text: We established a thorough, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the Board of Directors. Our Chief Technology Officer & Digital Officer/Chief Information Officer holds overall responsibility for IT, OT, and cybersecurity. Delek follows well-organized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: Our risk assessment process related to cybersecurity includes identifying threats and conducting vulnerability assessments, likelihood and impact assessments related to our own information and OT systems as well as our third-party service providers. Delek collaborates with third-party vendors to leverage managed security services, enhancing Delek's cybersecurity capabilities. Delek possesses monitoring capabilities for both its IT and OT infrastructure. To identify material cybersecurity risks, we use a combination of technical assessments, risk analysis, vulnerability scanning, incident and event monitoring, threat intelligence and third-party assessments along with ongoing monitoring and management.

companyName: Delek US Holdings, Inc.

ticker: DK

secItem: Item 1C


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. Delek has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, Delek has increased the frequency and sophistication of the mandatory training and phishing campaign program for our employees. Delek also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. Delek is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the two drills conducted in 2023, we are dedicated to continuous improvement and proactive readiness in addressing potential challenges and ensuring the effective management of incidents.


text: Delek has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for years ended December 31, 2023, 2022 and 2021. Delek continuously assesses and enhances the confidentiality, integrity, and availability of our IT and OT assets.


text: Board of Directors Oversight The Board of Directors and executive leadership team at Delek are committed to investing the attention and resources necessary to maintain the privacy, security and integrity of our information, systems and networks and enhance the company's resiliency against cyber threats. To assist in these efforts, the Board of Directors has assigned a number of cybersecurity related responsibilities to its standing committees while retaining overall responsibility for the oversight of Delek's cybersecurity activities.


text: In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Company programs are discussed with the Board of Directors by the Chief Technology & Digital Officer Chief Information Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: In 2021 the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Company's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Company's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Company's digitalization, information and operational security policies help ensure strategic alignment of the Company's strategies with information security and risk management.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, ensuring the highest level of oversight of cybersecurity risks. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Digital Officer/Chief Information Officer reports to the Chief Executive Officer, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Digital Officer/Chief Information Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Representing the state of Israel at MIT's CDOIQ forum. Our Chief Technology & Digital Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Company. Senior leadership including our Chief Technology & Digital Officer/Chief Information Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: Risk Management and Strategy We depend on IT and OT for various operations, including refinery processes, petroleum movement monitoring in pipelines and terminals, and other critical processes and transactions. We utilize IT and OT systems across our operations to capture accounting, technical and regulatory data for archiving, analysis, and reporting. Our primary business systems mostly consist of purchased and licensed software programs that integrate with our internal solutions. Additionally, our technology encompasses a company-wide network through which employees have access to key business applications.


text: We maintain and continually enhance a comprehensive, risk-based cybersecurity program aimed at safeguarding our data, along with the data of our customers and partners. The identification, assessment, and management of cyber risks fall under our Enterprise Risk Management ("ERM") program, overseen by the Board of Directors. Our Chief Technology & Data Officer holds overall responsibility for IT, OT, and cybersecurity. Delek follows recognized cybersecurity frameworks with a Chief Information Security Officer dedicated to overseeing cybersecurity initiatives throughout the entire enterprise.


text: We manage our material cybersecurity risks through a combination of security measures, audits, training, planning, and testing. Delek has established processes for regular disaster recovery planning and response readiness testing. Our security approach also includes multiple layers of defense and testing of controls. We have implemented security measures, including segmentation, firewalls, intrusion detection systems, encryption, multi-factor authentication and data loss prevention designed to safeguard our systems and data. Furthermore, we have reinforced our data protection capabilities by investing in both hardware and software.


text: Recognizing that humans are often the most vulnerable element of even the most secure computer architectures, Delek conducts mandatory security awareness programs, including required training and phishing campaigns for our employees. Delek also conducts monthly reviews of global cybersecurity incidents to ensure that appropriate mitigation measures are in place to guard against similar threats. Delek is committed to enhancing its organizational resilience through a multiyear, comprehensive incident response tabletop drill program. Building upon the success of the drill conducted in 2024 and previous years, we remain committed to continuous improvement and proactive preparedness in addressing potential challenges and effectively managing incidents.


text: Delek has not experienced a significant cybersecurity breach or associated expenses, penalties, or settlements for the years ended December 31, 2024, 2023 and 2022. Delek continuously assesses and enhances the confidentiality, integrity, and availability of its IT and OT assets.


text: In overseeing cybersecurity risks, the Board of Directors follows the principles identified by the National Association of Corporate Directors in the oversight of cybersecurity risks. Cybersecurity risks and Company programs are discussed with the Board of Directors by the Chief Technology & Data Officer and others. Third parties are periodically engaged in the assessment of cybersecurity, including evaluating maturity under the National Institute for Security and Technology's and the International Society of Automation/ International Electrotechnical Commission's cybersecurity frameworks, testing informational and operational cyber defenses, controls, and reviews of policies and procedures.


text: In 2021, the Board of Directors established the standing Technology Committee. One of the Technology Committee's responsibilities is to review, assess, manage, and mitigate risks related to technological developments, digitalization, and information security. The Technology Committee also reviews assessments of the effectiveness of the Company's information security and technology programs, procedures, and initiatives. The Technology Committee regularly receives reports from management regarding information security and cyber risk matters, including the Company's contingency planning and information security training and compliance, and reports its activities to the Board. The Technology Committee's designated focus on these areas of the Company's digitalization, information and operational security policies help ensure strategic alignment of the Company's strategies with information security and risk management.


text: Management Oversight Our senior leadership team is actively involved in cybersecurity governance, providing oversight of cybersecurity risks at the highest levels of our organization. Establishing clear lines of ownership and accountability, along with regular and transparent communication among our standing Board committees, the Board of Directors and executives, is crucial for effectively handling cybersecurity risks and opportunities. Our Chief Technology & Data Officer reports to the Chief Executive Officer, dedicating a substantial amount of their efforts to ensure the safety and security of our networks and systems. Our Chief Technology & Data Officer has nearly 20 years of IT experience including areas of technology, cybersecurity, data, analytics, and digital transformation as well as being an Adjunct Lecturer at Tel-Aviv University and the Technion for Big Data Technologies, Data Science and Data Visualization. Our Chief Technology & Data Officer oversees a team of security professionals and regularly updates the Board of Directors on any potential risks and threats to the Company. Senior leadership including our Chief Technology & Data Officer and the Chief Information Security Officer brief the Board on information security matters multiple times throughout the year.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks In the normal course of business, we collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third party information and employee information, and certain personal identifiable information. To manage the risks associated with cybersecurity threats, we are continually assessing, reviewing and adopting new processes, systems and resources in an effort to protect the information in our possession. We have endeavored to implement policies, standards, and technical controls based on the National Institute of Standards and Technology (NIST) framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: Risk Assessment:

companyName: Solaris Energy Infrastructure, Inc.

ticker: SEI


text: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Regular assessments of our cybersecurity safeguards are conducted periodically. Management conducts regular evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies, and education programs in response. We use firewalls and protection software, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. We also incorporate external resources to aid in reviews of our cybersecurity program.


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct periodic incident response tabletop exercises and planned incident response drills to refine and update incident response processes.


text: All employees and contractors are required to receive bi-annual cybersecurity awareness training, and have deployed internal phishing campaigns to measure the effectiveness of the training program. New hires also receive training in response to drills and simulated attacks.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company information.


text: Encryption methods are used to protect sensitive data in transit and at rest. This includes the encryption of customer data, financial information, and other confidential data. We also have programs in place to monitor our retained data with the goal of identifying personal identifiable information and taking appropriate actions to secure the data.


text: We recognize that third-party service providers introduce cybersecurity risks to our business. In an effort to mitigate these risks, before engaging with any third-party service provider, we conduct due diligence to evaluate their cybersecurity capabilities. Additionally, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require them to adhere to security standards and protocols, as applicable.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management activities. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains and recognize cybersecurity measures have become more critical due to remote work, and we continuously evaluate improvements and new measures to protect our information and computing systems. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security or eliminate all risks associated with cyberattacks to us or third parties with whom we do business. No security measure is infallible. See Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats and Management's Role The Audit Committee of our Board of Directors is responsible for overseeing cybersecurity, information security and information technology risks, as well as management's actions to identify, assess, mitigate and remediate those risks. The Audit Committee assists our Board of Directors in exercising oversight of the Company's cybersecurity, information security and information technology risks. At least annually, the Audit Committee reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Chief Administrative Officer ("CAO") is responsible for upward reporting of emerging cybersecurity incidents to our Audit Committee, who in turn reports to our Board of Directors.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, our Board of Directors considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our CAO meets regularly with management to proactively review current cybersecurity threats as well as our potential exposure. Our CAO, supported by members of our management team and information technology group, briefs the Audit Committee on cybersecurity matters as needed and holds discussions on cybersecurity risks, incident trends and the effectiveness of cybersecurity measures as necessitated by emerging material cyber risks.


text: Description of Processes for Assessing, Identifying, and Managing Cybersecurity Risks The security and integrity of our information and operational technology infrastructure is critical to our business and our ability to perform day-to-day operations and deliver services. In the normal course of business, we collect and store certain sensitive Company information, including proprietary and confidential business information, trade secrets, intellectual property, sensitive third party information and employee information, and certain personal identifiable information. To manage the risks associated with cybersecurity threats, we are continually assessing, reviewing and adopting new processes, systems and resources in an effort to protect our operations and the information in our possession. We have endeavored to implement policies, standards, and technical controls based on the National Institute of Standards and Technology (NIST) framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: Risk Assessment:


text: A multi-layered system designed to protect and monitor data and cybersecurity risk has been implemented. Assessments of our cybersecurity safeguards are conducted periodically. Management conducts periodic evaluations designed to assess, identify and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies and education programs in response. We use firewalls and protection software, and we additionally rely on a third-party vendor for alerts regarding suspicious activity. We also incorporate external resources to aid in reviews of our cybersecurity program.


text: A monitoring and detection system has been implemented to help promptly identify cybersecurity incidents. In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We aim to conduct periodic incident response tabletop exercises and planned incident response drills to refine and update incident response processes.


text: All employees and contractors are required to receive bi-annual cybersecurity awareness training, and have deployed internal phishing campaigns to measure the effectiveness of the training program. New hires are also required to receive training in the form of drills and simulated attacks.


text: Users are provided with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. A multi-factor authentication process has been implemented for employees accessing company systems.


text: Impact of Risks from Cybersecurity Threats As of the date of this Annual Report, though we and the third parties with whom we do business have experienced certain cybersecurity incidents, we are not aware of cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains and recognize cybersecurity measures have become more critical due to remote work, and we continuously evaluate improvements and new measures to protect our information and computing systems. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information or operational technology systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security or eliminate all risks associated with cyberattacks on us or third parties with whom we do business. No security measure is infallible. See Part I, Item 1A. "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our information or operational technology systems.


text: Board of Directors' Oversight of Risks from Cybersecurity Threats and Management's Role The Audit Committee of our board of directors is responsible for overseeing cybersecurity, information security and information and operational technology risks, as well as management's actions to identify, assess, mitigate and remediate those risks. The Audit Committee assists our board of directors in exercising oversight of the Company's cybersecurity, information security and information and operational technology risks. At least annually, the Audit Committee reviews and discusses with management the Company's policies, procedures and practices with respect to cybersecurity, information security and information and operational technology, including related risks. In addition, our Chief Administrative Officer ("CAO") is responsible for upward reporting of significant cybersecurity incidents to our Audit Committee, who in turn reports to our board of directors, as appropriate.


text: Recognizing the importance of cybersecurity to the success and resilience of our business, our Board of Directors considers cybersecurity to be a vital aspect of corporate governance. To facilitate effective oversight, our CAO meets regularly with the Information Technology department ("IT department") which includes individuals who possess extensive experience in information technology and cybersecurity. The IT department reports directly to the CAO and is responsible for managing the Company's cybersecurity initiatives, including technical risk assessments, implementation of controls, and response to cybersecurity incidents. The IT department has significant expertise in IT systems and cybersecurity, enabling the Company to respond effectively to cybersecurity risks and incidents.


text: Our management recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our employees and investors. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our systems. Our current processes are limited and reflect the transitional state of our business and lack of resources. If and when our business evolves and we obtain additional resources, we would expect to adapt our processes accordingly.

companyName: EXICURE, INC.

ticker: XCUR


text: Technical safeguards We deploy technical safeguards that are designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls.


text: We do not currently engage third parties with respect to our cybersecurity risk management processes due to our limited resources and operations.


text: Governance of Cybersecurity Risks Pursuant to its charter, the Audit Committee of the Board has the primary responsibility for oversight and review of guidelines and policies with respect to risk assessment and risk management, including cybersecurity. The Company's Chief Executive Officer, President, and Chief Financial Officer are responsible for assessing and managing cybersecurity risks. Given our currently limited resources, we do not have dedicated personnel with specific cybersecurity expertise. When appropriate, the Company's management will report on cybersecurity issues and presents information to our Audit Committee and/or our full Board on cybersecurity matters.


text: Material Impact of Cybersecurity Risks We have not experienced a material cybersecurity incident, and we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business. However, future incidents could have a material impact on our business strategy, results of operations or financial condition.


text: Risk Management and Strategy The Company has a robust, risk-based cybersecurity program, designed to protect the company's data as well as data belonging to its customers and partners. In addition to performing its annual assessment of the overall cybersecurity risk as part of the Company's Enterprise Risk Assessment evaluation, Magnolia constantly assesses its cybersecurity risks by considering the likelihood of occurrence and the potential impact on the business. The risk identification process considers those common in the oil and gas industry and those that pertain to the technologies within the Company's applications and infrastructure.

companyName: Magnolia Oil & Gas Corp

ticker: MGY


text: Magnolia has policies that govern many aspects of computer and data security, data backup, appropriate use, and incident management. In addition, there are several key risk mitigation processes and software tools in place to prevent, detect, and respond to cybersecurity attacks. Multi-factor authentication and privileged access are required to access the Company's network in order to protect internal data and ensure appropriate access. The Company utilizes security vulnerability scanning software and 24/7 monitoring to detect and prevent significant cybersecurity threats. Magnolia uses a leading email and spam filtering solution and requires mandatory security awareness training for all employees, which is reinforced through periodic simulated phishing tests.


text: The Company uses a sophisticated backup and recovery methodology that supports the replication of data across multiple secure data centers with the intent to prevent local and cloud backup data from accidental destruction and unavailability in the event of data loss or a major cyber event. Magnolia has a cybersecurity Incident Response Plan ("IRP") in place that was established to help protect the integrity, availability, and confidentiality of information, prevent loss of service, and adhere to industry best practices. The IRP is reviewed annually and specifies the process for identifying a cybersecurity incident, conducting the initial investigation, classifying incident severity, documenting and communicating information to the appropriate parties, responding to and remediating the incident, and ongoing training. In the event of a cybersecurity incident, the IRP would be initiated to inform management, the Audit Committee, and the board of directors. The Company also has contracted retainers with third party vendors in the event they are required to assist during a major cybersecurity incident.


text: Cybersecurity risks are an important subset of Magnolia's overall risk management process. The Company considers the complexity of and reliance on cyber-connected systems in its risk assessment and prioritization. Magnolia's information security management processes and controls are based upon industry leading frameworks, including the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). Through recurring internal audits, controls are regularly reviewed, tested, and enhanced to promote best practices.


text: Magnolia engages third party consultants to benchmark its internal cybersecurity posture against the NIST CSF, perform external penetration tests, and facilitate simulated cyberattacks and incident responses. Additionally, third party service providers perform continuous managed detection and response activities. Security due diligence is performed when considering purchasing third party software and utilizing third party hosted providers. This evaluation considers the security architecture, confidentiality and criticality of data, as well as methods and practices used by third party vendors to encrypt, transmit, store, back up, and recover data.


text: The Audit Committee of the board of directors has oversight of the Company's risk management, including cybersecurity. The Company's senior officers, including its Vice President, Information Technology, are responsible for cybersecurity risk management and regularly communicate with the Audit Committee and the board of directors regarding risks and threats, including the status of current cybersecurity risk prevention and threat detection efforts. Magnolia's Vice President, Information Technology, is the primary individual responsible for assessing and managing cybersecurity risks. He has extensive experience managing information technology departments of oil and gas organizations. This includes responsibilities for securing the solutions, data, and infrastructure for both corporate and field operations technology. The Company's technology environment is managed by an experienced team of professionals who follow an extensive set of policies and procedures related to data security.


text: The Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Please see "Risk Factors" in Item 1A in this Annual Report on Form 10-K for further discussion regarding the Company's cybersecurity risks.


text: Risk Management and Strategy The Company has a robust, risk-based cybersecurity program, designed to protect the Company's data as well as data belonging to its customers and partners. In addition to performing its annual assessment of the overall cybersecurity risk as part of the Company's Enterprise Risk Assessment evaluation, Magnolia constantly assesses its cybersecurity risks by considering the likelihood of occurrence and the potential impact on the business. The risk identification process considers those common in the oil and gas industry and those that pertain to the technologies within the Company's applications and infrastructure.


text: Magnolia has policies that govern many aspects of computer and data security, data backup, appropriate use, and incident management. In addition, there are several key risk mitigation processes and software tools in place to prevent, detect, and respond to cybersecurity attacks. Multi-factor authentication and privileged access are required to access the Company's network in order to protect internal data and ensure appropriate access. The Company utilizes security vulnerability scanning software and 24/7 monitoring in an effort to detect and prevent significant cybersecurity threats. Magnolia uses email and spam filtering and requires mandatory security awareness training for all employees, which is reinforced through periodic simulated phishing tests.


text: The Company uses a backup and recovery methodology that supports the replication of data across multiple secure data centers with the intent to prevent local and cloud backup data from accidental destruction and unavailability in the event of data loss or a major cyber event. Magnolia has a cybersecurity Incident Response Plan ("IRP") in place that was established to help protect the integrity, availability, and confidentiality of information, prevent loss of service, and adhere to industry best practices. The IRP is reviewed annually and specifies the process for identifying a cybersecurity incident, conducting the initial investigation, classifying incident severity, documenting and communicating information to the appropriate parties, responding to and remediating the incident, and ongoing training. In the event of a cybersecurity incident, the IRP would be initiated to inform management, the Audit Committee, and the board of directors, as necessary. The Company also has contracted retainers with third party vendors in the event they are required to assist during a major cybersecurity incident.


text: The Company is not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Please see Item 1A—Risk Factors—Magnolia's business could be adversely affected by security threats, including cybersecurity threats, and related disruptions in this Annual Report on Form 10-K for further discussion regarding the Company's cybersecurity risks.


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. As a result, cybersecurity risk management is an integral part of our overall risk management and compliance program. Our cybersecurity risk management processes are modeled after industry best practices, such as the National Institute of Standards and Technology Cybersecurity Framework, for handling cybersecurity threats and incidents, including threats and incidents associated with the use of applications developed by third-party service providers, and facilitate coordination across different departments of our company.

companyName: Accel Entertainment, Inc.

ticker: ACEL


text: The Board has overall oversight responsibility for our cybersecurity risk management; however, it delegates cybersecurity risk management oversight to the audit committee of the Board (the "Audit Committee"). The Audit Committee is responsible for ensuring that management has processes in place designed to identify and evaluate cybersecurity risks to which we are exposed and implement processes and programs to manage cybersecurity risks and mitigate cybersecurity incidents.


text: These processes include steps for assessing the severity of a cybersecurity threat, identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. Our information technology team is responsible for assessing our cybersecurity risk management program, and we currently do not engage third parties for such assessment.


text: Our cybersecurity program is under the direction of our Chief Financial Officer ("CFO") and our Chief Technology Officer ("CTO"), who receive reports from our information technology team and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO has over 26 years of extensive information technology experience in various roles of increasing importance. His experience includes roles as Director of Technology, Information Technology Manager, Technical Manager, and Systems Analyst. Among his other duties as CTO, he manages our cybersecurity team, which comprises certified and experienced information security professionals, and he has been instrumental in the implementation and monitoring of our various cybersecurity systems and tools.


text: Management is responsible for identifying, considering, and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risk exposures are monitored, putting in place appropriate mitigation measures and maintaining cybersecurity programs, including: • Implementing a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner; • Deploying technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence; • Establishing and maintaining comprehensive incident response and recovery plans that fully address our response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis; and • Providing regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Management, including the CFO, regularly updates the Audit Committee on our cybersecurity processes, material cybersecurity risks and mitigation strategies. The Audit Committee reports all material cybersecurity risks to the Board.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2023 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors — Our success depends on the security and integrity of the systems and products offered, and security breaches or other disruptions could compromise certain information and expose us to liability, which could cause our business and reputation to suffer."


text: These processes include steps for assessing the severity of a cybersecurity threat, identifying the root cause of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider, implementing cybersecurity countermeasures and mitigation strategies, and informing management and our Board of material cybersecurity threats and incidents. Our information technology team is responsible for assessing our cybersecurity risk management program, and we currently do not engage third parties for such assessment.


text: Our cybersecurity program is under the direction of our Chief Financial Officer ("CFO") and our Chief Technology Officer ("CTO"), who receive reports from our information technology team and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CTO has over 27 years of extensive information technology experience in various roles of increasing importance. His experience includes roles as Director of Technology, Information Technology Manager, Technical Manager, and Systems Analyst. Among his other duties as CTO, he manages our cybersecurity team, which comprises certified and experienced information security professionals, and he has been instrumental in the implementation and monitoring of our various cybersecurity systems and tools.


text: Although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats in 2024 that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Risk Factors — Our success depends on the security and integrity of the systems and products offered, and security breaches or other disruptions could compromise certain information and expose us to liability, which could cause our business and reputation to suffer."


text: Risk Management and Strategy Given the importance of cybersecurity to our business, we maintain a cybersecurity program to help support the effectiveness of our systems and our preparedness for cybersecurity risks. Our program is informed by industry frameworks, such as the NIST Cybersecurity Framework, and comprises various components, including policies, procedures and protocols; threat monitoring and alerting; auditing and assessments; and other security controls and tools. We also require cybersecurity trainings when onboarding new employees and contractors, as well as annual cybersecurity awareness training for our employees and contractors.

companyName: GRAIL, Inc.

ticker: GRAL


text: We use various means, including our Enterprise Risk Management ("ERM") process, in an effort to assess and manage cybersecurity risks that may be associated with our systems, operations, and third-party service providers. We also are working towards enhancing our cybersecurity risk management practices and various other security controls following the Spin-Off, and have at times conducted internal audits and engaged external assessors to help review our cybersecurity program and identify opportunities for maturing our program. For additional information, see "Item 1A—Risk Factors".


text: Identifying, assessing and managing cybersecurity risks Our cybersecurity team and the owners of information technology systems across the business, led by our Chief Security Officer ("CSO"), monitor current events and trends related to cybersecurity in an effort to anticipate potential risks and threats on current systems and operations. We have implemented or are in the process of implementing various processes to identify, review and track risks to our systems and operations, including through the use of third-party solutions. We also seek to conduct due diligence in connection with the onboarding of new third-party vendors, and reviews are conducted on our critical third-party vendors. Following these assessments, we utilize the findings to improve and mature our cybersecurity practices and to promote continuous improvement. In addition, we have implemented a cybersecurity awareness program to train our employees and contractors on key cyber threats, which includes phishing exercises.


text: In the event of a cybersecurity incident, we have policies and processes for detecting threats and managing incident response. We also periodically conduct cross-functional exercises and activities to help detect, assess and respond to cybersecurity incidents, and have relationships with external providers to assist with incident response efforts, as needed. We also seek to contractually require our third-party service providers to notify us in the event a cybersecurity incident within their systems or services impacts our data or operations. We maintain specific coverage to help mitigate losses associated with certain cybersecurity incidents that impact our or our third parties' systems, networks and technology.


text: As of December 31, 2024, we are not aware of any risks from cybersecurity threats, or from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company. While we maintain a cybersecurity program, the techniques used to infiltrate information technology systems continue to evolve. Accordingly, we may not be able to timely detect threats or anticipate and implement adequate security measures. For additional information, see "Item 1A—Risk Factors".


text: Our Board of Directors administers its cybersecurity risk oversight function through its Audit Committee. The Audit Committee is charged with reviewing our cybersecurity and other information technology risks, controls, and procedures, including our plan to mitigate cybersecurity risks and respond to data or cybersecurity incidents. The Audit Committee is also charged with reviewing with management cybersecurity issues that could affect the adequacy of our internal controls. At least annually, the Audit Committee meets directly with the CSO and the executive leadership team and receives a report on our cybersecurity program, posture, risks and other matters. At least annually, we conduct an organization-wide ERM process to evaluate key risks in different areas of the business. Among those risks, cybersecurity risks are identified, and scores representing the potential likelihood and severity of each risk are determined. The executive leadership team and Audit Committee receive a direct report of the ERM program findings, including these cybersecurity risks. Third-party assessors, consultants, counsel or other parties also participate in Audit Committee discussions as needed.


text: More broadly, the Audit Committee reviews our policies and practices with respect to risk assessment and risk management, including results from our overall Enterprise Risk Management ("ERM"), and discusses with management our major financial risk exposures and the steps that have been taken to monitor and control such exposures. Cybersecurity is a key piece of our overall ERM program. The Audit Committee oversees the activities of, and meets regularly with, our Chief Compliance Officer, and receives direct reports from the Chief Compliance Officer regarding the ERM structure and activities of our compliance program, including updates on training, policies, auditing and monitoring, investigations and any corrective and preventive actions. As part of the ERM program, our Chief Compliance Officer gathers information about cybersecurity risk, and that information is included in the Chief Compliance Officer's report to the Audit Committee.


text: The CSO is responsible for implementing and overseeing the controls and processes employed to identify, assess and manage the Company's risks from cybersecurity threats. We also maintain a Privacy and Security Steering Committee that regularly meets to review and discuss cybersecurity issues and review our cybersecurity-related metrics. The Privacy and Security Steering Committee is comprised of the CSO and other representatives from our cybersecurity, IT, legal, and privacy teams. The CSO, cybersecurity team, and members of the Privacy and Security Steering Committee combined have decades of experience in managing relevant information technology and cybersecurity matters. The CSO also provides regular briefings to our executive leadership team, including the CEO and CFO, and our Audit Committee on cybersecurity matters, such as threats, events, and the state of the program, and at least annually as part of our ERM process. Our security program also includes a yearly audit of our controls towards cybersecurity certifications, including ISO 27001, SOC 2 Type 2, PCI DSS, UK Cyber Essentials, and others.


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, protecting our stakeholders, and maintaining customer trust. Our approach to managing cybersecurity risks, which includes periodic risk assessments, implementing and overseeing governance and policies, an incident response plan, ongoing training and awareness programs, and a commitment to continuous improvement.

companyName: Ranger Energy Services, Inc.

ticker: RNGR


text: Our risk assessment process involves periodic vulnerability assessments and monitoring of emerging threats. Our policies and procedures are designed to ensure compliance with relevant regulations, to consider industry practices, and we periodically review and update them to address evolving cybersecurity risks.


text: In the event of a cybersecurity incident, we have an incident response plan in place. This plan includes detection, response, and communication with stakeholders. Incident response is supported by appropriate third-party experts to address, assess and respond to the event. The plan calls for the mobilization of a response team including both internal and external resources as well as communication protocols so that event information is shared on a proactive basis. We aim to prioritize transparency and accountability, and we are committed to providing timely and accurate information to our stakeholders in the event of a breach.


text: We understand the importance of educating our employees about cybersecurity risks, and, over the past two years have initiated awareness and training programs internally specifically targeted to employees with a goal of continually increasing employee education. This initiative aims to foster a culture of cybersecurity awareness and empower our employees to be vigilant in identifying and mitigating potential threats.


text: Our Vice President of Information Technology reports to the Company's Chief Financial Officer and is the head of the Company's cybersecurity team. This role is responsible for assessing and managing the Company's cyber risk management program, informing senior management regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and supervising such efforts. Senior leadership has been specifically trained and is credentialed in cybersecurity risk assessment and oversight.


text: The Audit Committee of the Board of Directors oversees the Company's cybersecurity posture and the steps taken by management to monitor, identify, and mitigate cybersecurity risks. The Information Technology team briefs the Audit Committee on the effectiveness of the Company's cyber risk management program, typically on an annual basis.


text: We are dedicated to continuous improvement in our cybersecurity program. We regularly monitor, evaluate, and aim to enhance our capabilities through investments in technology, infrastructure, and personnel. Our goal is to try to stay ahead of emerging threats and maintain the highest level of cybersecurity resilience.


text: In conclusion, by prioritizing cybersecurity, we aim to protect the interests of our stakeholders, promote business continuity, and uphold the trust that our customers place in us. Notwithstanding the approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: We recognize the critical importance of cybersecurity in safeguarding sensitive information, protecting our stakeholders, and maintaining customer trust. Our approach to managing cybersecurity risks, includes periodic risk assessments, implementing and overseeing governance and policies, an incident response plan, ongoing training and awareness programs, and a commitment to continuous improvement.


text: Our risk assessment process involves periodic vulnerability assessments and monitoring of emerging threats. Our policies and procedures are designed to ensure compliance with relevant regulations and to consider industry practices, and we periodically review and update them to address evolving cybersecurity risks.


text: We are dedicated to continuous improvement in our cybersecurity program. We regularly monitor, evaluate, and aim to enhance our capabilities through investments in technology, infrastructure, and personnel. Our goal is to stay ahead of emerging threats and maintain the highest level of cybersecurity resilience.


text: We depend on information systems and related technologies for internal purposes, including secure data storage, processing, and transmission, as well as in our interactions with our business associates, such as customers and suppliers. We also rely on third-party business associates, with whom we may share data and services, to defend their digital technologies and services against attack.

companyName: Cactus, Inc.

ticker: WHD


text: Managing Material Risks & Integrated Overall Risk Management We attempt to integrate cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. We depend on various controls, policies, procedures and programs ("Risk Controls") to manage our risks, including risks associated with our information systems. Risks and Risk Controls are included as part of our annual enterprise risk management ("ERM") program. Our risk controls include our administrative, physical, and technical controls ("Cyber Risk Controls"). We are dependent on our Cyber Risk Controls to protect our information systems and the data that resides on or is transmitted through them. The Cyber Risk Controls are in many cases integrated with our other Risk Controls in an attempt to maximize their effectiveness.


text: Engaging Third Parties on Risk Management We collaborate with our clients, vendors and other third parties to develop information systems and protect against cybersecurity threats. We engage third-party security experts for risk assessments and program enhancements.


text: Managing Third Party Risk There are risks associated with the use of vendors, service providers and other third parties that provide information system services to us, process information on our behalf, or have access to our information. We evaluate third-party service providers' cybersecurity posture and seek to mitigate risk through contractual safeguards, monitoring, and incident response plans.


text: Risks from Cybersecurity Incidents While we have experienced and will likely continue to experience varying degrees of cyber incidents in the normal conduct of our business, including attacks resulting from phishing emails and ransomware infections, those incidents have not materially affected the Company's business strategy, results of operations, or financial condition. There can be no assurance that the systems we have designed to prevent or limit the effects of cyber incidents or attacks will be sufficient to prevent or detect future material consequences arising from incidents or attacks, or to avoid a material adverse impact on our systems after such incidents or attacks do occur. However, the Company does not currently anticipate that risks from cybersecurity threats are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition. Governance.


text: Risk Management Personnel Our Director of IT Infrastructure and Cybersecurity has direct responsibility for assessing, monitoring and managing risks related to cybersecurity threats in conjunction with the Vice President of Information Technology. Third party experts and/or consultants are retained to help identify, assess and monitor cybersecurity incidents and related risks. Our Director of IT Infrastructure and Cybersecurity has been in that position with the Company since 2019 and, including prior experience, has over 12 years' experience in managing IT infrastructure, architecture and security. Our Vice President of Information Technology has been with the Company in his current position and similar roles since its inception in 2011. Prior to joining the Company, he had over 20 years' experience in oversight of Information Technology systems including ERP systems, infrastructure, and networking.


text: Monitoring Cybersecurity Risks and Incidents Our Director of IT Infrastructure and Cybersecurity meets regularly with members of our executive team to discuss and review risks related to cybersecurity. The reviews may include evaluations of risks and incidents identified by third-party providers retained to review our cyber risk as well as cybersecurity threat scenario planning. Identified risks related to cybersecurity threats may also be analyzed as part of our ERM process.


text: Board of Director Oversight Our Audit Committee is responsible for oversight of our programs and procedures related to cybersecurity risk. Management provides periodic reports to the Audit Committee on cybersecurity risk. The Audit Committee reports significant findings from these reports to the full Board of Directors.


text: Managing Material Risks & Integrated Overall Risk Management We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cyber risk awareness. We depend on various controls, policies, procedures and programs ("Risk Controls") to manage our risks, including risks associated with our information systems. Risks Assessment and Risk Controls are included as part of our annual enterprise risk management ("ERM") program. Our risk controls include our administrative, physical, and technical controls ("Cyber Risk Controls"). We are dependent on our Cyber Risk Controls to protect our information systems and the data that resides on or is transmitted through them. The Cyber Risk Controls are in many cases integrated with our other Risk Controls in an attempt to maximize their effectiveness.


text: Risk Management Personnel Our Director of Cybersecurity and Networking has direct responsibility for assessing, monitoring and managing risks related to cybersecurity threats in conjunction with the Vice President of Information Technology. Third party experts and/or consultants are retained to help identify, assess and monitor cybersecurity incidents and related risks. Our Director of Cybersecurity and Networking has been in that position with the Company since 2019 and, including prior experience, has over 13 years' experience in managing IT infrastructure, architecture and security. Our Vice President of Information Technology has been with the Company in his current position and similar roles since its inception in 2011. Prior to joining the Company, he had over 20 years' experience in oversight of Information Technology systems including ERP systems, infrastructure, and networking.


text: Monitoring Cybersecurity Risks and Incidents Our Director of IT Cybersecurity and Networking meets regularly with members of our executive team to discuss and review risks related to cybersecurity. The reviews may include evaluations of risks and incidents identified by third-party providers retained to review our cyber risk as well as cybersecurity threat scenario planning. Identified risks related to cybersecurity threats may also be analyzed as part of our ERM process.


text: Risk Management and Strategy. We employ processes for assessing, identifying, and managing material risks from cybersecurity threats. In conjunction with EBM, Inc., we employ best in class Endpoint Detection and Response with 24/7 SOC at the Endpoints. We also utilize MFA and Geolocation enforcement where available. We continuously monitor and maintain our network infrastructure including consistent vulnerability monitoring and remediation. We also engage in quarterly phishing campaigns as well as cybersecurity awareness training to our end users to keep them vigilant in being able to detect threats.

companyName: Azitra, Inc.

ticker: AZTR


text: Although we develop and maintain systems and controls designed to prevent cybersecurity threats from occurring, and we have a process to identify and mitigate threats, the development and maintenance of these systems, controls and processes is costly and requires ongoing monitoring and updating as technologies change and efforts to overcome security measures become increasingly sophisticated. Moreover, despite our efforts, the possibility of these events occurring cannot be eliminated entirely. As we outsource more of our information systems to vendors, engage in more electronic transactions with service providers and patients, and rely more on cloud-based information systems, the related security risks will increase and we will need to expend additional resources to protect our technology and information systems. In addition, there can be no assurance that our internal information technology systems or those of our third-party contractors, or our consultants' efforts to implement adequate security and control measures, will be sufficient to protect us against breakdowns, service disruption, data deterioration or loss in the event of a system malfunction, or prevent data from being stolen or corrupted in the event of a cyberattack, security breach, industrial espionage attacks or insider threat attacks which could result in financial, legal, business or reputational harm.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Governance. Our senior management team conducts the regular assessment and management of material risks from cybersecurity threats, including review with our IT team and third-party service providers. All employees and consultants are directed to report to our senior management any irregular or suspicious activity that could indicate a cybersecurity threat or incident. The Audit Committee of our Board of Directors evaluates our cybersecurity assessment and management policies, including quarterly interviews with our senior officers and independent registered accounting firm.


text: We protect our digital systems and data through a comprehensive cybersecurity management program, which includes a dedicated cybersecurity function, risk assessments, policies and procedures, and technical measures and related services from third party service providers. We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. As part of our cybersecurity management program, we operate a Cyber Fusion Center ("CFC") to monitor both internal and external cybersecurity threats, conduct initial assessment of severity, coordinate incident response resources, reduce incident response time, and shift toward a proactive cyber-defense model, which includes a dedicated threat intelligence program that leverages custom intelligence platforms as well as industry specific professional associations and ongoing threat hunting. Through our cybersecurity risk management program, we monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and countermeasures made to defend against such threats.

companyName: Baker Hughes Co

ticker: BKR


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to cybersecurity and privacy threats and incidents, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. We conduct regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through external and internal reporting channels.


text: Enterprise Risk Management Process Integration Cybersecurity risk management processes are an integral part of our enterprise risk management, which is overseen by the Audit Committee of the Board. Our processes include periodic program maturity assessments, ongoing information technology risk assessments, and third-party security risks assessments.


text: Our cybersecurity risk management efforts have also been integrated into the overall Enterprise Risk Management ("ERM") process, which includes assessment of cybersecurity risks that could result in significant operational disruption to the Company, such as production disruption, business downtime, loss of containment or other operation interruptions, as well as risks that could have significant reputational and compliance/regulatory impact. Cybersecurity risks identified and tracked through our ERM risk register have assigned risk owners at the executive leadership level and risk delegates who are responsible to identify and manage risk mitigation actions. Key risk indicators are updated quarterly by risk delegates and communicated to our executive leadership and the Audit Committee.


text: We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, and program enhancements. We also include cybersecurity training as part of our required annual employee training program. In addition, cybersecurity and privacy training and awareness is integrated and continues throughout the year, utilizing various delivery methods such as phishing campaigns, training sessions, and informational articles.


text: Third Party Security Experts We engage third party security experts to supplement our internal CFC team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct cybersecurity tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.


text: Identification of Threats Associated with Third Parties Baker Hughes utilizes a third-party risk management ("TPRM") program to identify, assess, monitor, and mitigate risks associated with third-party relationships, including cybersecurity risks. We conduct initial risk assessments of third-party suppliers and service providers based on various factors to classify each into a risk category. Our TPRM program is designed to apply our most rigorous processes to those suppliers and service providers that are classified into the highest risk category. These processes include due diligence assessments of third-party suppliers and service providers that have access to Baker Hughes networks, confidential information, and information systems in order to assess the risks from cybersecurity threats that could impact our suppliers and third-party service providers. We leverage external partners to assist with the regular assessment of our top priority suppliers and third-party service providers to identify, review and address risks, including deeper reviews of their cybersecurity controls. We track the identified deficiencies and include with other cybersecurity metrics based on their severity. We also require that our suppliers and third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards.


text: Incidents & Risks We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations or financial condition. For more information on our cybersecurity risks, see "Technology Risks" identified in the "Risk Factors" section of Part 1 of Item 1A herein.


text: Board of Directors Oversight responsibilities for our cybersecurity and digital trust compliance programs and risks lie with the Audit Committee of the Board. The Board is actively engaged in the oversight of our cybersecurity program and oversees all operational, financial, strategic, and reputational risks with oversight of specific risks undertaken with the committee structure including risks related to cybersecurity, privacy, and technology.


text: The Audit Committee receives reports on the Company's cybersecurity program and developments from our Chief Information Officer ("CIO"), who reports to the Chief Executive Officer, and our CISO, who reports to the CIO, at each of our regular meetings, which occur five times a year. These reports typically include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status, as well as a review of our third-party service providers. Our digital technology, legal, and the corporate audit functions also routinely present to the Audit Committee on key cybersecurity topics and, on at least an annual basis, the Board receives reports on the Company's cybersecurity program and developments from the CIO and CISO.


text: Our programs are focused on building digital trust through sound oversight of cybersecurity and data privacy protections and the responsible use of data and technology. We operate a CFC, and we have a cross-functional approach to addressing cybersecurity-related risks through the functional compliance structures in our digital technology and legal organizations with oversight from the corporate audit and controllership functions. The cybersecurity and legal functions employ full time cybersecurity and privacy roles with expertise in managing cybersecurity and privacy compliance and risks and responding to incidents.


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital trust compliance programs. The senior executive leadership-level Cybersecurity Steering Committee ("CSC") is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CSC also receives monthly reports on the Company's cybersecurity program and developments from our CISO and legal representatives. The CSC is chaired by our CISO. The senior executive leadership members include the CIO, Chief Legal Officer, Chief Financial Officer, Chief Compliance Officer, and Senior Vice President of Operations Excellence.


text: The CISO has over 25 years of business experience in information technology and cybersecurity and is a long-standing certified information systems security professional ("CISSP") with the International Information System Security Certification Consortium.


text: We have an Incident Response Team ("IRT") that consists primarily of representatives from the CFC, legal, corporate communications, finance, and other relevant stakeholders. The IRT follows the guidance as outlined in the IRP to respond to cybersecurity incidents and escalate as necessary to the CSC based on a defined severity matrix. Internal legal and finance stakeholders are responsible for assessing materiality of risks in consultation with the IRT, CSC, the CEO, and external advisors.


text: We protect our digital systems and data through a comprehensive cybersecurity management program, which includes a dedicated cybersecurity function, risk assessments, policies and procedures, and technical measures and related services from third party service providers. We have a dedicated Chief Information Security Officer ("CISO") with overall responsibility for the cybersecurity program, including threat detection and response, vulnerability management, governance, risk and compliance, security strategy and architecture, security engineering and operations, product and operational technology security. As part of our cybersecurity management program, we operate a CFC to monitor both internal and external cybersecurity threats, conduct initial assessment of severity, coordinate incident response resources, reduce incident response time, and shift toward a proactive cyber-defense model, which includes a dedicated threat intelligence program that leverages custom intelligence platforms as well as industry specific professional associations and ongoing threat hunting. Through our cybersecurity risk management program, we monitor cybersecurity vulnerabilities and potential attack vectors and evaluate the potential operational and financial effects of any threat and countermeasures made to defend against such threats.


text: We have established policies and procedures, including our Incident Response Plan ("IRP"), for assessing, identifying, managing, and responding to events that may jeopardize the company digital information or systems, including protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our IRP provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities to triage, assess severity, escalate, contain, investigate, and remediate incidents, as well as to comply with applicable legal obligations and mitigate brand and reputational damage. We conduct regular tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, employees and stakeholders can report cybersecurity threats, cybersecurity and data privacy incidents, or other concerns through external and internal reporting channels.


text: Third Party Security Experts We engage third party security experts to supplement our internal CFC team as well as for assessments, penetration tests and program enhancements, including vulnerability assessments, security framework maturity assessments and identification of areas for continued focus and improvement. In addition, our third-party experts work with us to conduct tabletop exercises and internal phishing awareness campaigns. We use the findings of these exercises to improve our practices, procedures, and technologies. We also engage third party security experts to support our cybersecurity threat and incident response management and maintain information security risk insurance coverage.


text: Identification of Threats Associated with Third Parties Baker Hughes utilizes a third-party risk management ("TPRM") program to identify, assess, monitor, and mitigate risks associated with suppliers and vendors, including cybersecurity risks. We conduct initial risk assessments of third-party suppliers and service providers based on various factors to classify each into a risk category. Our TPRM program is designed to apply our most rigorous processes to those suppliers and service providers that are classified into the highest risk category. These processes include due diligence assessments of third-party suppliers and service providers that have access to Baker Hughes networks, confidential information, and information systems in order to assess the risks from cybersecurity threats that could impact our suppliers and third-party service providers. We leverage external partners to assist with the regular assessment of our top priority suppliers and third-party service providers to identify, review and address risks, including deeper reviews of their cybersecurity controls. We track the identified deficiencies and include with other cybersecurity metrics based on their severity. We also require that our suppliers and third-party service providers have in place appropriate technical and organizational security measures and security-control principles based on recognized cybersecurity standards.


text: Incidents & Risks We have not experienced a material cybersecurity incident and although we are subject to ongoing and evolving cybersecurity threats, we are not aware of any material risks from cybersecurity threats that have materially affected the Company. For more information on our cybersecurity risks, see "Technology Risks" identified in the "Risk Factors" section of Part 1 of Item 1A herein.


text: Board of Directors Oversight responsibilities for our cybersecurity and digital security programs and risks lie with the Audit Committee of the Board. The Board is actively engaged in the oversight of our cybersecurity and digital security programs and oversees all operational, financial, strategic, and reputational risks with oversight of specific risks undertaken with the committee structure including risks related to cybersecurity, data security, and technology.


text: The Audit Committee receives reports on the Company's cybersecurity program and developments from our Chief Information Officer ("CIO"), who reports to the Chief Executive Officer, and our CISO, who reports to the CIO, at each of our regular meetings, which occur at least four times per year. These reports typically include analyses of recent cybersecurity threats and incidents at the Company and across the industry, as well as a review of our own security controls, assessments and program maturity, and risk mitigation status, as well as a review of our third-party service providers. Our digital technology, legal, and the corporate audit functions also routinely present to the Audit Committee on key cybersecurity topics and, on at least an annual basis, the Board receives reports on the Company's cybersecurity program and developments from the CIO and CISO.


text: Our senior executive leadership is actively engaged in the oversight and strategic direction of our cybersecurity and digital data protection programs. The senior executive leadership-level Cybersecurity Steering Committee ("CSC") is responsible for assessing cybersecurity risks, providing direction and oversight for risk mitigation action, and assisting the Audit Committee in overseeing the Company's cybersecurity risks. The CSC also receives monthly reports on the Company's cybersecurity program and developments from our CISO and legal representatives. The CSC is chaired by our CISO. The senior executive leadership members include the CIO, Chief Legal Officer, Chief Financial Officer, Chief Compliance Officer, and Senior Vice President, Enterprise Operational Excellence.


text: Risk Management, Strategy and Procedures We, our Investment Adviser and its affiliates regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by Carlyle's Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the our data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with Carlyle's business segment teams, including our Investment Adviser, to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. The GTS team has procedures in place to report cybersecurity threats or incidents on a periodic basis. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as Carlyle's acceptable use policy, upon hire and annually.

companyName: Carlyle Credit Solutions, Inc.


text: In addition, Carlyle partners with third parties to assess the effectiveness of its cybersecurity program, which includes the Company. Third party assessments will include audits and assessments performed under the direction of Carlyle's internal audit team, which co-sources with third-party cybersecurity experts in conducting its reviews. GTS also administers Carlyle's cyber third-party risk management program, which assesses external service providers before onboarding and provides ongoing monitoring in accordance with certain risk-based cybersecurity criteria.


text: To our knowledge cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K "Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."


text: Risk Management Oversight and Governance Our Board of Directors oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Directors (the "Audit Committee") oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from Carlyle on our enterprise risk profile on an annual basis. In addition, Carlyle's Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs Carlyle's Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies, standards, processes, and practices throughout our operations that are designed to address cybersecurity threats, events, and incidents. In particular, our cybersecurity program supports security governance, security awareness and training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and incident response capabilities. In addition, our incident response plan contains escalation and reporting protocols, including reporting to our disclosure committee to consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the disclosure committee with these materiality assessments and any resulting reporting requirements.


text: Carlyle's CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, and Principal Accounting Officer, among certain other senior executives of our Investment Adviser, is responsible for leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 30 years of experience in information security and is a Certified Information Systems Security Professional. As described above, Carlyle's CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: Risk Management, Strategy and Procedures We, our Investment Adviser and its affiliates regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by Carlyle's Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise. Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the our data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with Carlyle's business segment teams, including our Investment Adviser, to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. The GTS team has procedures in place to report cybersecurity threats or incidents on a periodic basis. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, mobile device management software, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment and third-party risk and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as Carlyle's acceptable use policy, upon hire and annually.


text: To our knowledge cybersecurity threats, including as a result of any previous detected or undetected cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition, however, we may learn new facts about these detected or undetected incidents and these facts may lead us to change this materiality assessment. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A of this Form 10-K"Risk Factors—Risks Related to Our Business and Structure—Cybersecurity risks and cyber incidents may adversely affect our business or those of our portfolio companies by causing a disruption to our operations, a compromise or corruption of confidential information and/or damage to business relationships, or those of our portfolio companies, all of which could negatively impact our business, results of operations or financial condition."


text: Carlyle's CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, and Principal Accounting Officer, among certain other senior executives of our Investment Adviser, is responsible for leading the assessment and management of cybersecurity risks. The current Carlyle CISO has over 22 years of experience in information security and that includes key roles managing cybersecurity risk in both government and the private sector. As described above, Carlyle's CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: Overview and Leadership Our enterprise risk management framework considers cybersecurity risk alongside other risks as part of our overall enterprise risk assessment process. As part of our enterprise risk management, we maintain a comprehensive information technology, data governance and cybersecurity program that leverages people, processes and technology, to support the effectiveness of our information technology systems and identify, prevent and mitigate information technology and data security risks. Our cybersecurity program is aligned to the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF). Our cybersecurity team utilizes a variety of tools, processes and outside resources to continue to evolve and maintain our cybersecurity program's maturity across the elements of NIST CSF.

companyName: Simply Good Foods Co

ticker: SMPL


text: Our information security program is focused on detecting, identifying, defending against and mitigating the effect of cybersecurity risks to guard our information technology systems and protect the confidentiality, integrity, and availability of our information technology processes and data. Our Board of Directors is responsible for the oversight of cybersecurity risks, including through the delegation of certain cybersecurity oversight authority to the Audit Committee of the Board.


text: Our information security program also addresses cybersecurity risks associated with our use of third-party service providers. We use systems and processes designed to assess, identify and reduce the potential impact of a cybersecurity incident at any of our third-party service providers. We assess information security controls of certain of our third-party service providers as part of our third-party information technology risk due diligence, and we conduct third-party vulnerability analysis regularly.


text: Our information security function and management team is led by our Chief Information Officer, who has approximately 26 years of experience in the information technology area and reports to our Chief Financial Officer and our Director of Infrastructure and Controls. Our Director of Infrastructure and Controls has approximately 20 years of experience in the information technology area.


text: The information security team is responsible for monitoring, managing, assessing and mitigating cybersecurity risks and threats on a day-to-day basis and is responsible for improving and strengthening our cybersecurity environment. As discussed below, the information security team works with nationally recognized third parties and licenses various cybersecurity tools and products to assist with assessing and managing cybersecurity risks. The information security team regularly interacts and discusses cybersecurity matters with our Chief Financial Officer and a member of our Board who serves as the Board's primary contact on cybersecurity matters as a part of our company-wide risk management system. The information security team has plans and processes in place to escalate certain cybersecurity issues to senior management and the Board or the Audit Committee, including to determine whether, when and how to publicly disclose any material cybersecurity event. In addition, we maintain insurance to help reduce our exposure from potential losses should a cybersecurity incident arise.


text: The information security team undertakes or engages in these practices and activities, among others, as part of the Company's risk management system: • updating of software and hardware (including firmware) for vulnerabilities and required patches; • regular employee training and education to identify and avoid cybersecurity risks and threats; • developing, implementing and testing incident response and information recovery plans to assess and respond to cybersecurity threats and incidents; • collaborating with our internal audit function and other internal teams for testing cybersecurity controls and procedures; • identifying and managing cybersecurity risks presented by third parties, including cybersecurity vendors, cybersecurity software and hardware providers, other vendors and customers, service providers and other parties with access to our systems and data; and the systems of third parties that could adversely affect our operations or business in the event of a cybersecurity incident affecting those third-party systems; • overseeing threat intelligence systems and notification procedures; and • maintaining technology solutions for cybersecurity prevention and defense, including outside firewalls, multi-factor authentication systems, separate intrusion prevention and detection systems, anti-virus and anti-malware products and remote access controls.


text: Use of Third Parties We have engaged, and intend to continue to engage, nationally recognized third parties to assist us in assessing, among other things: • emerging cybersecurity risks; • threat identification; • threat neutralization; • cybersecurity environment testing; • penetration testing; • phishing and social engineering methods; and • best practices for continued compliance and training.


text: When risks or threats are identified to us by a third party, the information security team is responsible for assessing the risk or threat and determining a course of action to mitigate the risk or neutralize the threat.


text: Effect of Cybersecurity Events While no previous cybersecurity incidents have materially affected the Company, a cybersecurity incident could have a material effect on our results of operations and financial condition. As described above under "Item 1A-Risk Factors - Any inadequacy, failure or interruption of our information technology systems may harm our ability to effectively operate our business, and our business is subject to online security risks, including security breaches and identity theft," a material cybersecurity incident could disrupt our business, lead to the loss of data or cause us to suffer financial and/or reputational damage, in addition to litigation or remediation costs or penalties.