text: Management is responsible for, and is forming a committee tasked with, the operational oversight of company-wide cybersecurity strategy, policy, and standards across relevant departments to assess and help prepare us to address cybersecurity risks. Our contracted information technology consultant, supported by management, oversees the day-to-day implementation and management of our cybersecurity program. Our information technology consultant reports to the Chief Financial Officer, who currently operates as our head of information technology. Our information technology consultant has approximately 20 years of experience in information technology, and also leverages the experience of a third-party managed systems provider. Our information technology consultant regularly reports to the Chief Financial Officer as well as to other executive management, including our General Counsel, on cyber matters, as appropriate.


text: Risk Management and Strategy Our business depends on our continued ability to collect and safeguard vast amounts of personal and sensitive business information, including, among other types of data, protected health information (PHI), employee information, credit card information, insurance information, proprietary and confidential information about our business, financial information, trade secrets, intellectual property, and the sensitive and confidential information from the third parties with whom we work. We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, and hardware and software, to safeguard and prevent unauthorized access to this critical data (collectively Information Systems and Data).

companyName: Tempus AI, Inc.

ticker: TEM

secItem: Item 1C


text: Our Chief Technology Officer, or CTO, and our Chief Information Security Officer, or CISO, together with our Enterprise Risk Management Committee help identify, assess, and manage the Company's cybersecurity threats and risks. Working with a cross-functional team, these individuals and our Enterprise Risk Management Committee identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example, manual and automated tools, subscribing to reports and services that identify cybersecurity threats, analyzing reports of threats and actors, conducting scans of the threat environment, evaluating our and our industry's risk profile, evaluating threats reported to us, conducting internal and/or external audits, conducting vulnerability assessments to identify vulnerabilities, using external intelligence feeds, and third-party-conducted red/blue team testing and tabletop incident response exercises.


text: Our Information Security program has six broad components: Controls & Compliance; Security Operations; Cloud Security; Identity and Access Management; Application Security; and Data Governance. Within each program component, and depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: maintaining a vulnerability management policy and disaster recovery/business continuity plans, risk assessments, encryption of data, network security controls, data segregation, access controls, physical security, asset management, tracking and disposal, a vendor risk management program, a dedicated cybersecurity staff/officer, active monitoring, detection, prevention, mitigation, and remediation strategies to ensure we are adequately safeguarding and protecting our critical information, routinely conducting audits, vulnerability scans, penetration tests, social engineering simulations, security awareness training, and threat intelligence assessments to ensure that our systems, policies, and procedures are operating as intended. We also engage with a range of external experts to help us evaluate and attest to our risk management systems, including maintaining a certification pursuant to ISO 27001 and conducting periodic third-party audits to maintain our certification.


text: In addition, we maintain a detailed Incident Response Plan to assist in responding to potential cybersecurity threats. Our Incident Response Plan addresses critical aspects of incident management, including detection, impact analysis, containment, mitigation, remediation, recovery, and long-term strategies to prevent future incidents. Our Information Security and Privacy Teams conduct tabletop exercises twice per year to ensure preparedness for information security, including cybersecurity incidents. In addition, we promote a company culture of awareness and discipline in cybersecurity matters through annual employee training and education, including periodic phishing and social engineering simulations. We also maintain cybersecurity insurance coverage.


text: Our Privacy program is designed to support and enhance our Cybersecurity program. We perform an annual HIPAA Security Risk Assessment, among other things, to help identify remediation priorities and to ensure we have implemented best practices in storing and safeguarding PHI.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) the information security department works with management to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Enterprise Risk Management Committee evaluates material risks from cybersecurity threats against our overall business objectives and reports to the board of directors, which evaluates our overall enterprise risk.


text: We frequently collaborate with other third-party service providers to conduct regular audits, threat assessments, and consultation on cybersecurity strategy, enhancements, and best practices. We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, professional services firms, including legal counsel, cybersecurity software providers, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and cloud infrastructure providers. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires, review of the vendor's written security program, review of security assessments, and security assessment calls with the vendor's security personnel. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors" included elsewhere in this Annual Report on Form 10-K, including "Cyber-based attacks, security breaches, loss of data and other disruptions in relation to our information systems and computer networks could compromise sensitive information related to our business, prevent us from accessing it and expose us to substantial liability, which could adversely affect our business and reputation."


text: Our Board of Directors addresses the Company's cybersecurity risk management as part of its general oversight function. The Board of Directors' Audit Committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes as well as our Information Security program are implemented and maintained by certain Company management, including our CTO and our CISO, who have 25 years of experience in cybersecurity and IT Operations respectively. Our CTO and CISO collaborate with a cross-functional team of seasoned professionals responsible for maintaining, improving, and promoting our Information Security program. In addition to the oversight by our Technology and Security leaders, representatives from our Information Technology, Legal, Privacy, Finance, Regulatory, Quality, and Compliance teams are integral to the successful implementation of our overall Information Security program.


text: The CISO is responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, and communicating key priorities to relevant personnel. The CISO and CTO are responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our Incident Response Plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances. This team works with the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company's Incident Response Plan includes reporting to the Audit Committee of the board of directors for certain cybersecurity incidents.


text: Our CISO reports to the full Board of Directors quarterly, or more frequently as needed. These reports generally address each of the six components of our Information Security program, including the Company's progress on initiatives we have prioritized for the quarter. Our Audit Committee has general oversight responsibility for our data security practices, and we believe the Committee has the requisite skills and visibility into the risk profile of our Company to fulfill this responsibility effectively. Our CTO, CISO, or other members of our Enterprise Risk Management Committee report to the Audit Committee quarterly or on an as-needed basis.


text: Senior members of our management are responsible for assisting our CTO and CISO in managing cybersecurity risk. We maintain a cross-functional Enterprise Risk Management Committee, which meets monthly to identify, assess, mitigate, and remediate risks impacting the Company, including cybersecurity risks. Members of this committee include our CISO, CTO, Chief Financial Officer, Chief Privacy Officer, General Counsel, Chief Commercial Officer, Chief Scientific Officer, Chief Medical Officer, Chief Legal Officer, and the heads of our Regulatory and Quality teams. The Enterprise Risk Management Committee informs members of the Audit Committee regarding the overall enterprise risks identified by management, progress on remediation efforts identified in the prior quarter, and risk mitigation priorities for the forthcoming quarter.


text: As a global technology company, and the provider of electronic trading platforms and solutions for fixed-income and other securities, we view cybersecurity as fundamental to our business. Accordingly, we aim to appropriately secure all of our business operations, including information that we generate in the performance of our services, and data provided to us by third parties, including clients, vendors, business partners and employees.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Risk Management and Strategy The Company has adopted an Enterprise Risk and Resilience Framework (the "ERRF") to identify, assess, monitor, and manage the Company's risks, including cybersecurity risks. Our Chief Risk Officer (the "CRO") is responsible for implementing and executing the ERRF. The Company's information security and cybersecurity team is staffed with skilled professionals who manage the safeguarding of our information and is led by our Chief Information Security Officer (the "CISO"). This team is responsible for aligning our practices with the requirements of local regulations and the voluntary standards to which we strive to adhere, such as ISO/IEC 27001 and the National Institute of Standards and Technology ("NIST") Cybersecurity Framework. The CISO reports directly to our Chief Information Officer (the "CIO") and CRO. The CIO is responsible for designing and executing the Company's technology strategy, which includes overseeing the Company's cybersecurity strategy.


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERRF and are based on recognized frameworks established by NIST, the International Organization for Standardization ("ISO") and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the critical elements of the Company's overall ERRF approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed below in more detail under the heading "The Board's Oversight of Cybersecurity Risk," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee"), which regularly interacts with the Company's CRO, CIO, CISO and other members of management. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identification, protection, detection, response and recovery from cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys layered technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains its Information Security Incident Management Policy that addresses the Company's response to a cybersecurity incident, and such policy is tested and evaluated on a regular basis. The policy applies to all full- and part-time employees and contractors. The goal of the policy is to restore normal service operation as quickly as possible following an event, provide timely and accurate information to relevant stakeholders regarding such an event, as appropriate, and minimize the impact of such an event on our business operations. The policy is designed to ensure that we are meeting both our contractual and regulatory requirements related to cybersecurity events. • Data Collection, Use, Processing and Monitoring: The Company maintains policies and procedures relating to our data collection, use and processing activities, as well as mechanisms for monitoring our data systems and usage. We do not have individual retail clients and any gathering and maintaining of individual consumer data is very limited. We seek to maintain compliance with global data protection laws in the countries in which we operate, including the GDPR, the U.K. Data Protection regime and the California Consumer Privacy Act (the "CCPA"). • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats in order to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. In addition, the Company provides regular, mandatory training for personnel regarding key data privacy laws and the appropriate collection, use and storage of data.


text: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported, as appropriate, to the Risk Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We experience cybersecurity threats and incidents from time to time. However, as of the date of this report, we have not experienced a cybersecurity threat or incident that has materially affected the Company, including our business strategy, results of operations, or financial condition, in at least the last three years. While we are not currently aware of any risks from cybersecurity threats that are reasonably likely to materially affect the Company, please see Part I, Item 1A. – "Risk Factors – Malicious cyber-attacks, attempted cybersecurity breaches, and other adverse events affecting our operational systems or infrastructure, or those of third parties, could disrupt our businesses, result in the disclosure of confidential information, damage our reputation and cause losses or regulatory penalties."


text: The Board's Oversight of Cybersecurity Risk The Board recognizes the critical importance of maintaining the trust and confidence of our clients, business partners and employees. The Board is actively involved in oversight of the Company's ERRF, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Board is responsible for overseeing the Company's risk management processes over the short-, medium- and long-term by staying informed of the Company's material risks and evaluating whether management has reasonable controls in place to address such material risks. As part of its oversight responsibilities, the Board dedicates meaningful time and attention to oversight of cybersecurity risk. The Board is not responsible, however, for defining or managing the Company's various risks. See "Management's Involvement in Cybersecurity Risk Oversight" below.


text: The Board and its committees oversee risk through regular reports from management. The Board's committees report on the matters discussed at the committee level to the full Board. The Risk Committee has primary responsibility for cybersecurity oversight. In that capacity, the Risk Committee receives quarterly presentations and reports, as well as additional updates as needed, on cybersecurity matters. Such updates address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, external threat intelligence, technological trends and cybersecurity considerations arising with respect to the Company's peers and third parties. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established internal escalation thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management's Involvement in Cybersecurity Risk Oversight The CISO, in coordination with the Information Security Steering Committee, which includes our CEO, CIO, CRO and General Counsel & Corporate Secretary (the "GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the Information Security Steering Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Committee and/or the full Board when appropriate.


text: The CISO holds undergraduate and masters' degrees in computer science and cybersecurity, respectively, and has served in various senior roles in information technology and information security for over 20 years, including previously serving as the Chief Information Security Officer of a major global asset manager. The CISO has attained the professional certification of Certified Information System Security Professional (CISSP), Certified Information Security Manager (CISM) and Certified in Risk and Information Systems Control (CRISC). The CIO holds undergraduate and masters' degrees in computer science and has served in various roles in information technology for over 30 years. The Company's CRO holds an undergraduate degree and has over 30 years of experience managing risks, including risks arising from cybersecurity threats.


text: The Company is ISO/IEC 27001:2013 certified, which is a global standard that specifies the requirements for establishing, implementing, maintaining, and continually improving information security management systems. Additionally, we have received an independent examination regarding our compliance with SOC 2 Type 1 and Type 2.


text: To effectively identify, assess and manage risks from cybersecurity threats, the Company maintains a cybersecurity and cyber risk management program which is comprised of the Company-wide cybersecurity strategy and its supporting policies, processes and architecture. This program is part of the Company's enterprise risk management program.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: Risk Management Strategy The Director of Information Technology, who reports to the Chief Financial Officer, has extensive information technology ("IT") and cybersecurity knowledge and skills gained from over 15 years of relevant work experience at the Company, and is responsible for leading the Company's cybersecurity and cyber risk management program which includes certain cybersecurity processes covering the Company's corporate systems. These processes include, among other items, the Company's information technology and risk management departments' use of an internal set of applications and control activities to actively monitor potential threats to its corporate IT environment and regularly conduct internal testing to identify potential vulnerabilities to the Company's corporate information technology infrastructure and systems. These activities include, but are not limited to, continuous monitoring of network and infrastructure vulnerabilities, automated patching and software updates, redundancy and back-up systems, and incident response planning and handling. The Company's employees are required to report cybersecurity events, including suspicious activity or emails, to the Company's information technology department. Should a cybersecurity event occur within its corporate systems, the Company is positioned to coordinate a swift response to mitigate impacts to its information technology infrastructure and systems. The Company has in place an incident response plan which provides guidance for leadership and employees to swiftly evaluate and respond to cybersecurity incidents. The Company also carries cybersecurity insurance to further mitigate certain potential losses from a cybersecurity incident affecting its corporate IT equipment and systems.


text: The Company's cybersecurity processes also include self-assessments using industry benchmarks as well as input from external industry consultants and ongoing communication with third-party business partners to identify cybersecurity incidents and threats that could potentially impact the Company. The Company has relationships with a number of third-party business partners to assist with cybersecurity incident containment and recovery efforts and assesses the processes and tools used by its third-party business partners to manage their cybersecurity risks. The Company uses a risk-based approach with respect to its use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of network connectivity or of data accessed, processed, or stored by such third-party service provider.


text: The Company's corporate IT systems are not used to process business transactions with its guests and those systems currently have no connectivity to hotel and/or third-party management and brand technology platforms. The Company's information technology and risk management departments regularly engage with its third-party management companies and brands to understand and benchmark their execution and alignment with applicable policies and industry practices for data protection and cybersecurity.


text: Management and Board Oversight The Company's Board of Directors administers cybersecurity risk oversight primarily through its Audit Committee. The Board's Audit Committee is tasked with oversight responsibility for the Company's enterprise risk management program, including those related to cybersecurity and cyber risks. The Audit Committee receives regular reports from the Chief Financial Officer on, among other things: the Company's cybersecurity risks and threats; the status of projects to strengthen the Company's information security systems; internal and third-party assessments of the Company's cybersecurity program; and the emerging cyber threat landscape. The Audit Committee also receives updates on cybersecurity incidents experienced by third-party business partners that may pose significant risk to the Company. The Audit Committee provides periodic reporting to the Board of Directors on cybersecurity matters. The Company's IT and risk management departments report directly to the Chief Financial Officer and are directed to promptly report incidents to the Chief Financial Officer in accordance with the Company's incident response plan. The Chief Financial Officer also apprises the Audit Committee of cybersecurity incidents consistent with the Company's incident response procedures for more significant incidents and in the aggregate for less significant incidents.


text: Cybersecurity Risks The Company faces a number of cybersecurity risks in connection with its business, although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date. While the Company is not aware of any cybersecurity incidents that have materially affected its business as of December 31, 2024, there can be no guarantee that the Company will not be the subject of future attacks, threats or incidents, that may have a material impact on its business strategy, results of operations or financial condition. Notwithstanding the extensive approach the Company takes to address cybersecurity, it may not be successful in preventing or mitigating all cybersecurity incidents or threats. For more information about the cybersecurity risks the Company faces, see the risk factor entitled "Technology is used in operations, and any material failure, inadequacy, interruption or security failure of that technology from cyber-attacks or other events could harm the Company's business" in Item 1A- Risk Factors.


text: Global cybersecurity vulnerabilities and threats continue to evolve and are increasingly more sophisticated. The Company is aware of the dynamic nature of the cybersecurity threats we face and has a security program led by our Chief Information Security Officer (CISO) that strives to monitor and mitigate risks from cybersecurity threats. The CISO reports to the Chief Information Officer (CIO), provides periodic reports to the Chief Executive Officer (CEO) and Chief Financial Officer (CFO), and reports quarterly to the Audit Committee of the Board of Directors, which oversees the Company's cybersecurity risk profile, including risks from cybersecurity threats, and mitigation activities. The Company's CISO has over 35 years of security and cybersecurity experience between the military and corporate sectors. Prior to joining Benchmark, he oversaw cybersecurity for Masco Corporation, a Fortune 500 company, and La-Z-Boy Incorporated, both of which are global manufacturing organizations with similar complexities as the Company. The CISO also served as a member of the Department of Defense as a civilian in charge of cybersecurity for an Army acquisition command, overseeing the cybersecurity for approximately 320 programs of record.

companyName: BENCHMARK ELECTRONICS INC

ticker: BHE


text: The Company's CIO has been and continues to be responsible for Global IT, including overseeing cybersecurity and its digital strategy. In addition, he was responsible for cybersecurity in previous roles prior to joining the Company, including during his time at Rogers Corporation, a global high tech manufacturing company, as well as other global manufacturing companies.


text: The Company has an Enterprise Risk Management (ERM) process, with an annual risk assessment performed. A universe of key risks is updated annually, with key risks rated by and discussed with corporate and site-level executives, as well as the Audit Committee, which oversees the Company's ERM process. As a result of the annual risk assessment, the enterprise's top risks are identified, with action plans developed to address each risk. Results of the annual enterprise risk assessment are presented to and discussed with the Audit Committee at least annually. One of the key risks evaluated annually is cybersecurity. Our cybersecurity risk evaluation assesses whether, or to what extent, information assets (hardware, software, systems, laptops, data, intellectual property) might be compromised in an attack by a malicious actor, resulting in potential data leakage, data destruction, malware infiltration, or a ransomware attack. With the increasing sophistication of cyber-criminals and constantly evolving threat vectors, the Company continues to identify cybersecurity as a top risk, prompting numerous actions and measures across the Company that endeavor to mitigate and, where possible, minimize such risks.


text: The Company increasingly leverages and relies upon digital technologies and services to conduct our business and support our customers. These technologies and services are a blend of organic and third-party supplied solutions that encompass data storage, processing and transmissions. Our digital technologies support business processes for financial management, human capital management, customer engagement, and manufacturing services. Examples of such technologies include Enterprise Resource Planning (ERP) systems, shop floor controls, test equipment, general business applications, and our global infrastructure and networks, as well as external systems, analytics, automation and cloud services. Such digital technologies and services are subject to numerous risks including, but not limited to, ransomware or cyber-extortion, denial of service to systems, malicious code introduced through third party software products or software updates or theft of company, customer, vendor and employee data. Our operations have been, and may in the future be, subject to ransomware or cyber-extortion attacks, which could significantly disrupt our operations. Generally, such attacks involve restricting access to electronic and computer systems or the restriction or theft of vital data including customer supplied data.


text: The Company has a security program that strives to implement best practices for protecting our systems with the understanding that adversaries have varying skills and competencies and may be able to exploit or evade our current protective technologies. We actively monitor our systems for cyber threats and have processes in place to detect and remediate vulnerabilities. Our approach relies on both internal and external monitoring, vulnerability assessments as well as penetration testing by third parties. We also use leading end-point detection response tools to continuously monitor our security environment. We regularly conduct a review of our data management practices to ensure the proper retention, protection and storage of data, and to apply new technology-based tools to better manage the protection of customer data. Our information security policies and practices, which includes disaster recovery, are designed to deliver resilience and comply with several regulatory requirements including DFARS/NIST 800-171 controls. For our defense customers, we are undergoing certification to the U.S. Cybersecurity Maturity Model Certification (CMMC) program and performed a CMMC self-assessment with the assistance of a qualified third-party inspector. To ensure security awareness throughout the Company, we conduct employee training on multiple topics, and also conduct simulated phishing campaign tests. Regular communications remind all employees of how to be vigilant against cyberattacks. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors key suppliers and customers' cybersecurity scores.


text: The Company's protective technologies include firewall and email protection against malware and phishing campaigns, and information system access management solutions such as multifactor authentication (MFA). We augment these protective technologies with security monitoring and detection capabilities to limit the impact of cybersecurity incidents. The security monitoring and detection tools we utilize leverage Endpoint Detection and Response (EDR) and Security Incident and Event Management (SIEM) augmented with threat intelligence information from multiple sources. We have further enhanced the security posture of the Company by implementing data security technologies and measures to reduce the impact of attempts to steal or destroy data. These technologies are tested regularly by both internal resources and external experts that evaluate the technology and identify vulnerabilities for mitigation and/or remediation. Our security program leverages Company and third-party security professionals and services to achieve an appropriate level of security and resilience that is reviewed periodically by an IT steering committee that includes senior officers such as the CEO, CFO, Chief Legal Officer, CIO, CISO, Chief Operating Officer and Chief Technology Officer, and the efficacy of these programs is also reviewed quarterly with the Audit Committee of the Company's Board of Directors. We have also recently implemented a third-party cybersecurity risk management program that continuously monitors cybersecurity scores of key suppliers and customers.


text: As of the date of this filing, we are not aware of any risks from cybersecurity threats, including any previous cybersecurity incidents since the ransomware incident in the fourth quarter of fiscal 2019 described under "Our operations are subject to cyberattacks that could have a material adverse effect on our business" in Part I, Item 1A of this Report, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. This statement does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. Despite the systems and processes we have in place to monitor, detect, mitigate and remediate potential vulnerabilities, in the past, we have experienced cyberattacks, and attempted breaches, including phishing emails and other targeted attacks, and there can be no guarantees that such attacks will not occur in the future.


text: Cybersecurity risk management and strategy Saia maintains cybersecurity processes, technologies and controls to help us assess, identify and manage material risks from cybersecurity threats. These processes, technologies and controls are part of Saia's overall enterprise risk management process. Our cybersecurity program is based on the National Institute of Standards and Technology Cybersecurity Framework and is designed to ensure that our information systems are effective and are prepared for cybersecurity threats, including through regular oversight and mitigation of internal and external threats.

companyName: SAIA INC

ticker: SAIA


text: We regularly perform evaluations of our information security program and our information technology infrastructure, including through the use of tools and services for network and endpoint monitoring, vulnerability assessments and penetration testing, among other things. We have implemented security monitoring capabilities designed to alert us to suspicious activity and have an incident response program to restore business operations as quickly and as orderly as possible in the event of a cybersecurity incident.


text: Saia contracts with third party firms to evaluate our information security program, for continuous system monitoring and threat detection, to gather insights for identifying and assessing material cybersecurity threats, and for potential mitigation assistance. We consider cybersecurity matters when selecting and overseeing our third party service providers and we administer a standardized information gathering questionnaire to evaluate cybersecurity risk in third parties. We seek to require third parties who could pose significant cybersecurity risk to us to be contractually responsible for the risk and to agree to cybersecurity assessments in connection with new vendor engagements and annually thereafter.


text: Saia has an established cybersecurity and information security awareness training program that includes mandatory annual training and regular communications for our employees regarding cybersecurity threats and methods of mitigation. The annual cybersecurity training consists of threat avoidance when working remote, proper password construction techniques, identifying and reporting suspicious activity, social engineering and insider threats. Additionally, we have implemented a regular phishing assessment that provides feedback and additional training as needed to enhance the annual training program. Our information technology professionals also receive additional training related to their position.


text: There can be no guarantee that our policies and procedures will be effective. Although our risk factors include further detail about the material cybersecurity risks we face, we believe that risks from prior cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations or financial condition. For more information about the cybersecurity risks we face, see the risk factors entitled "We rely heavily on technology to operate our business and cybersecurity threats or other disruptions to our technology infrastructure could harm our business or reputation" and "We use AI in our business, and its use could result in reputational harm, competitive harm, cybersecurity risks and legal liability, which could have a material adverse effect on our results of operations" in Item 1A. Risk Factors.


text: Management is responsible for the day-to-day assessment and management of cybersecurity risks. Saia's Director of Information Security and Compliance, who reports to the Executive Vice President and Chief Information Officer, has primary oversight of our cybersecurity risk management and strategy processes. The Director of Information Security and Compliance has served in information security roles since 2001 and led the information security function for a large health care system prior to joining Saia. He has a Bachelor of Science degree in Information Technology with a Concentration in Information Assurance and Security.


text: The Director of Information Security and Compliance assesses our cybersecurity readiness through internal assessment tools as well as third-party control testing, vulnerability assessments and evaluation against industry standards. We maintain compliance structures that are designed to elevate issues relating to cybersecurity to our Director of Information Security and Compliance and to our Executive Vice President and Chief Information Officer.


text: The Board of Directors has oversight responsibility for Saia's strategic and operational risks. Although the Board has delegated oversight responsibility for certain risks to its committees, the Board has determined that oversight for cybersecurity should remain with the full Board. The Board regularly receives reports from the Executive Vice President and Chief Information Officer concerning the Company's cybersecurity risk management and strategies and related processes, technologies and controls.


text: Our business and industry has become increasingly dependent upon digital technologies, including information and operational systems and related infrastructure as well as cloud applications and services, to process and record financial and operating data; analyze seismic, drilling, completion and production information; manage production equipment; conduct reservoir modeling and reserves estimation; communicate with employees and business associates; perform compliance reporting and many other activities. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has an Insider Threat and Data Loss Prevention program that is designed to protect the confidentiality, integrity and availability of such data, and we maintain processes designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: CONTINENTAL RESOURCES, INC


text: The Company has a cybersecurity team with relevant subject-matter expertise that is part of the Company's Information Technology department (the "Cybersecurity Team"). This team reports to the Company's Vice President and Chief Information Officer ("CIO") and is led by the Company's Chief Information Security Officer ("CISO"), who has primary responsibility for oversight of the Company's assessment, identification, and management of cybersecurity risks. The CIO and CISO jointly determine whether a given cybersecurity matter is sufficiently important to warrant elevating it to the attention of the Company's Cybersecurity Executive Committee (defined below) and/or Board of Directors. Our CISO has received certifications relating to information security, security leadership, and forensics from the Global Information Assurance organization.


text: The Cybersecurity Team monitors the cybersecurity environment for threats and indicators of compromise. It also considers the risks attendant to the Company's business operations and strategy and develops solutions and mitigation measures for the risks identified, including risks arising in connection with third-party interactions and the integration of newly acquired assets. In addition, the Company invests in Security Awareness training to help promote employee awareness of cybersecurity.


text: The Company's internal cybersecurity efforts are supported by a team of outside consultants, assessors, and third-party vendors who assist with identifying and monitoring risks and indications of compromise.


text: The Cybersecurity Team regularly engages third-party assessors to conduct evaluations of the Company's cybersecurity risk mitigation efforts and strategy. The Company also engage s a third-party auditing firm to periodically assess our information security program. Audits are also conducted from time-to-time by other third parties, such as insurance adjusters and regulators.


text: The Cybersecurity Team engages third-party vendors to assist with managing endpoint security, managing the Company's security operations center, providing threat detection and response capabilities, monitoring certain operational technology and control system environments, and providing threat detection and vulnerability identification and remediation services. Additionally, the Company is a member of the Oil and Natural Gas Information and Analysis Center. This center provides the Company with information regarding threats to the oil and gas industry and threats reported by other industry participants. Finally, the Cybersecurity Team periodically engages with the cybersecurity-related guidance of other third parties such as law enforcement, industry trade groups and vendors.


text: The Cybersecurity Team reviews the integrity of services provided by vendors engaged to support the Company's cybersecurity efforts using the same methods as are used to evaluate the services provided by other vendors engaged to support the Company's regular business operations.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Since the Company is private, it has no independent members of its Board of Directors. All of the Company's directors are also executive officers. The body primarily responsible for oversight of the Cybersecurity Team is the Cybersecurity Executive Committee, which is composed of the Company's President and Chief Executive Officer; Executive Vice President, Chief Culture Officer and Administrative Officer (both of whom are also members of the Company's Board of Directors); Chief Financial Officer and Executive Vice President of Strategic Planning; Senior Vice President, General Counsel and Secretary; CIO; and the Director of Corporate Security. The Cybersecurity Executive Committee meets regularly and during these meetings its members review and discuss cybersecurity information provided by the CISO, which may include: (i) metrics relevant to cybersecurity issues; (ii) summaries of changes or proposed changes to the Company's cybersecurity program; and (iii) cybersecurity risk and threat updates. Information regarding any critical cybersecurity-related matter is communicated to the Cybersecurity Executive Committee as soon as practicable.


text: In addition, the CISO periodically briefs the Company's Audit Committee regarding cybersecurity matters at a regularly scheduled committee meeting and these briefings cover the same types of information as is presented to the Cybersecurity Executive Committee. The Audit Committee is composed of the two members of the Board of Directors who are also members of the Cybersecurity Executive Committee.


text: The Company has developed a Cybersecurity Incident Response Plan (the "Response Plan"), which is based upon NASA's mission control incident response procedures to address and manage certain cybersecurity incidents. If an incident meets certain criteria, the incident response plan is invoked by the CISO and General Counsel. Once the plan is invoked, an impact assessment is conducted and a remediation plan is developed, if needed. The plan also sets forth procedures for monitoring incidents and post-incident follow-up so that any lessons learned can be discussed. Where appropriate, the post-incident follow up identifies measures that can be implemented to aid with future incident prevention and detection. Under the Response Plan any incident-related information is communicated using the channels outlined in the Response Plan.


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, the Company does not believe any prior cybersecurity threat or incident has materially affected or are reasonably likely to materially affect the Company, including its business operations or prospects. However, the Company acknowledges that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For additional information about the risks to our business associated with cybersecurity incidents, please see "A cybersecurity incident could result in information theft, data corruption, operational disruption, and/or financial loss" under Part I, Item IA. Risk Factors.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: Aimco OP L.P.


text: We use the NIST Cybersecurity Framework and CIS Critical Security Controls as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program is integrated with our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise IT environment; • a team comprised of IT personnel principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to monitor, assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response plan and Security Operations Center (SOC) to respond to cybersecurity incidents; and • a third-party risk management process for service providers.


text: There can be no assurance that our cybersecurity risk management program, including our controls, procedures and processes, will be fully complied with or that our program will be fully effective in protecting the confidentiality, integrity and availability of our information systems, product and network.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity threats that, if realized and material, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. These and other risks related to cybersecurity matters are described in more detail in Item 1A. Risk Factors.


text: Cybersecurity Governance Our Board considers cybersecurity risk as critical to the enterprise and delegates the cybersecurity risk oversight function to the Audit Committee. The Audit Committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program.


text: Our Chief Information Officer (CIO) reports to the Chief Administrative Officer & General Counsel and leads the Company's overall cybersecurity function. The Audit Committee receives regular reports from our CIO on our cybersecurity risks, including briefings on our cyber risk management program and cybersecurity incidents. Audit Committee members also receive periodic presentations on cybersecurity topics from our CIO, supported by our internal security staff, or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our CIO supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers; and alerts and reports produced by security tools deployed in the IT environment.


text: Our CIO is responsible for assessing and managing our material risks from cybersecurity threats. Our CIO has primary responsibility for leading our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CIO has been publicly recognized as a cybersecurity thought leader by leading industry analysts. Our CIO has over 25 years of technical leadership and industry experience, which is inclusive of global experience in managing and leading IT and cybersecurity teams. Our cybersecurity team holds industry standard certifications and participates in routine training.


text: Cybersecurity Risk Management The Company has systems and processes for identification, assessment, and management of material risks from cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. The Company's multi-faceted approach includes deploying applications and control activities to actively monitor and mitigate potential threats to the Company's IT environment.

companyName: TREX CO INC

ticker: TREX


text: These activities include, but are not limited to, engaging an external third-party to monitor information systems security events, conducting annual security training of employees, testing employees via periodic phishing campaigns, conducting system vulnerability scanning, utilizing a patching program to remediate critical patches, and utilizing an external third-party to perform testing to identify gaps in the Company's security program. The Company also performs third-party risk management to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners. Additionally, for providers of software-as-a-service and other services that hold Company data, the Company reviews and assesses industry standard certifications such as System and Organization Controls (SOC) 1 or SOC 2 reports and cybersecurity preparedness questionnaires. Mitigation of risk efforts are coordinated by the Company's Director of Information Security, utilizing internal resources and third-party providers.


text: The Company has not had any cybersecurity risks that have materially affected the Company, including its business strategy, results of operations, or financial condition. Cybersecurity risks are disclosed in Part I Item 1A. Risk Factors, incorporated herein by reference.


text: Cybersecurity Governance Our cybersecurity programs, including the cross-functional management committees responsible for identifying, assessing, and mitigating cybersecurity risks and incidents, are overseen by our Vice President and Chief Information Officer. Day-to-day administration of the cybersecurity programs are led by our Director of Information Security, a direct report to the Vice President and Chief Information Officer. Our Vice President and Chief Information Officer has 27 years of technology leadership experience and a Doctor of Business Administration. Our Director of Information Security has 27 years of experience in infrastructure and security operations and a degree in Information Technology Management. Our Director of Information Security is the chair of the Company's Information Security Committee. The activities of the Information Security Committee are reviewed by the Executive Information Security Oversight Committee, which is comprised of members of our senior leadership team including our Vice President and Chief Information Officer, Senior Vice President, Chief Financial Officer, Senior Vice President, Chief Legal Officer and Secretary and Senior Vice President, Chief Human Resources Officer. The Executive Information Security Oversight Committee facilitates notification to the Audit Committee of emerging cybersecurity risks, and threats, the status of projects to strengthen the Company's information security systems, and updates on any cybersecurity incidents.


text: The Audit Committee of the Board of Directors oversees cybersecurity related risks. Members of the Audit Committee receive the above referenced notifications and updates on a quarterly basis from the Company's Chief Information Officer as the designated representative of the Executive Information Security Oversight Committee.


text: Additionally, the Company has a written Information Security Policy and a Cybersecurity Incident Response Plan that provides the above-referenced processes by which such committees are informed of and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents and material risks from cybersecurity threats.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, patient data, and data related to our clinical trials ("Information Systems and Data").

companyName: Minerva Neurosciences, Inc.

ticker: NERV


text: The Company's information security function and third-party service providers help identify, assess and manage the Company's cybersecurity threats and risks, including through the use of the Company's risk assessment process. The Company's information security function and third-party service providers identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment and risk profile using various methods including, for example: • automated tools; • subscribing to reports and services that identify cybersecurity threats; • analyzing reports of threats and actors; • conducting scans of the threat environment; • evaluating our and our industry's risk profile; • evaluating threats reported to us; • conducting audits; • conducting threat assessments for internal and external threats; • conducting vulnerability assessments to identify vulnerabilities; and • using external intelligence feeds.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: • our incident response plan; • incident detection and response processes; • a disaster recovery/business continuity plan; • encryption of certain data; • network security controls; • access controls; • asset management, tracking and disposal; • systems monitoring; • employee training; • penetration testing; • cybersecurity insurance; and • outsourced cybersecurity staff.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, the Company's information security function works with management, including our Chief Operating Officer ("COO") to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: • our external IT service provider; • professional services firms, including legal counsel; • cybersecurity consultants; • managed cybersecurity service providers; and • penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers, contract research organizations and contract manufacturing organizations. As part of our vendor security due diligence and to manage cybersecurity risks associated with our use of certain vendors, we perform risk assessments on vendors and may include cybersecurity obligations in our contracts with them. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor due diligence involves different levels of assessment designed to help identify cybersecurity risks associated with a provider. For example, we may impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including: • If our information technology systems or data, or those of third parties upon which we rely, are or were compromised, we could experience adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions; litigation; fines and penalties; disruptions of our business operations; reputational harm; loss of revenue or profits; and other adverse consequences.


text: Our board of directors addresses the Company's cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing Company's cybersecurity risk management processes, including oversight of mitigation of risks from cybersecurity threats. Our cybersecurity risk assessment and management processes are implemented and maintained by certain Company management, including our COO.


text: The COO is responsible for managing our information security function and overseeing our third-party information technology service providers. The COO is also responsible for helping to integrate cybersecurity risk considerations into the Company's overall risk management strategy, communicating key priorities to relevant personnel, and approving budgets. Our outsourced Chief Technology Officer, who has over 20 years in executive-level IT and cybersecurity roles, is responsible for developing and implementing our technology environment and cybersecurity framework, helping the Company prepare for cybersecurity incidents, approving and implementing certain cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our cybersecurity incident response plan is designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including the COO and Chief Financial Officer ("CFO"). The COO and CFO work with the other members of the Company's incident response team to help the Company mitigate and remediate cybersecurity incidents of which they are notified. In addition, the Company will report to the audit committee of the board of directors for certain cybersecurity incidents.


text: The audit committee receives periodic updates from the CFO and finance department concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented to address them. The audit committee also receives various updates, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our use of information systems for collecting, using, transmitting and storing data is a vital aspect of our business operations. Information systems are inherently vulnerable to a range of cybersecurity threats that could potentially have a material impact on our strategy, financial condition, liquidity or results of operations.

companyName: ARMSTRONG WORLD INDUSTRIES INC

ticker: AWI


text: Cybersecurity Risk Management and Strategy. The Company actively maintains an enterprise risk management program. Management's role is to identify, mitigate, guide and review the efforts of our business units, consider whether the residual risks are acceptable, and approve plans to deal with serious risks. Cybersecurity is a key risk management category within our enterprise risk management program.


text: The Vice President and Chief Information Officer ("CIO"), who also serves as a member of the Company's enterprise risk council, works closely with key business leaders and functions to develop and enhance the Company's cybersecurity strategy. Our cybersecurity program is designed to safeguard against an evolving threat landscape through effective prevention, detection, response and recovery processes. Our cybersecurity risk management processes include frequent assessment of our top cyber risks and mitigations.


text: Our cybersecurity risk program is a comprehensive framework designed to safeguard our organization and stakeholders from evolving threats. Central to this approach is our commitment to threat and vulnerability management, where we proactively identify, prioritize, and address potential cybersecurity gaps to strengthen our overall security posture. We emphasize identity and access management by implementing access controls and robust authentication methods to protect user identities and secure information technology systems. Data protection and privacy is in place to ensure sensitive information is protected from exfiltration. Our cybersecurity defenses leverage systems and technologies, including firewalls, network access, endpoint protection, privileged access management, user behavior analytics, multi-factor authentication, intrusion detection systems and continuous monitoring. The purpose of these systems and technologies is to stay ahead of potential threats. To prepare for and respond to potential cybersecurity events, we conduct regular incident response exercises, ensuring our readiness and resilience. Additionally, we invest in employee training and awareness programs to promote a culture of security mindfulness and reduce risks associated with human error. Recognizing the importance of third-party relationships, we maintain a vendor risk management program that includes monitoring the cybersecurity practices of our vendors, and if applicable, performing user access reviews and evaluating System and Organization Controls reports at both inception and on an ongoing basis. Together, these efforts reflect our dedication to building a secure and compliant environment that protects our operations, data, and the trust of our stakeholders.


text: Our program incorporates an Incident Response Plan to guide the evaluation, response, and escalation of cybersecurity incidents. This plan is overseen by our CIO and executed by a cross-functional Cybersecurity Incident Response Team. The incident response plan establishes clear protocols for incident identification, impact assessment, containment and resolution, with defined escalation paths based on incident severity. Cybersecurity incidents above a defined threshold of criticality are evaluated for materiality to determine reporting and disclosure requirements. To enhance our response capabilities, we conduct periodic assessments, including third-party reviews, and simulate incidents through regular tabletop exercises.


text: Our cybersecurity program's effectiveness is periodically evaluated against established quantifiable goals and other external benchmarks, including the National Institute of Standards and Technology security framework. This evaluation is carried out through internal and external risk assessments and compliance audits. We regularly engage third parties to help conduct these evaluations, assessments and audits, advise us on the effectiveness of our cybersecurity processes and assist the Company in remediating any identified vulnerabilities.


text: We do not believe that risks from cybersecurity threats, individually or in the aggregate, including any previous cybersecurity incidents, have materially affected, or are reasonably likely to materially affect, our strategy, financial condition, liquidity or results of operations. For additional information on how cybersecurity risk may affect our business, refer to Item 1A. Risk Factors of this Form 10-K under the heading "We rely on operating and information systems that may experience a failure, a compromise of security, or a violation of data privacy laws or regulations, which could interrupt or damage our operations and have a material adverse effect on our financial condition, liquidity or results of operations."


text: Governance. Our Board of Directors has responsibility for oversight of management's cybersecurity risk program and receives regular updates from our CIO. These updates, provided on a semi-annual basis, cover a range of topics, including the performance of our cybersecurity program against established goals and external standards, insights into the evolving cybersecurity landscape, current events and recent cybersecurity threats, and progress in enhancing the Company's cybersecurity posture. Pursuant to its charter, the Audit Committee of our Board of Directors is responsible for reviewing management's cybersecurity incident reporting process, methodology and tools. In addition, the Audit Committee is responsible for reviewing management's materiality assessments of cybersecurity incidents identified as significant by management.


text: Our CIO holds an advanced degree in Information Technology with over 20 years of experience, including senior leadership roles in technology at various companies. The CIO oversees a cybersecurity team, comprised of internal and external subject matter experts who work collaboratively to achieve our cybersecurity objectives. In addition, our CIO leads the Information Security Steering Committee, a group comprised of key information technology employees and business leaders, including our Senior Vice President, Chief Financial Officer and Senior Vice President, General Counsel and Chief Compliance Officer. This committee meets regularly to review and discuss the Company's cybersecurity strategies and developments, ensuring a comprehensive approach to managing cybersecurity risk.


text: Risk Management and Strategy We have implemented cybersecurity programs designed to maintain and protect our information technology systems and the confidentiality, integrity, and availability of our data. These programs serve to maintain compliance with applicable laws and regulations governing ethical business practices, including our relationships with suppliers, customers, and business partners.

companyName: Orthofix Medical Inc.

ticker: OFIX


text: We maintain formal processes for our cybersecurity program and incident response procedures, which are updated at least annually and reviewed by external legal and cybersecurity advisors. These processes include, among other things, detailed steps on how we assess cyber risks, identify threats, and determine the materiality of cyber incidents. These processes also designate certain roles within the company to execute these policies and certain leadership roles to manage material risk escalation. These processes endeavor to follow the National Institute of Standards and Technology ("NIST") Cybersecurity Framework and are tested at least annually.


text: Our Information Security team uses automated technology, third-party partners, and direct review of system indicators to monitor and implement the prevention, detection, mitigation, and remediation of cybersecurity incidents, and to stay current with the changing threat landscape. We also leverage encryption technologies and other measures to safeguard systems. We engage third parties as part of our cyber program, including external security firms that provide security technology, conduct regular security audits, and conduct penetration testing. We also engage third parties to conduct regular drills, such as tabletop exercises, to help with our overall preparedness.


text: We also engage third-party service providers to assist with managing various other aspects of our business. We have implemented processes designed to both assess and maintain oversight of third-party service providers with regards to cybersecurity risks. These service providers are subject to due diligence reviews of their information security programs during our vendor evaluation process.


text: Our employees are responsible for complying with our data security standards and are required to complete annual training to understand the behaviors and technical requirements necessary to keep data secure. We also require that cybersecurity training be part of the onboarding process for new hires.


text: As of December 31, 2024, cybersecurity risks have not materially affected our business strategy, results of operations, or financial condition.


text: Cybersecurity is an important component of our enterprise risk management program. While the full Board of Directors has primary responsibility for risk oversight, the Board of Directors utilizes its committees, as appropriate, to monitor and address the risks that may be within the scope of a particular committee's expertise or charter. The Board of Directors receives updates at quarterly board meetings on committee activities from each committee Chair.


text: The Audit and Finance Committee has oversight over and regularly reviews our cybersecurity, including information technology ("IT") risks, controls, procedures, and plans to mitigate cybersecurity risks and respond to security incidents. The Audit and Finance Committee receives reports on at least a quarterly basis from the Chief Information Officer and the Vice President, Information Security, on, among other issues, our cyber risks and threats, the status of projects, management's strategies to strengthen our IT systems, assessments of our security program, third-party assessments and testing, our emerging threat landscape, and the review of our cybersecurity insurance policy. Pursuant to our incident response procedures, material cyber incidents will be reported to the Chair of the Audit and Finance Committee upon a determination of material status. Due to the importance of cybersecurity, the full Board of Directors also receives updates on cybersecurity matters from management at least annually.


text: Management is responsible for our company's day-to-day risk management activities. Our cybersecurity program is led by our Chief Information Officer, who is responsible for assessing and managing cybersecurity risks. He has 26 years of experience in both military and corporate leadership roles, including 13 years of experience in CIO-level leadership roles, including consulting with major firms, covering technology and security operations responsibility.


text: Our Vice President, Information Security, who reports to our Chief Information Officer, is responsible for cybersecurity program execution, risk management, and oversight of information security staff and consultants. She has 20 years of experience in IT roles, including 14 years in IT leadership roles and 6 years in cybersecurity program execution and oversight of information security.


text: Our Manager, Information Security, who reports to our Vice President, Information Security, is responsible for managing our security analyst and engineering team and is also responsible for the tactical execution of security operations. He has 25 years of experience in IT roles including 15 years of experience in security leadership. He also has the following certifications: ISC2 CISSP, EC-Council Certified Ethical Hacker ("CEH"), and numerous vendor specific certifications.


text: As cybersecurity risks arise, our Information Security team executes the incident response procedure and communicates the appropriate details to management in alignment with the escalation steps in the procedure. In addition, our Chief Information Officer, Vice President, Information Security, and Manager, Information Security, conduct monthly cybersecurity program status reviews with the Information Security team that includes key performance indicator ("KPI") tracking, risk assessment, escalation actions, and project status.


text: Cyber Risk Management and Strategy At Fulcrum Therapeutics, we recognize the importance of assessing, identifying, and managing risks from cybersecurity threats. We have implemented a cybersecurity risk management process in accordance with our risk profile and business that is informed by industry standards and is integrated into our enterprise risk management process.

companyName: Fulcrum Therapeutics, Inc.

ticker: FULC


text: We leverage the support of third-party information technology and security providers, including for periodic security testing and risk assessments, as part of our risk management process, designed to identify, assess, and manage cybersecurity risks. We conduct employee cybersecurity training and maintain an incident response and notification plan designed to assist us in identifying, responding to, and recovering from cybersecurity incidents. Further, we regularly evaluate and update our existing cybersecurity policies and procedures as appropriate to continue to align them to our risk profile.


text: We have a process to assess the security practices of certain third-party vendors, including through the use of vendor security questionnaires, as appropriate.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third party vendors' data and systems. For more information about these risks, please refer to the section entitled "Risk Factors" in this Annual Report on Form 10-K.


text: Governance Related to Cybersecurity Risks Our Executive Director, IT & Operations, or Executive Director, who reports to the Chief Financial Officer, is responsible for the strategic leadership and direction of our cybersecurity program. With over 15 years of experience in information technology, the Executive Director works alongside individuals across other functions, such as legal and engineering, to establish and implement our cybersecurity strategy.


text: The Executive Director and our Chief Legal Officer participate in periodic discussions with other members of our management, including executive leadership, regarding implementation of our cybersecurity program, program enhancements, and relevant cyber risks or threats. Our Chief Legal Officer has received the National Association of Corporate Directors CERT Certificate in Cyber-Risk Oversight.


text: Our audit committee has oversight over cybersecurity risks. With the input of the executive team, the Executive Director provides annual presentations to the audit committee on our cyber program, including updates on security testing and assessments, cyber risks, and related cyber strategy as applicable. The management team will also update the full board of directors on matters related to cybersecurity as needed.


text: Additionally, we have implemented an enterprise risk management process, which addresses cyber risks. This process is led by our Chief Legal Officer and includes participation by the board of directors, as appropriate. Our Chief Legal Officer reports regularly on the enterprise risk management process to executive leadership and the audit committee.


text: We have certain processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program/information technology function and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and clinical trial information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards, response plans, regular tests on our systems, incident simulations and routine review of our policies and procedures to identify risks and enhance our practices. We engage certain external parties, including consultants, independent privacy assessors, computer security firms and risk management, peer companies, industry groups and governance experts, to enhance our cybersecurity oversight. We consider the internal risk oversight programs of third-party service providers before engaging them in order to help protect our company from any related vulnerabilities.

companyName: Beam Therapeutics Inc.

ticker: BEAM


text: Based on an assessment using these processes, we do not believe that there are currently any risks from known cybersecurity threats that are reasonably likely to materially affect our company or our business strategy, results of operations or financial condition. For additional information, please see the risk factor titled "Our internal computer systems, or those of our third-party vendors, collaborators or other contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs, compromise sensitive information related to our business or prevent us from accessing critical information, potentially exposing us to liability or otherwise adversely affecting our business." under Item 1A., Risk factors—General risk factors, in this Annual Report on Form 10-K.


text: The Audit Committee of our board of directors provides direct oversight over cybersecurity risk, and provides updates to the board of directors regarding such oversight. The Audit Committee receives updates quarterly from management regarding cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents.


text: Our Vice President of Information Security, or the VP, IS, leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees and third-party service providers to address cybersecurity risks. The VP, IS's cybersecurity training includes 25 years of experience building and maintaining cybersecurity programs, and he obtained his certified information systems security professional, or CISSP, certification from the International Information System Security Certification Consortium, or ISC2, and his Cybersecurity and Infrastructure Security Agency, or CISA, certification from ISACA.


text: In an effort to deter and detect cyber threats, we annually provide all employees, including part-time and temporary employees, with a data protection, cybersecurity and incident response and prevention training and compliance program, which covers timely and relevant topics. Past topics have included social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educate employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Cybersecurity risk management is an integral part of our overall enterprise risk management program. Our cybersecurity risk management program is designed to align with industry best practices and provide a framework for evaluating and implementing methods to assess, identify and manage material risks from cybersecurity threats and properly respond to incidents, including threats and incidents associated with the use of services provided by third-party service providers. This framework includes steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat (including whether the cybersecurity threat is associated with a third-party service provider), implementing cybersecurity countermeasures and mitigation strategies and informing management and our Board of material cybersecurity threats and incidents. Our cybersecurity team leads a regular cybersecurity working group meeting with representatives from across the Company's centers of excellence, as well as a quarterly cybersecurity steering committee meeting with executives from across the Company, to facilitate coordination across different functional groups within our Company and ensure broad awareness of ongoing cybersecurity initiatives and assessments. These committees also hold ad hoc meetings as necessary to address urgent threats that arise in between meetings. Our cybersecurity team also engages third-party security experts for risk assessment and system enhancements. In addition, our cybersecurity team provides training to all employees annually.

companyName: Pactiv Evergreen Inc.


text: Our Board has overall oversight responsibility for our risk management and has delegated cybersecurity risk management oversight to the Audit Committee. The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and procedures to manage cybersecurity risks and mitigate cybersecurity incidents. The Audit Committee also reports material cybersecurity risks to our full Board. Management is responsible for identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining our cybersecurity program. Our cybersecurity program is managed under the direction of our Senior Vice President for Business Transformation, who receives reports from our cybersecurity team, including our Chief Information Security Officer, or CISO, and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents. The CISO, in coordination with senior management, works collaboratively across the Company to implement a program designed to protect our information systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity program, cross-functional teams throughout the Company address cybersecurity threats and respond to cybersecurity incidents. Through ongoing communications, the CISO and these teams inform senior management about, and monitor the prevention, detection, mitigation and remediation of, cybersecurity threats and incidents in real time, and report such threats and incidents to the Audit Committee when appropriate.


text: Our CISO has 43 years of experience in a diverse array of information and security technologies and has managed various domains, with expertise in enterprise resource planning, finite scheduling, middleware technologies, network control, operational control, identity access and governance and data center management. He and our other dedicated cybersecurity personnel collectively hold numerous certifications, including in relation to forensic investigation, threat hunting and digital forensics, risk and information system controls, Google cybersecurity, information security auditors and fraud examiners. Additionally, the collective cybersecurity team members have substantial experience in information technology disciplines and prioritize remaining educated on current threats.


text: Our cybersecurity team regularly updates the Audit Committee on our cybersecurity program, material cybersecurity risks and mitigation strategies and provides quarterly cybersecurity reports that cover, among other topics, third-party assessments of the Company's cybersecurity program, developments in cybersecurity and updates to the Company's cybersecurity program and mitigation strategies.


text: In 2024, we did no t identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see the risk factor above entitled "Cybersecurity breaches and improper access to or disclosure of our data or user data, or other infiltration, hacking and phishing attacks on our systems, could harm our reputation and adversely affect our business."


text: Cyber Risk Management and Strategy We have developed and maintain processes designed to assess, identify, and manage cybersecurity risks from potential unauthorized occurrences on or through our information technology systems that may result in adverse effects on the confidentiality, integrity, and availability of these systems and the data residing therein. The scope of these processes includes risks that may be associated with both our internally managed IT systems and key business functions and sensitive data operated or managed by or maintained at third-party service providers. These processes are managed and monitored by a dedicated information technology team, which is led by our Vice President, IT, who reports to our Chief Technology Officer, and include mechanisms, controls, technologies, systems, and other processes designed to prevent or mitigate data loss, theft, misuse, or other security incidents or vulnerabilities affecting the data and maintain a stable information technology environment. We constantly monitor our information technology environment for abnormal behavior, conduct penetration and vulnerability testing, data recovery testing, security audits, and ongoing risk assessments, including due diligence on our key technology vendors and other third-party service providers that have access to the personal information we collect, use, store, and transmit. We also conduct periodic employee trainings on cyber and information security, among other topics. We leverage standard industry tools from a software and hardware perspective and maintain a cybersecurity risk insurance policy.

companyName: Cogent Biosciences, Inc.

ticker: COGT


text: We comply with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF and have accordingly certified our adherence to the respective DPF principles to the U.S. Department of Commerce with regard to the processing of personal data received from the EU, UK and Switzerland respectively. This includes compliance with the information security requirements of the DPF that prescribe that organizations creating, maintaining, using or disseminating personal data must take reasonable and appropriate measures to protect it from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the personal data.


text: In addition, we consult with outside advisors and experts on a regular basis to assist with assessing, identifying, and managing cybersecurity risks, including to anticipate future threats and trends, and their impact on our risk environment. We have retained VeraSafe, LLC ("VeraSafe") to help review and monitor our practices and processes related to personal data and compliance with applicable data protection laws. VeraSafe acts as our Data Protection Officer pursuant to the European Union and United Kingdom General Data Protection Regulation and has served in this capacity since May 2021.


text: We consider cybersecurity, along with other significant risks that we face, within our overall enterprise risk management framework. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, but we face certain ongoing cybersecurity risks threats that, if realized, are reasonably likely to materially affect us. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors," under the heading "Risks Related to Employee Matters and Managing Growth."


text: Governance Related to Cybersecurity Risks The Board of Directors, as a whole and at the committee level, has oversight for the most significant risks facing us and for our processes to identify, prioritize, assess, manage, and mitigate those risks. The Audit Committee, which is comprised solely of independent directors, has been designated by our Board to oversee cybersecurity risks. The Audit Committee receives periodic updates on cybersecurity and information technology matters and related risk exposures. The Board also receives updates from management and the Audit Committee on cybersecurity risks on at least an annual basis.


text: Our Vice President, IT, who reports to the Chief Technology Officer, a member of the executive team, has over 20 years of experience managing information technology and cybersecurity matters. The Vice President, IT and the Chief Technology Officer, together with our senior leadership team, are responsible for assessing and managing cybersecurity risks and they work collaboratively across our company to implement policies and procedures designed to protect our information and systems from cybersecurity threats and to respond promptly to any material cybersecurity incidents in accordance with our incident response plans. A cross-functional team is responsible for responding to cybersecurity incidents.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information.

companyName: NOVANTA INC

ticker: NOVT


text: We design and assess our program based on various cybersecurity frameworks, such as the National Institute of Standards and Technology ("NIST") as well as International Organization for Standardization ("ISO") 27001. We use these cybersecurity frameworks and information security standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is designed to be integrated into our overall risk management program, and shares common methodologies and governance processes across the risk management program. Key elements of our cybersecurity risk management program, include but are not limited, to the followings: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team and an external service provider principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity threats and incidents; • the use of external service providers, where appropriate, to assess, test, or otherwise assist with aspects of our cybersecurity security processes; • cybersecurity awareness training for our employees, including incident response personnel and senior management, on a quarterly basis as part of the risk mitigation strategy; • quarterly testing of the effectiveness of the cybersecurity awareness training; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; • a third-party risk management process for key service providers, based on our assessment of their criticality to our operations and respective risk profile, suppliers, and vendors; and • cybersecurity internal and external penetration testing.


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We have not experienced any incidents that have materially affected us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance The Board of Directors (the "Board") recognizes the need for continually monitoring our information security risks and cybersecurity initiatives. The Audit Committee of our Board undertakes the primary oversight responsibility over our cybersecurity risks and information security controls. Management briefs the Audit Committee on information security matters at each quarterly meeting of the Audit Committee. In addition, management updates the Audit Committee regarding any potentially material cybersecurity incidents, if any, as well as any incidents with lesser potential impact. In addition to the role the Audit Committee plays in overseeing enterprise and cybersecurity risks, the Environmental, Social and Governance ("ESG") Committee reviews and oversees our overall cybersecurity program, including its strategy and processes, and is updated by management on the status and development of the cybersecurity programs at each of the ESG Committee's meetings.