at the regional and local dealership levels. In addition to various enterprise-wide risks identified throughout this management-led process, the Risk Report highlights cybersecurity risks, tasking the Chief Information Officer or his designees with the responsibility to monitor such risks and, as appropriate, implement risk mitigation strategies. The Risk Report also clarifies that both the Board and the Audit Committee retain oversight of such risks. The Risk Report is shared and discussed at least quarterly with the Audit Committee and periodically with the full Board, with certain specified risks and mitigation efforts reported to the Board or designated standing committees on a more frequent basis, as appropriate.


text: We and others across our industry face a number of cybersecurity risks in connection with our business and operations. Although such risks have not materially affected our business strategy, results of operations, or financial condition to date, we have, from time to time, experienced threats to, and incidents in connection with, our information systems. Any security breach or event resulting in the unauthorized disclosure of our information or the information of our customers or the degradation of services provided by our critical business systems, whether by us directly or our third-party service providers, could adversely affect our business operations, sales, reputation with current and potential customers, associates, or vendors as well as other operational and financial impacts derived from investigations, litigation, the imposition of penalties, or other means. For more information about the information technology and cybersecurity risks we face, see the risk factors entitled "We rely on third parties for the majority of our information systems and the availability and efficient operation of such systems is critical to the operation of our business," "Cybersecurity," and "Regulatory Issues – Privacy Regulation" in discussed in Item 1A. Risk Factors.


text: RISK MANAGEMENT AND STRATEGY We maintain a robust information security program that is designed to protect our information and the information of our customers. Our information security program is based on a recognized cybersecurity framework established by the National Institute of Standards and Technology ("NIST") and establishes controls to mitigate critical areas of cybersecurity risk. Our information security program has adopted all elements of the NIST cybersecurity framework, including the six functions of identify, protect, detect, respond, recover and govern, as well as each of the categories and control groups thereunder. This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST framework as a guide to ensure our information security program is designed to manage cybersecurity risks relevant to our business. Among other things, the cybersecurity controls in our information security program address information access rights, incident monitoring and response processes, information technology system configuration, network security, security architecture planning, mobile device security and compliance with information security policy requirements and protocols. These cybersecurity controls are designed to oversee, identify and mitigate risks from all cybersecurity threats, including those arising from our use of third-party service providers. Our cybersecurity controls are evaluated regularly by our internal information security team and we engage a third party examiner to assess the maturity of our information security program against the NIST cybersecurity framework no less frequently than bi-annually. Additionally, our information security program is assessed periodically by a federal regulator in the United States as part of its routine audit of the Company. In addition to our internal assessments, we also assess our third-party service providers on a regular basis using a risk-based approach that assigns a risk calculation to each such service provider. Results of our assessments are tracked and evaluated to ensure these third parties comply with our cybersecurity standards.

companyName: IRON MOUNTAIN INC

ticker: IRM


text: Our reputation for providing secure information storage to customers is critical to the success of our business, and protecting against material cyber risks is an integral part of maintaining that reputation. A successful cybersecurity breach could lead to theft or misuse of our or our customers' proprietary or confidential information or our employees' personal information and result in third-party claims against us, regulatory penalties and reputational harm. As part of our information security program, we also actively monitor emerging cyber attack patterns to develop custom detection capabilities and mitigation techniques to protect against material risk of cybersecurity threats. Upon encountering a cybersecurity incident, our information security team responds using our detailed cyber security incident response plan ("CSIRP"), which is based on industry best practices, relevant legal requirements and our contractual commitments. Among other things, the CSIRP sets forth the specific criteria used to assess a cybersecurity incident, mitigate risks of adverse consequences associated with any such incident, protocols to escalate the management of the incident and the process to inform our executive management team and any impacted functions of our business. All cybersecurity incidents are assessed to determine whether disclosure is required pursuant to any contractual or regulatory requirements and any material cybersecurity incident is also reported to our board of directors (our "Board"). To date, our information security program has been successful in protecting against risks from cybersecurity threats, and we have not had any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition.


text: Our risk management organization, which is led by our Chief Risk Officer, manages our information security program along with enterprise risk management, business continuity, internal audit and physical security. Our risk management team routinely reports on cybersecurity matters to our executive management team and our Board. Our Chief Information Security Officer, who reports directly to our Chief Risk Officer, leads a dedicated information security team that manages our information security program. The information security team is made primarily of full-time employees; however, we routinely engage consultants to provide supplemental labor and additional expertise in specific areas on an as-needed basis. Our information security team is organized based on industry best practices in alignment with NIST recommendations. All of the leaders in our information security team have over 10 years of cybersecurity experience and most of our information security staff maintain cybersecurity program certifications such as CMU Cybersecurity Executive Certification, ISACA Certifications (CISSP & CISM) and other relevant vendor certifications. Our information security team also regularly undergoes continuing education to ensure our implementation of best-in-class techniques.


text: Our Board reviews and discusses significant risks with executive management, including cybersecurity risk, that affect us. Although our executive management team and our Board work together on risk matters, our Board has the ultimate oversight authority over all enterprise risks, including cybersecurity risk. Our Board reserves the right to, and periodically does consult with third-party advisors and experts to assist our Board in understanding and anticipating future cybersecurity threats and trends. The risk and safety committee of our Board (the "RSC") is specifically tasked with reviewing and monitoring cybersecurity and information security risk, as well as the risk management strategies, systems and policies and processes implemented, established and reported on by our executive management team. The RSC is also primarily responsible for assisting our Board with oversight of our enterprise risk management program. As part of the risk management team, our Chief Information Security Officer reports key performance indicators of our information security program to the RSC at least three times a year to facilitate the committee's oversight of the effectiveness of the program through objective measurements, including metrics regarding software patching, IT asset management, cyber incident management and cybersecurity training. Reports by our Chief Information Security Officer also include detailed information on the activities of our cyber incident response team to allow for analysis of trends and the identification of any control gaps that require remediation.


text: Our executive management team, with oversight from our Board, is responsible for our enterprise risk management process and the day-to-day supervision and mitigation of enterprise risks, including cybersecurity risk. Our enterprise risk management program includes our executive management team receiving regular reports from our operations personnel. Our executive management team has established an enterprise risk committee (the "ERC"), which is chaired by our Chief Risk Officer and is otherwise comprised of each of our other executive vice presidents. The ERC oversees our risk and compliance activities to ensure that management has appropriate policies, structures and systems in place for managing risks of the business, including cybersecurity risk. Our executive management team reviews and prioritizes significant risks, allocates resources for risk mitigation. Our Chief Risk Officer and other members of our risk management team provide reports at each meeting of the RSC on areas of potential risks to us, including cybersecurity risk. We also maintain a business information security committee (the "ISC") with employee representation across geographies, business lines and business functions. The ISC includes a cross functional group of our employees with expertise and responsibilities in areas such as operations, digital product solutions, information technology, compliance, security, finance, privacy, internal audit and legal risk mitigation. The ISC is managed by our Chief Information Security Officer and meets regularly to receive updates on our cybersecurity posture, emerging risks and new cybersecurity capabilities. Members of the ISC act as points of contact during incident response activities to provide oversight and logistical support to the information security team.


text: RISK MANAGEMENT AND STRATEGY We maintain a robust information security program that is designed to protect our information and the information of our customers. Our information security program is based on a recognized cybersecurity framework established by the National Institute of Standards and Technology ("NIST") and establishes controls to mitigate critical areas of cybersecurity risk. Our information security program has adopted all elements of the NIST cybersecurity framework, including the six functions of identify, protect, detect, respond, recover and govern, as well as each of the categories and control groups thereunder. This does not imply that we meet any particular technical standards, specifications, or requirements, but only that we use the NIST framework as a guide to ensure our information security program is designed to manage cybersecurity risks relevant to our business. Among other things, the cybersecurity controls in our information security program address information access rights, incident monitoring and response processes, information technology system configuration, network security, security architecture planning, mobile device security and compliance with information security policy requirements and protocols. These cybersecurity controls are designed to oversee, identify and mitigate risks from all cybersecurity threats, including those arising from our use of third-party service providers. Our cybersecurity controls are evaluated regularly by our internal information security team, and we engage a third party examiner to assess the maturity of our information security program against the NIST cybersecurity framework no less frequently than bi-annually. Additionally, our information security program is assessed periodically by a federal regulator in the United States as part of its routine audit of the Company. In addition to our internal assessments, we also assess our third-party service providers on a regular basis using a risk-based approach that assigns a risk calculation to each such service provider. The results of our assessments are tracked and evaluated to ensure these third parties comply with our cybersecurity standards. We require all employees to undertake data protection and cybersecurity training and compliance programs annually.


text: Our reputation for providing secure information storage to customers is critical to the success of our business, and protecting against material cybersecurity risks is an integral part of maintaining that reputation. A successful cybersecurity breach could lead to theft or misuse of our or our customers' proprietary or confidential information or our employees' personal information and result in third-party claims against us, regulatory penalties and reputational harm. As part of our information security program, we also actively monitor emerging cyberattack patterns to develop custom detection capabilities and mitigation techniques to protect against material risk of cybersecurity threats. Upon encountering a cybersecurity incident, our information security team responds using our detailed cybersecurity incident response plan ("CSIRP"), which is based on industry best practices, relevant legal requirements and our contractual commitments. Among other things, the CSIRP sets forth the specific criteria used to assess a cybersecurity incident, mitigate risks of adverse consequences associated with any such incident, protocols to escalate the management of the incident and the process to inform our executive management team and any impacted functions of our business. All cybersecurity incidents are assessed to determine whether disclosure is required pursuant to any contractual or regulatory requirements and any material cybersecurity incident is also reported to our board of directors (our "Board").


text: To date, our information security program has been successful in protecting against risks from cybersecurity threats, and we have not had any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. Additional information about cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," under the heading "Attacks on our internal IT systems could damage our reputation, cause us to lose revenues, and adversely affect our business, financial condition and results of operations", which should be read in conjunction with the information above.