text: The scope of the risk assessment process includes but is not limited to the following asset types: a. Applications b. Business units h. Security infrastructure m. Cloud.


text: The Company conducts detailed due diligence (as described below), contract reviews and ongoing monitoring of high-risk third-party service providers. Third-party service providers hosting an application or providing a service that processes, analyzes, transmits, stores, or reports the Company's sensitive information must complete a control questionnaire. Vendors are subject to rigorous review of the vendor's internal control policies, procedures, data security and contingency capabilities. Ongoing monitoring is also performed annually on selected service providers. The program requires service providers on the ongoing monitoring list to provide the Company with a third-party security penetration assessment, and other artifacts based on the type of information processed, transmitted, or stored, annually.

companyName: COMMERCE BANCSHARES INC /MO/

ticker: CBSH

secItem: Item 1C


text: The Company has also developed a comprehensive set of key risk metrics to evaluate ongoing cybersecurity threats and the security risk exposure. These metrics are used for threat trending, identifying attack vectors, and determining the effectiveness of controls. Key risk metrics are provided to management monthly and reported through the Governance Model to the Board.


text: Security event monitoring and detection The Company formally tracks and reports on major identified risks and vulnerabilities and the results of their analysis and evaluation. These details can then be used to track and monitor their successful management as part of the activity to deliver the required, anticipated results. Security risks are categorized by Practice or Vulnerability (exploitable). The information is reported in the monthly security metrics report along with quarterly reporting to the ISSB.


text: The Company actively monitors alerts and shared intelligence from a variety of industry-standard sources and takes appropriate actions when warranted. As new threats and vulnerabilities emerge that threaten its systems and data, the Company continues to evaluate and address these threats through a layered security approach.


text: The Company engages cybersecurity assessors and consultants, including third party auditors, to perform annual penetration testing and risk assessments. These external parties provide validation of our processes and controls, ensuring they meet industry best practices and regulatory standards.


text: The Company performs network and application penetration testing on external high-risk applications as well as network penetration testing across its production, test, and disaster recovery networks. The Company also performs tests on its operational defense and response to assess the ability to detect and respond to a threat actor. This allows the Company to test lateral movement, exploitation, data exfiltration, and evaluate its security posture around three primary security functions: detection, prevention, and response. The Company regularly participates in desktop exercises to help demonstrate incident preparedness and regulatory compliance. All testing results are reported to the Board quarterly through the Governance Model.


text: Incident materiality The Commerce Bank Cybersecurity Incident Investigation and Response Plan is a component of the Information Security policy and sets forth the severity categories and processes required to assess the impact of a cyber-related incident to the Company. The impact is categorized in one of five severity levels and is expressed in terms of financial loss, strategic objectives, customer, legal and regulatory, reputation, and service interruption. The incident response plan includes timely notification of a material cybersecurity incident to the Board of Directors and other members of senior management.


text: Like other financial institutions, the Company experiences malicious cyber activity on an ongoing basis directed at its websites, computer systems, software, networks and users. This malicious activity includes attempts at unauthorized access, implantation of computer viruses or malware, and denial of service attacks. The Company also experiences large volumes of phishing and other forms of social engineering attempted for the purpose of perpetrating fraud. While, to date, malicious cyber activity, cyberattacks and other information security breaches have not had a material adverse impact on the Company, risk to its systems remains significant. See Technology Risk "A successful cyber attack or other computer system breach could significantly harm the Company, its reputation and its customers" within Risk Factors Item 1a.


text: Risk Management and Strategy CMC has established a comprehensive cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats to our computer systems, outsourced services, communications systems, industrial processing equipment, hardware and software, and to safeguard our data and our customers' data. Our risk management program includes a documented cybersecurity incident response plan and a data breach response plan (the "response plans") that outline how to respond to and contain incidents and data breaches. Additionally, we maintain a cybersecurity incident disclosure and evaluation plan (the "disclosure plan") which would be used to assess the impact of a cybersecurity incident and promptly issue required SEC disclosures if needed. The response plans and disclosure plan are adapted depending on the type of incident or data breach and are tested at least once per year. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our risk management program and utilize third parties to regularly review our response plans.

companyName: COMMERCIAL METALS Co

ticker: CMC


text: CMC recognizes the critical importance of a well-developed cybersecurity risk management program within an ever-changing threat landscape and has designed ongoing cybersecurity management protocols that are embedded into our global business processes and activities. These protocols include, but are not limited to, penetration testing, vulnerability scanning, attack simulations and appropriate internal controls, along with independent third-party audits conducted to evaluate compliance with security standards and best practices. The protocols are designed by our Chief Information Security Officer ("CISO") and implemented by an experienced team including our information security and various technology departments. We engage expert consultants and third-party service providers to review our cybersecurity controls and readiness, alert us to potential improvements and provide incremental industry knowledge and expertise. Additionally, employees are required to complete cybersecurity training at the start of their employment and annually thereafter and are regularly exposed to phishing awareness campaigns that simulate real-world threats.


text: Our cybersecurity risk management program also addresses cybersecurity risks associated with our use of third-party service providers and our vendors. We proactively manage these risks by reviewing current and prospective third-party service providers' compliance with our established relevant privacy and data security standards. We also require our key vendors to complete security questionnaires and we conduct audits and vulnerability scans related to them. Depending on the nature of the services provided and the sensitivity of the relevant data involved, our service provider and vendor management processes may involve different levels of assessment and impose additional obligations related to cybersecurity on the service provider or vendor.


text: While previous cybersecurity incidents and threats have not materially adversely affected our business strategy, results of operations or financial condition to date, any actual or perceived breach of our security could damage our reputation or subject us to third-party lawsuits, regulatory investigations and fines or other actions or liabilities, any of which could materially adversely affect our business strategy, results of operations, or financial condition. See Item 1A, Risk Factors, "Information technology interruptions and breaches in data security could adversely impact our business, results of operations and financial condition" for more information.


text: Both management and our Board understand that cybersecurity is crucial for securing our data and operations and defending the interests of our stakeholders. Our Board considers cybersecurity risk management as part of its general oversight function and receives an annual update on cybersecurity matters. The audit committee of our Board oversees management's process for identifying and mitigating cybersecurity threats and implementing the cybersecurity risk management processes described above. On a quarterly basis, our Vice President and Chief Information Officer ("CIO") and CISO update the audit committee regarding cybersecurity management initiatives, the status of ongoing cybersecurity threats CMC faces and other developments regarding our cybersecurity management protocols.


text: Our CISO has many years of experience in creating and implementing cybersecurity risk management programs and using cybersecurity management technologies and infrastructure solutions. Our CISO works under the supervision of our CIO, who has extensive experience in information technology and cybersecurity functions. Both the CISO and the CIO have daily responsibility for cybersecurity risk management and establishing risk management practices, and are involved in the execution of the response plans described above when a possible cybersecurity incident occurs. We engage a third-party service provider on a bi-annual basis to evaluate our cybersecurity risk management program and perform health checks on key applications. We also complete annual penetration testing to test our defenses against potential threats or risks.


text: The response plans referenced above define a cross-functional cyber incident response team (the "CIRT") that includes members of senior management, including the CISO and CIO, among other skilled employees. The CIRT plays an important role in the detection, mitigation, and remediation of cybersecurity incidents and in informing relevant members of management and the audit committee on cybersecurity threats and events. Select members of the CIRT actively participate in regular technical readiness exercises. Moreover, our executive officers participate in annual crisis tabletop exercises and attack simulations to prepare for a swift, effective, and thorough response to a potential cybersecurity incident.


text: Risk Management and Strategy CMC has established a comprehensive cybersecurity risk management program to identify, assess and manage material risks from cybersecurity threats to our computer systems, outsourced services, communications systems, industrial processing equipment, hardware and software, and to safeguard our data and our customers' data. Our risk management program includes a documented cybersecurity incident response plan and a data breach response plan (the "response plans") that outline how to respond to and contain incidents and data breaches. Additionally, we maintain a cybersecurity incident disclosure and evaluation plan (the "disclosure plan") which is used to assess the impact of a cybersecurity incident and promptly issue required SEC disclosures if needed. The response plans and disclosure plan are adapted based on the type of incident or data breach and are tested at least once per year. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our risk management program and engage third parties to regularly review our response plans.


text: CMC recognizes the critical importance of a well-developed cybersecurity risk management program and has designed ongoing cybersecurity management protocols that are embedded in our global business processes and activities. These protocols include, but are not limited to, penetration testing, vulnerability scanning, attack simulations and appropriate internal controls, along with independent third-party audits conducted to evaluate compliance with security standards and best practices. The protocols are designed by our Chief Information Security Officer ("CISO") and implemented by an experienced team comprising our information security and various technology departments. We engage expert consultants and third-party service providers to review our cybersecurity controls and readiness, alert us to potential improvements and provide incremental industry knowledge and expertise. Additionally, employees are required to complete cybersecurity training at the start of their employment and annually thereafter, and are regularly exposed to phishing awareness campaigns that simulate real-world threats.


text: Our cybersecurity risk management program also addresses cybersecurity risks associated with our use of third-party service providers and vendors. We proactively manage these risks by reviewing current and prospective third-party service providers' compliance with our established, relevant privacy and data security standards. We also require our key vendors to complete security questionnaires, and we conduct audits and vulnerability scans of those vendors and their systems. Depending on the nature of the services provided and the sensitivity of the relevant data involved, our service provider and vendor management processes may involve different levels of assessment and impose additional obligations related to cybersecurity on the service provider or vendor.


text: Both management and our Board understand that cybersecurity is crucial for securing our data and operations and defending the interests of our stakeholders. Our Board considers cybersecurity risk management as part of its general oversight function and receives an annual update on cybersecurity matters. The audit committee of our Board oversees management's process for identifying and mitigating cybersecurity threats and implementing the cybersecurity risk management processes described above. On a quarterly basis, our Vice President and Chief Information Officer ("CIO") and CISO update the audit committee regarding cybersecurity management initiatives, the status of ongoing cybersecurity threats and other developments in our cybersecurity management protocols.


text: Our CISO has many years of experience in creating and implementing cybersecurity risk management programs and using cybersecurity management technologies and infrastructure solutions. Our CISO works under the supervision of our CIO, who has extensive experience in information technology and cybersecurity functions. The CISO and the CIO are responsible for daily cybersecurity risk management, establishing risk management practices and executing the response plans when potential cybersecurity incidents arise. We engage a third-party service provider on a biannual basis to evaluate our cybersecurity risk management program and perform health checks on key applications. We also complete annual penetration testing to test our defenses against potential threats or risks.


text: The response plans define a cross-functional cyber incident response team (the "CIRT") that includes members of senior management, including the CISO and CIO, among other skilled employees. The CIRT supports the detection, mitigation and remediation of cybersecurity incidents and informs relevant members of management and the audit committee about cybersecurity threats and events. Select CIRT members participate in regular technical readiness exercises. Moreover, our executive officers participate in annual crisis tabletop exercises and attack simulations to prepare for a swift, effective and thorough response to potential cybersecurity incidents.


text: The Company has an information security program designed to identify, mitigate, respond to and manage reasonably foreseeable cybersecurity risks and threats. The program is overseen by the Chief Financial Officer. The CFO in conjunction with senior management conducts periodic reviews of cybersecurity control, policies, and procedures to ensure relevance and effectiveness for the Company's needs and operating environment. The CFO has previously led IT/cyber strategy and programs in his past work experiences and is able to apply those experiences to the Company. The audit and finance committee of the board has discussions with management on an annual basis about the Company's risk assessment and risk management policies, particularly in the areas of financial reporting, internal controls, and compliance with legal and regulatory requirements.

companyName: SUNation Energy, Inc.

ticker: SUNE


text: One aspect of the Company's information security program is focused on vendor selection. The Company evaluates all third-party vendors and service providers for their cybersecurity features and compliance with security requirements. Selected vendors, for example, must employ a variety of security measures to protect against unauthorized access, data breaches, and data loss. Pineapple Energy remains committed to maintaining the highest standards of data security and ensuring the integrity and confidentiality of our data.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks or any future material incidents. For more information on our cybersecurity related risks, see Item 1A, "Risk Factors," of this Annual Report on Form 10-K.


text: The Company has an information security program designed to identify, mitigate, respond to and manage reasonably foreseeable cybersecurity risks and threats. The program is overseen by the Chief Operating Officer. The COO in conjunction with senior management conducts periodic reviews of cybersecurity control, policies, and procedures to ensure relevance and effectiveness for the Company's needs and operating environment. The COO has previously led IT programs in his past work experiences and is able to apply those experiences to the Company. The audit and finance committee of the board has discussions with management on an annual basis about the Company's risk assessment and risk management policies, particularly in the areas of financial reporting, internal controls, and compliance with legal and regulatory requirements.


text: One aspect of the Company's information security program is focused on vendor selection. The Company evaluates all third-party vendors and service providers for their cybersecurity features and compliance with security requirements. Selected vendors, for example, must employ a variety of security measures to protect against unauthorized access, data breaches, and data loss. The Company remains committed to maintaining the highest standards of data security and ensuring the integrity and confidentiality of our data.


text: Cybersecurity Risk Management Strategy and Program We identify and assess material risks from cybersecurity threats predominantly through the work of our Information Security ("InfoSec") team as part of our enterprise risk management ("ERM") process. Our ERM process is designed to identify and evaluate the full range of significant risks to Comtech. As part of our ERM program, our functional and operations departments identify and manage enterprise risks on an annual cycle. The process consists of structured reviews, discussions, and mitigation planning, and includes risks identified by our cybersecurity functions.

companyName: COMTECH TELECOMMUNICATIONS CORP /DE/

ticker: CMTL


text: The cybersecurity ERM process is administered by InfoSec with input from each business segment and function, continually monitors material cybersecurity risks facing Comtech, including cybersecurity threats and threats to our internal systems, our products, services and programs for customers, and our supply chain. Our CISO has extensive experience leading information technology for global organizations across communications, aerospace and defense, and works directly with our CEO, Chief Financial Officer, Executive Vice President ("EVP") of Systems and IT Controls, and other members of senior management to assess cybersecurity threats as part of our ERM process.


text: To manage and remediate cybersecurity risks identified as part of our ERM process and to manage emerging cybersecurity threats in real time; we have implemented a Managed Detection and Response system that supports the Security Operations Center. We are a member of the DoD Defense Industrial Base Collaborative Information Sharing Environment and the National Defense Information Sharing and Analysis Center. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting, and recovering from cybersecurity threats.


text: As a government contractor, we must comply with extensive cybersecurity regulations, including the DFARS related to adequately safeguarding controlled unclassified information and reporting cybersecurity incidents to the DoD. The policies and controls we have implemented to date reflect our adherence to these requirements and have been assessed by external organizations, including industry partners.


text: Enterprise Cybersecurity Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology ("NIST") standards, among others, and includes processes and controls for the deployment of new IT systems by the Company and controls over new and existing systems operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications.


text: Cybersecurity for U.S. Government Authorized Systems Our information technology systems used in connection with programs for the U.S. government align with the NIST standard and meet the requirements of 32 CFR Part 117 (National Industrial Security Program Operating Manual) and other applicable U.S. government guidance. The program includes authorizations and assessments of new and existing IT systems by our customers. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.


text: Third Party Service Providers We engage third party service providers to expand the capabilities and capacity of our cybersecurity program, including for design, monitoring and testing of the program's risk prevention and protection measures and process execution, including incident detection, investigation, analysis and response, eradication and recovery.


text: Management of Third-Party Risks Our suppliers, subcontractors and third-party service providers are subject to cybersecurity obligations and controls as aligned with DFARS and U.S. Federal Acquisition Regulations ("FARS") requirements. We are making strides to ensure suppliers, subcontractors and third-party service providers are knowledgeable and aligned with DFARS and FARS requirements. We are also developing an enhanced program for our suppliers, subcontractors, and third-party service providers to agree to cybersecurity-related contractual terms and conditions of purchase to ensure their commitment to the mandates. Many of these contractors, suppliers or third parties are also subject to regulatory requirements in mandatory government procurement clauses, including those contained in the DFARS and FARS, which obligate adherence to a generally accepted cybersecurity framework, such as NIST, and occasional assessment of their implementation of cybersecurity controls as a condition of contract award or during contract performance. Finally, we require these third parties to notify us of cybersecurity incidents that impact us.


text: Program Assessment We continuously evaluate and seek to improve and mature our cybersecurity processes and controls. Our cybersecurity program is regularly assessed through management self-evaluations and ongoing monitoring procedures to evaluate our program effectiveness, including vulnerability management through active discovery, and testing to validate patching and configuration. Additionally, our InfoSec function regularly assesses our program effectiveness through audits of our entities, systems, and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall effectiveness of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the U.S. Defense Contract Management Agency ("DCMA") and Cybersecurity Maturity Model Certificate Third Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibilities for enterprise cybersecurity risks. The Technology, Innovation, and Cyber Committee of the Board of Directors also reviews enterprise cybersecurity risks in connection with its oversight of cybersecurity and compliance risks. Our CISO leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks in coordination with the EVP of Systems and IT Controls.


text: Our CISO regularly updates the Technology, Innovation and Cyber Committee and Board of Directors on cybersecurity risks as they relate to our information and operational technology systems and our suppliers and partners, as well as provides regular updates on enterprise cybersecurity incidents and key defenses and mitigation strategies. Our CISO regularly reviews enterprise cybersecurity risks, controls, program policy and processes, including training, oversees policy and program development, implementation, and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Additionally, our CISO is regularly apprised of enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.


text: The cybersecurity ERM process is administered by InfoSec with input from each business segment and function. InfoSec continually monitors material cybersecurity risks facing Comtech, including cybersecurity threats and threats to our internal systems, our products, services and programs for customers, and our supply chain. Our cybersecurity risk management team has extensive experience leading information technology for global organizations across communications, aerospace and defense, and works directly with our CEO, Chief Financial Officer, Executive Vice President ("EVP") of Systems and IT Controls, and other members of senior management team to assess cybersecurity threats as part of our ERM process.


text: To manage and remediate cybersecurity risks identified as part of our ERM process and to manage emerging cybersecurity threats in real time; we have implemented a Managed Detection and Response system that supports the Security Operations Center. We are a member of the DoD Defense Industrial Base Collaborative Information Sharing Environment and the National Defense Information Sharing and Analysis Center. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting and recovering from cybersecurity threats.


text: During fiscal year 2025 and through the date of this filing, based on the information available, we did not identify any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents (as such terms are defined in Item 106(a) of Regulation S-K), that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Please see Cybersecurity Risks under Item 1A - Risk Factors under Part I of this Form 10-K for more information about risks to us from cybersecurity threats.


text: Enterprise Cybersecurity Our enterprise cybersecurity program aligns with the National Institute of Standards and Technology ("NIST") standards, among others, and includes processes and controls for the deployment of new IT systems by us and controls over new and existing systems operation. We monitor and conduct regular testing of these controls and systems, including vulnerability management through active discovery and testing to regularly assess patching and configuration status. In addition, we require our employees and contract workers to complete annual cybersecurity training, and we regularly conduct simulated phishing and cyber-related communications.


text: Cybersecurity for U.S. Government Authorized Systems Our information technology systems used in connection with programs for the U.S. government align with the NIST standard and meet the requirements of 32 CFR Part 117 (National Industrial Security Program Operating Manual or "NISPOM") and other applicable U.S. government guidance. The program includes authorizations and assessments of new and existing IT systems by our customers. We monitor use on these systems, including vulnerability management through patching and configuration. In addition, we restrict user access and require authorized users to complete additional user and cybersecurity training.


text: Program Assessment We continuously evaluate and seek to improve and mature our cybersecurity processes and controls. Our cybersecurity program is regularly assessed through management self-evaluations and ongoing monitoring procedures to evaluate our program effectiveness, including vulnerability management through active discovery and testing to validate patching and configuration. Additionally, InfoSec regularly assesses our program effectiveness through audits of our entities, systems, and processes to help maintain compliance with policies. As cybersecurity threats are continuously evolving, we also periodically engage with third parties to perform maturity assessments of our program to identify potential risk areas and improvement opportunities. This includes assessment of our overall program, policies and processes, compliance with regulatory requirements and an overall assessment of key vulnerabilities. We use these assessments to supplement our own evaluation of the overall effectiveness of our program and target improvement areas. Several external organizations also evaluate our enterprise cybersecurity program, including the U.S. Defense Contract Management Agency ("DCMA") and Cybersecurity Maturity Model Certificate or "CMMC" Third Party Assessment Organization. Moreover, some of our products are audited or reviewed for regulatory compliance certification pursuant to the relevant DoD risk management framework.


text: Board Oversight and Management's Role Our Board of Directors has primary oversight responsibilities for enterprise cybersecurity risks. The Technology, Innovation, and Cyber Committee of the Board of Directors also reviews enterprise cybersecurity risks in connection with its oversight of cybersecurity and compliance risks. Our cybersecurity risk management team leads our enterprise cybersecurity program and is responsible for assessing and managing enterprise cybersecurity risks.


text: Our cybersecurity risk management team regularly updates the Technology, Innovation and Cyber Committee and Board of Directors on cybersecurity risks as they relate to our information and operational technology systems and our suppliers and partners, as well as provides regular updates on enterprise cybersecurity incidents and key defenses and mitigation strategies. Our cybersecurity risk management team regularly reviews and manages enterprise cybersecurity risks, controls, program policy and processes, including training, oversees policy and program development, implementation, and updates, and informs senior leadership on cybersecurity-related issues and activities affecting the organization. Additionally, our cybersecurity risk management team regularly monitors and leads efforts to address and remediate, as appropriate, enterprise cybersecurity events, threats, and activities, including with respect to incidents, protection vulnerabilities, software update needs and lifecycle status.


text: Like other firms in the financial services sector, insurers like us are particularly vulnerable to cybercrime due to our large amounts of customer data. Insurance-related data is particularly interesting to cybercriminals because of its inherent confidentiality. Often linked to policyholders, sensitive data helps insurers customize their policies, products, and prices for each client. The scope of personally identifiable information and sensitive data processed by insurers puts the industry at increased risk of cybercrime. Cyber attacks can lead to the loss of confidential data, business, and reputation. Additionally, business disruption through cyber incidents is also a major problem for insurance companies, which need to react quickly to fulfill their contracts and maintain the trust of their clients. Because of the risks posed to our business and customers, we have developed robust processes for assessing, identifying and managing our cybersecurity threats.

companyName: CITIZENS, INC.

ticker: CIA


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third party assessments, IT security, and external audits. Cybersecurity risks are integrated into our overall enterprise risk management process. To defend, detect and respond to cybersecurity incidents, we, among other things: perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.


text: We have implemented incident response and breach management processes which have four overarching and interconnected stages: 1) preparation for a cybersecurity incident, 2) detection and analysis of a security incident, 3) containment, eradication and recovery, and 4) post-incident analysis. Such cybersecurity incident responses are overseen by leaders from our Information Security, IT, Finance, Compliance and Legal teams.


text: Security events and data incidents are evaluated, ranked by severity and prioritized for response and remediation. Incidents are evaluated to determine materiality as well as operational and business impact, and reviewed for privacy impact. We also conduct tabletop exercises to simulate responses to cybersecurity incidents.


text: Our risk management program also assesses third party risks, and we perform third-party risk management assessments to identify and mitigate risks from third parties such as vendors, suppliers, and other business partners associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform periodic ongoing security reviews of our critical vendors. CITIZENS, INC.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity and Technology Risks" included as part of our risk factor disclosures at Item 1A - Risk Factors - of this 10-K.


text: While we have devoted significant financial and personnel resources to implement and maintain the security measures described above, and in order to meet regulatory requirements and customer expectations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, cybersecurity incidents have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. Cyber Governance.


text: Cybersecurity is a key element of the Company's enterprise risk management (ERM). Identification and management of the Company's key risks, including cybersecurity, starts with the executive management team, who is responsible for identifying key strategic, insurance, financial, regulatory and operational risks to the Company and managing them on a day-to-day basis. Because of the importance of cybersecurity, the Company has a Chief Information Security Officer ("CISO") who is primarily responsible for managing our cybersecurity risk in conjunction with our Vice President of Information Technology. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from employees in the information technology team and through the use of technological tools and software and results from third party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: Our CISO has served in that position since 2018 and is an experienced security leader with over 20 years' experience. In addition to his current role, our CISO has led security and IT audit functions at healthcare technology and population health organizations. His experience includes work in the fields of security, application development, and internal audit at a Fortune 100 company. Our CISO is a Certified Information Security Manager (CISM), Certified Information Systems Auditor (CISA), and a member of the ISACA and ISSA organizations. He received his bachelors' degree from Middle Tennessee State University and served in the United States Marine Corps. Additionally, Gerald W. Shields, our CEO and a member of the Board, has experience in assessing and managing cybersecurity risk and, in addition to his former roles as Chief Information Officer at several companies, he has a Cyber Security Oversight Certificate from Carnegie Mellon Institute.


text: Our Audit Committee Charter tasks this committee with oversight of the Company's major enterprise risk exposure, including risks related to cybersecurity, and the steps management takes to monitor and control such exposures. The Audit Committee holds its regular meetings on a quarterly basis and at each of those meetings receives a information security update report from the Company's CISO, which report includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues. The CISO also attends the regularly scheduled Board meetings to give his information security report to all members of the Board.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity risks related to our business, technical operations, privacy and compliance issues are identified and addressed through a multi-faceted approach including third-party assessments, IT security, and external audits. Cybersecurity risks are integrated into our overall enterprise risk management process. To defend, detect and respond to cybersecurity incidents, we, among other things perform penetration testing using external third-party tools and techniques to test security controls and conduct employee training.


text: Our risk management program also assesses third-party risks where we identify and mitigate risks from third-parties such as vendors, suppliers, and other associated business partners. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform periodic ongoing security reviews of our critical vendors.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Cybersecurity and Technology Risks" included as part of our risk factor disclosures at Part I. Item 1A. Risk Factors of this 10-K.


text: While we have devoted significant financial and personnel resources to implement and maintain the security measures described above, and in order to meet regulatory requirements and customer expectations, there can be no guarantee that our policies and procedures will be properly followed in every instance or that those policies and procedures will be effective. Although our Risk Factors include further detail about the material cybersecurity risks we face, cybersecurity incidents have not materially affected our business to date. We can provide no assurance that there will not be incidents in the future or that they will not materially affect us, including our business strategy, results of operations, or financial condition. CITIZENS, INC.


text: Cyber Governance Cybersecurity is a key element of the Company's enterprise risk management ("ERM"). Identification and management of the Company's key risks, including cybersecurity, starts with the executive management team, who is responsible for identifying key strategic, insurance, financial, regulatory and operational risks to the Company and managing them on a day-to-day basis. Because of the importance of cybersecurity, the Company has a Chief Information Security Officer ("CISO") who is primarily responsible for managing our cybersecurity risk in conjunction with our Chief Information Officer. Our CISO is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from employees in the information technology team and through the use of technological tools and software and results from third-party audits. We have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: Our CISO has served in that position since 2018 and is an experienced security leader with over 20 years' experience. In addition to his current role, our CISO has led security and IT audit functions at healthcare technology and population health organizations. His experience includes work in the fields of security, application development, and internal audit at a Fortune 100 company. Our CISO is a Certified Information Security Manager ("CISM"), Certified Information Systems Auditor ("CISA"), and a member of the ISACA and ISSA organizations. He received his bachelors' degree from Middle Tennessee State University and served in the United States Marine Corps. Additionally, Gerald W. Shields, our former Chief Executive Officer and now a member of the Board of Directors, has experience in assessing and managing cybersecurity risk and, in addition to his former roles as Chief Information Officer at several companies, has a Cyber Security Oversight Certificate from Carnegie Mellon Institute.


text: Our Audit Committee Charter tasks this committee with oversight of the Company's major enterprise risk exposure, including risks related to cybersecurity, and the steps management takes to monitor and control such exposures. The Audit Committee holds its regular meetings on a quarterly basis and at each of those meetings receives an information security update report from the Company's CISO, which report includes cybersecurity events that may have impacted the Company as well as an overview of the Company's security program and efforts to prevent, detect, mitigate, and remediate issues. The CISO also attends the regularly scheduled Board meetings to give his information security report to all members of the Board.


text: Our cybersecurity program is managed by a dedicated Global Chief Information Officer whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our Global Chief Information Officer has over 35 years of relevant industry experience, including over 29 years at our Company. Our Senior Director of Information Security functions as our Chief Information Security Officer and has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Our Board, Audit Committee and senior management receive periodic briefings from the Global Chief Information Officer and the Senior Director of Information Security, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs. In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").

companyName: MOLSON COORS BEVERAGE CO

ticker: TAP


text: The ERM Program is a proactive and ongoing process led by our legal and risk professionals and senior management, to identify, assess and manage risks and to build out and track mitigation and reduction efforts. The Board has tasked the Audit Committee with overseeing, reviewing and discussing with management, the internal audit team and the independent auditors, our ERM Program, policies and procedures with respect to, among other things, the assessment and management of risks related to our cybersecurity and information security and the steps management has taken to monitor and control such risks.


text: The Audit Committee is also responsible for overseeing risks related to our cybersecurity, technology and information security programs and reviewing emerging cybersecurity, technology and information security developments and threats and our strategy to mitigate such risks. The Audit Committee provides another level of cybersecurity oversight through engagements at each Audit Committee meeting with senior management, including our Global Chief Information Officer and the Senior Director of Information Security. These reports include updates on our cybersecurity risks, threats, and incidents; our efforts to monitor, prevent, detect, mitigate and remediate the same; regulatory updates; the status of our cybersecurity projects, programs, and assessments; and periodic updates on our cybersecurity staffing and related matters. The Audit Committee regularly reports to the Board regarding these matters.


text: We engage in the ERM Program process semi-annually, which addresses, among other matters, emerging cybersecurity threats and models our exposure to the threat landscape against the overall strategic objectives of our Company. We regularly engage cybersecurity industry experts to assess, audit and consult on our cybersecurity practices. Further, we engage Managed Security Service Providers to monitor our information technology ("IT") environment, help identify attacks, forensically investigate and remediate breaches, and assess and test our IT system security. We also operate a cyber controls assessment program to monitor our internal program in between external assessments. We have also implemented a cybersecurity awareness training program to facilitate initial and continuing education for employees on cybersecurity and related matters. Regular reviews are conducted to assess our information security programs and practices, including incident management, service continuity, information security compliance programs and related achievements.


text: In addition, we operate a third-party cyber risk management capability which monitors the exposure of significant IT suppliers, significant software as a service suppliers and major vendors with access to our IT systems. We also monitor for significant changes in our cybersecurity risk posture and attempt to remediate the risk through collaboration with that partner. We also monitor for known breaches of the IT supplier landscape.


text: As previously disclosed, during March 2021, we experienced a systems outage that was caused by a cybersecurity incident. We engaged leading forensic information technology firms and legal counsel to assist our investigation into the incident and we restored our systems. Despite these actions, we experienced delays and disruptions to our business, including brewery operations, production and shipments. This incident caused a shift in production and shipments from the first quarter of 2021 to the balance of fiscal year 2021. In addition, we incurred certain incremental one-time costs of $2.4 million for the year ended December 31, 2021, related to consultants, experts and data recovery efforts, net of insurance recoveries. See also Part I—Item 1A Risk Factors for the following risk: Cybersecurity incidents impacting our information systems, and violations of data privacy laws and regulations could disrupt our business operations and adversely impact our reputation and results of operations.


text: Our cybersecurity program is managed by a dedicated Global Chief Information Officer ("CIO") whose team, including the head of Information Technology Security, is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture and processes. Our CIO has over 35 years of relevant industry experience, including over 30 years at our Company. Our Vice President of Information Technology Security and Chief Information Security Officer ("CISO") has over 20 years of relevant industry experience. Further, team members who support our cybersecurity program have relevant educational and industry experience through various roles involving information technology, security, auditing, compliance, systems and programming, as well as cybersecurity certifications such as a Certified Information Systems Security Professional or Certified Information Security Manager. Our Board, Audit Committee and its Technology Subcommittee and senior management receive periodic briefings from the CIO and the CISO, concerning cybersecurity, information security and technology risks, and our related risk mitigation programs. In general, the Board is responsible for overseeing our enterprise risk management program ("ERM Program").


text: The Audit Committee and its Technology Subcommittee are also responsible for overseeing risks related to our cybersecurity, technology and information security programs and reviewing emerging cybersecurity, technology and information security developments and threats and our strategy to mitigate such risks. The Audit Committee and its Technology Subcommittee provides another level of cybersecurity oversight through engagements at each Technology Subcommittee meeting with senior management, including our CIO and CISO. These reports include updates on our cybersecurity risks, threats, and incidents; our efforts to monitor, prevent, detect, mitigate and remediate the same; regulatory updates; the status of our cybersecurity projects, programs, and assessments; and periodic updates on our cybersecurity staffing and related matters. The Technology Subcommittee regularly reports to the Audit Committee regarding these matters. Further, the Audit Committee regularly reports to the Board regarding these matters, including the matters discussed at the Technology Subcommittee.


text: We engage in the ERM Program process semi-annually, which addresses, among other matters, emerging cybersecurity threats and models our exposure to the threat landscape against the overall strategic objectives of our Company. We regularly engage cybersecurity industry experts to assess, audit and consult on our cybersecurity practices. Further, we engage Managed Security Service Providers to monitor our information technology ("IT") environment, help identify attacks, forensically investigate and remediate breaches, and assess and test our IT system security. We also operate a cyber controls assessment program to monitor our internal program in between external assessments. We have also implemented a cybersecurity awareness training program to facilitate initial and continuing education for employees on cybersecurity and related matters. Regular reviews are conducted to assess our information security programs and practices, including incident management, service continuity, information security compliance programs and related achievements. Additionally, we operate an Artificial Intelligence ("AI") governance program to ensure proper risk management and regulatory compliance where applicable with this expanding capability; managing ethical, legal, cyber, data privacy and other technology risks associated with the use of AI and Generative AI technologies.


text: As previously disclosed, during March 2021, we experienced a systems outage that was caused by a cybersecurity incident. We engaged leading forensic information technology firms and legal counsel to assist our investigation into the incident and we restored our systems. Despite these actions, we experienced delays and disruptions to our business, including brewery operations, production and shipments. This incident caused a shift in production and shipments from the first quarter of 2021 to the balance of fiscal year 2021. In addition, we incurred certain incremental one-time costs of $ 2.4 million for the year ended December 31, 2021, related to consultants, experts and data recovery efforts, net of insurance recoveries. See also Part I—Item 1A Risk Factors for the following risk: Cybersecurity incidents impacting our information systems, and violations of data privacy laws and regulations could disrupt our business operations and adversely impact our reputation and results of operations.


text: The day-to-day management of cybersecurity is the responsibility of our Senior Vice President, Chief Information Officer, who oversees our Information Technology ("IT") team. The Chief Information Officer reports directly to the Chief Financial Officer. Our Senior Vice President, Chief Information Officer ("CIO") has served in this role for over seven years, and has more than 20 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations, and developing cybersecurity strategy. Together with his IT team and external consultants, our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management processes described below, including the operation of our cybersecurity incident response plan.

companyName: COUSINS PROPERTIES INC

ticker: CUZ


text: For many years, we have strategically invested in our cybersecurity programs across the organization, and we have developed and refined our processes for detecting, evaluating, and responding to potential cybersecurity incidents. In particular, we focus on our networks, applications, data, employees, and vendors with a comprehensive cybersecurity plan, informed by nationally recognized frameworks which we use to monitor and improve our program as compared to the framework controls. In addition to our ongoing monitoring, we engage a third-party advisor to perform cybersecurity risk assessments of our information technology security processes and implemented technologies. We have segmented our building networks so that they are separate from our corporate network, and using third party services, we monitor, scan, assess, audit, and remediate identified vulnerabilities across those networks, as appropriate. Furthermore, recognizing that our employees are an essential line of defense in cybersecurity, we engage with our employees in a training and testing program through which we provide education on the risk of potential cybersecurity incidents, methods for identification of such incidents and appropriate responses. Our policies and processes are informed by industry standard practices regarding application security, access management, device protection, network management, and data loss prevention and recovery, and we also maintain a business continuity and disaster recovery plan (including a cybersecurity incident response plan) to reduce the risk and impact of business interruptions, across a range of disaster scenarios, including potential impacts from a cybersecurity incident. Our business continuity and disaster recovery plan and our cybersecurity incident response plan are reviewed at least annually, and we also periodically conduct tabletop exercises that include the CIO and key members of management.


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Based on the context and details of the potential cybersecurity incident, the incident response plan includes prompt review by one or more members of the IT Team, with appropriate responses deployed as promptly as is practicable under the circumstances. Additionally, the CIO receives reports on potential cybersecurity incidents. As part of overall enterprise risk management, additional reporting of potential cybersecurity incidents is also provided to our General Counsel, Chief Accounting Officer, and Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: Our Board of Directors provides oversight of risks from cybersecurity threats, in coordination with our management team and the Audit Committee of the Board. Our Board relies on management to bring significant matters impacting the Company to its attention, including with respect to material risks from cybersecurity threats. Our CIO reports on cybersecurity strategy, status of cybersecurity risk control efforts, and third-party cybersecurity risk assessments of our information technology security processes and implemented technologies to the General Counsel, Chief Accounting Officer, Chief Financial Officer, Chief Executive Officer, and our Audit Committee. Our full Board has access to these Audit Committee presentations, including any provided materials. In the event of any material cybersecurity incidents, these presentations would also include information regarding those incidents, including status of mitigation and remediation.


text: Our Audit Committee provides an additional layer of cybersecurity oversight and is responsible for discussing cybersecurity concerns (including data privacy risk management) and the steps management has taken to monitor and control such exposures with management. As part of this oversight, the Audit Committee reviews the results of a biannual risk assessment designed to identify and analyze risks to achieving the Company's business objectives, including material risks from cybersecurity threats. The results of the biannual risk assessment are discussed with management and used to develop the Company's internal audit plan.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For a disclosure of our cybersecurity risks, Risk Factors in Part I, Item 1A.


text: The day-to-day management of cybersecurity is the responsibility of our Senior Vice President, Chief Information Officer, who oversees our Information Technology ("IT") team. The Chief Information Officer reports directly to the Chief Financial Officer. Our Senior Vice President, Chief Information Officer ("CIO") has served in this role for over eight years, and has more than 20 years of experience in the aggregate in various roles involving managing information security, technology infrastructure, IT operations, and developing cybersecurity strategy. Together with his IT team and external consultants, our CIO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through the management of and participation in the cybersecurity risk management processes described below, including the operation of our cybersecurity incident response plan.


text: Our cybersecurity incident response plan includes retention of external experts for prompt assistance following discovery of any material incident. This cybersecurity incident response plan is part of our ongoing cybersecurity vulnerability management, and we endeavor to maintain appropriate controls to identify, monitor, analyze, and address potential cybersecurity incidents, including potential unauthorized access to our networks and applications, along with detection of potential unusual activity within our networks or applications. Based on the context and details of the potential cybersecurity incident, the incident response plan includes prompt review by one or more members of the IT team, with appropriate responses deployed as promptly as is practicable under the circumstances. Additionally, the CIO receives reports on potential cybersecurity incidents. As part of overall enterprise risk management, additional reporting of potential cybersecurity incidents is also provided to our General Counsel, Chief Accounting Officer, Chief Financial Officer, and the Audit Committee or the full Board, as appropriate.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected nor are they reasonably likely to affect the Company, including its business strategy, results of operations or financial condition. For a disclosure of our cybersecurity risks, see Risk Factors in Part I, Item 1A.


text: Material Cybersecurity Risks, Threats and Incidents To date, risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. Additional information on cybersecurity risks we face is discussed in Part I, Item 1A "Risk Factors" under the heading "General," which should be read in conjunction with the foregoing information.

companyName: CUMMINS INC

ticker: CMI


text: Cybersecurity Governance We are committed to protecting our Information Technology (IT) assets and the data stored within these assets. This commitment includes the protection of IT assets relevant to our operations, stakeholder data (including employee, customer and supplier data), intellectual property and our products.


text: The Cummins Enterprise Cybersecurity function, which is responsible for the administration of our enterprise cybersecurity program, is led by the Chief Information Security Officer, who has more than 25 years of information technology, IT architecture and operations experience in the industrial manufacturing industry. The Chief Information Security Officer reports to our Chief Information Officer. These leaders provide regular updates to the Audit Committee of the Board on cybersecurity risks. Through these updates, the Audit Committee receives a cybersecurity dashboard illustrating the status of key cybersecurity activities such as email phishing, event logging and data encryption. Information regarding relevant cybersecurity training is provided as well.


text: The Product Cybersecurity function, which is responsible for the administration of our product cybersecurity program, is led by the Executive Director – Corporate Product Cybersecurity and Functional Safety, who has more than 35 years of automotive industry and electronic controls design experience. The Executive Director – Corporate Product Cybersecurity and Functional Safety reports to our Chief Technical Officer. These leaders provide regular updates to the SET Committee of the Board on product related cybersecurity risks. Through these updates, the SET Committee receives a report discussing product level vulnerability management, product level incident management and the status of relevant product cybersecurity activities.


text: Our processes for oversight of cybersecurity risks are integrated into our Enterprise Risk Management (ERM) program, which is led by the Executive Director, Global Risk. To govern the ERM program, we established an Executive Risk Council that meets regularly to review and monitor our most significant enterprise risks, including the prevention, detection and mitigation plans, including with respect to cybersecurity. The Executive Risk Council is comprised of senior leaders with cross-functional experience and responsibilities.


text: Our Board and its committees are engaged in the oversight of our most significant enterprise risks, including cybersecurity risks. We assign a member of our executive management team to report material information to our Board regarding these risks. The Audit Committee, working with the Chief Information Officer, provides oversight of the enterprise cybersecurity program. The SET Committee, working with the Chief Technical Officer, provides oversight of the product cybersecurity program.


text: Our Board, Audit Committee and SET Committee receive reports and information from our senior leaders who have functional responsibility for the mitigation of enterprise cybersecurity and product cybersecurity risks. These leaders meet with the committees on a regular basis, at least four times per year, and provide dashboards or reports, which summarize cybersecurity risks and action plans.


text: Cybersecurity Risk Management and Strategy We have an Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the enterprise cybersecurity program. The Enterprise Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. This MRG meets regularly, at least four times per year, with our Chief Information Security Officer to review the cybersecurity program and related risks. The MRG receives updates on the status of key cybersecurity initiatives and is responsible for our response to material cybersecurity incidents.


text: We have a Product Cybersecurity Management Review Group (Product Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the product cybersecurity program. The Product Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. The Product Cybersecurity MRG meets regularly with the Executive Director – Corporate Product Cybersecurity and Functional Safety to review the cybersecurity program, including risks and the status of key initiatives.


text: Both the Enterprise and Product Cybersecurity functions administer policies related to cybersecurity in consultation with other stakeholders at the company. We have a third-party risk management process, which is designed to assess and manage cybersecurity risks posed by third parties. This process is administered by the Enterprise Cybersecurity function.


text: In addition, a cybersecurity operations team is in place, which monitors the environment for cybersecurity incidents on a regular basis. We have incident response plans to assess and manage cybersecurity incidents. These plans include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to us, are escalated to executive management and the Enterprise Cybersecurity MRG. The Enterprise Cybersecurity MRG practices the incident response process through a tabletop exercise facilitated by external consultants. In addition, cyber insurance is in place, which may mitigate the impact of cybersecurity incidents.


text: We engage outside experts where appropriate to aid in developing and implementing the cybersecurity program and to review its operations. Our Internal Audit function also performs regular assessments of the design and operational effectiveness of the program's key processes and controls. We will continue to enhance our cybersecurity operations to respond to the dynamic cybersecurity landscape.


text: Cybersecurity Governance We are committed to protecting our IT assets and the data stored within these assets. This commitment includes the protection of cyber assets relevant to our operations, stakeholder data (including employee, customer and supplier data), intellectual property and our products.


text: The Enterprise Cybersecurity function, which is responsible for the administration of our enterprise cybersecurity program, is led by the Chief Information Security Officer, who holds a degree in Management Information Systems (MIS) and a Certified Information Security Manager (CISM) designation, and has more than 20 years of IT, cybersecurity, audit and risk management experience in the industrial manufacturing industry. The Chief Information Security Officer reports to our Chief Information Officer. These leaders provide regular updates to the Audit Committee of the Board on cybersecurity risks. Through these updates, the Audit Committee receives a cybersecurity dashboard illustrating cybersecurity priorities and the status of key initiatives.


text: The Product Cybersecurity function, which is responsible for the administration of our product cybersecurity program, is led by the Principal Engineer – Product Cybersecurity, who has more than 35 years of embedded electronic systems design experience. The Principal Engineer – Product Cybersecurity works directly with the Chief Technical Officer. These leaders provide regular updates to the SET Committee of the Board on product related cybersecurity risks. Through these updates, the SET Committee receives a report discussing product level vulnerability management, product level incident management and the status of relevant product cybersecurity activities.


text: Our processes for oversight of cybersecurity risks are integrated into our Enterprise Risk Management (ERM) program, which is led by the Executive Director, Global Risk. To govern the ERM program, we established an Executive Risk Council that meets regularly to review and monitor our most significant enterprise risks, and our prevention, detection and mitigation plans, including with respect to cybersecurity. The Executive Risk Council is comprised of senior leaders with cross-functional experience and responsibilities.


text: Our Board, Audit Committee and SET Committee receive reports and information from our senior leaders who have functional responsibility for the mitigation of enterprise cybersecurity and product cybersecurity risks. These leaders meet with the committees on a regular basis and provide dashboards or reports, which summarize cybersecurity risks and action plans. The committees elevate matters to the Board as appropriate.


text: Cybersecurity Risk Management and Strategy We have an Enterprise Cybersecurity Management Review Group (Enterprise Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the enterprise cybersecurity program. The Enterprise Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. This MRG meets regularly with our Chief Information Security Officer to review the enterprise cybersecurity program and related risks. The MRG receives updates on the status of key cybersecurity initiatives and is responsible for our response to material cybersecurity incidents. For material cybersecurity incidents, our process is to escalate through the MRG to the Audit Committee and Board.


text: We have a Product Cybersecurity Management Review Group (Product Cybersecurity MRG), which functions as a steering committee to provide oversight and strategic direction for the product cybersecurity program. The Product Cybersecurity MRG is comprised of senior leaders with cross-functional experience and responsibilities. The Product Cybersecurity MRG meets regularly with the Principal Engineer – Product Cybersecurity to review the product cybersecurity program, including risks and the status of key initiatives.


text: Both the Enterprise and Product Cybersecurity functions administer policies related to cybersecurity in consultation with other stakeholders at the company. Our risk-based cybersecurity program is designed to protect, detect, and respond to cybersecurity threats and incidents. This program, developed alongside the National Institute of Standards and Technology Cybersecurity Framework, aims to protect the confidentiality, integrity, and availability of our IT assets and the data stored thereon. We also have a third-party risk management process, which is designed to assess and manage cybersecurity risks posed by third parties. This process is administered by the Enterprise Cybersecurity function, and through this program, the company evaluates the type of data that is shared with certain vendors with the goal of conducting risk-informed assessments. These assessments provide insights which the Enterprise Cybersecurity function uses to better manage third-party risks.


text: A cybersecurity operations team is in place to regularly monitor the environment for cybersecurity threats and incidents. We have incident response plans to assess and manage cybersecurity incidents. These plans include escalation procedures based on the nature and severity of the incident. The most critical incidents, which could be material to us, are escalated to executive management and the Enterprise Cybersecurity MRG. In addition, cyber insurance is in place, which may mitigate the impact of cybersecurity incidents.


text: We engage outside experts where appropriate to aid in maturing, implementing and testing the cybersecurity program and to review our cybersecurity operations. This includes incident response testing through tabletop exercises facilitated by external consultants. We have implemented training and awareness programs to educate our employees on cybersecurity risks, which includes regular educational phishing campaigns, and our Internal Audit function performs regular assessments of the design and operational effectiveness of the program's key processes and controls. We will continue to develop and mature our cybersecurity operations to respond to the dynamic cybersecurity landscape.


text: Our Board is actively engaged in the oversight of the Company's cybersecurity, information security, data protection, and technology programs ("cybersecurity"). The Audit Committee of the Board, acting through its written charter, serves as the principal agent of the Board in fulfilling its oversight and review of the Company's policies and procedures with respect to cybersecurity risk assessment and risk management. The Company's Chief Information Officer (CIO) leads the Company's cybersecurity risk assessment and risk management program. Our CIO, with over 25 years of experience leading cybersecurity oversight, brings a wealth of expertise and in-depth knowledge that is instrumental in developing and executing our cybersecurity program.

companyName: CURTISS WRIGHT CORP

ticker: CW


text: Our cybersecurity program is fully integrated into the Company's overall enterprise risk management program. Our Vice President, Risk and Compliance (VP of Risk) facilitates the enterprise risk management program, and helps ensure that risk management is integrated into our strategic and operating planning process. The VP of Risk works closely with the CIO and his information technology security team to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level.


text: The CIO continually assesses industry best practices, frameworks, and standards, and leverages them to advance our cybersecurity program. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our cybersecurity risk management program includes the deployment of tools and activities designed to prevent, detect, and analyze current and emerging cybersecurity threats, and plans and strategies to address threats and incidents. Program highlights include: a. Employing a multi-layer strategy of defense designed to ensure the safety, security, and responsible use of information and data.


text: b. Monitoring of all IT assets, resources, and data 24-hours per day, 7-days per week, 365-days per year by security operations center (SOC). c. Performing annual testing of the Company's incident response plan and cybersecurity posture by a third party.


text: d. Incorporating external expertise to manage the SOC, perform penetration tests, cyber-attack simulation exercises, and log management to review anomalies indicating a possible breach. e. Maintaining a business continuity program and cyber insurance. f. Performing periodic employee simulated phishing campaigns.


text: g. Conducting annual cybersecurity and insider threat training for all employees. In addition to assessing our own cybersecurity preparedness, we also consider and evaluate cybersecurity risks associated with use of third-party service providers. Our Internal Audit team conducts an annual review of third-party hosted applications with a specific focus on any sensitive data shared with third parties. The internal business owners of the hosted applications are required to provide a System and Organization Controls (SOC) 1 or SOC 2 report. If a third-party vendor is not able to provide a SOC 1 or SOC 2 report, we take additional steps to assess their cybersecurity preparedness and assess our relationship on that basis.


text: The CIO plays a pivotal role in informing the Audit Committee, as well as our CEO and other members of our senior management team, including our Chief Financial Officer (CFO), COO, and General Counsel, on cybersecurity risks. The CIO provides comprehensive briefings to the Audit Committee on a periodic basis, which the CEO and other members of our senior management team attend. This report includes discussions of rapidly evolving cybersecurity threats, cybersecurity incidents, cybersecurity technologies and solutions deployed, major cybersecurity risk areas, and policies and procedures to address those risks and cybersecurity incidents. The report also includes third-party assessments of our cybersecurity program, which are conducted regularly. The CIO also informs the CEO and other members of our senior management team on a more informal basis of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Any significant cybersecurity matters and strategic risk management decisions related thereto are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity issues. In 2023, the Company achieved its primary cybersecurity risk management objective of no material cybersecurity incidents.


text: As of the date of this report, the Company is not aware of any material risks from cybersecurity threats, including those resulting from previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "Intrusion on our systems could damage our business" in Item 1A "Risk Factors" of this Form 10-K.


text: The CIO plays a pivotal role in informing the Audit Committee, as well as our CEO and other members of our senior management team, including our Chief Financial Officer (CFO), COO, and General Counsel, on cybersecurity risks. The CIO provides comprehensive briefings to the Audit Committee on a periodic basis, which the CEO and other members of our senior management team attend. This report includes discussions of rapidly evolving cybersecurity threats, cybersecurity incidents, cybersecurity technologies and solutions deployed, major cybersecurity risk areas, and policies and procedures to address those risks and cybersecurity incidents. The report also includes third-party assessments of our cybersecurity program, which are conducted regularly. The CIO also informs the CEO and other members of our senior management team on a more informal basis of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing us. Any significant cybersecurity matters and strategic risk management decisions related thereto are escalated to the Board of Directors, ensuring that they have comprehensive oversight and can provide guidance on significant cybersecurity issues. In 2024, the Company achieved its primary cybersecurity risk management objective of no material cybersecurity incidents.


text: Set forth below is information regarding our cybersecurity risk management, strategy, and governance, along with a related description of our information security and data privacy practices.

companyName: TARGET CORP

ticker: TGT


text: Securing company systems, business information, and personal information of our guests, team members, vendors, and other third parties is important to us. We have systems in place to: • safely receive, protect, and store that information; • collect, use, and share that information appropriately; and • detect, contain, and respond to information security, cybersecurity, and data privacy incidents.


text: While everyone at Target plays a part in information security, cybersecurity, and data privacy, oversight responsibility is shared by our Board of Directors, its committees, and management.


text: Audit & Risk Committee Primary oversight responsibility for information security, cybersecurity, and data privacy, including internal controls designed to identify, assess, and manage risks related to these topics Management


text: Our Chief Information Officer, Chief Information Security Officer, Chief Legal & Compliance Officer, Chief Corporate Affairs Officer, and other senior members of our cybersecurity, risk, and compliance and ethics teams are responsible for identifying, assessing, and managing risks related to these topics, and reporting to the Audit & Risk Committee and/or the full Board of Directors CYBERSECURITY


text: Index to Financial Statements Our program and practices regarding information security, cybersecurity, and data privacy include the following: • Audit & Risk Committee and Board of Directors updates. To inform and educate the Audit & Risk Committee in its primary oversight responsibility for information security, cybersecurity, and data privacy, management provides updates on these topics. For example, the Chief Information Security Officer addresses information security risks and controls, cyber threats, and other program updates, and senior members of the risk team provide enterprise risk management program updates. In addition, the Board of Directors receives updates from management regarding Target's overall risks, which include risks related to these topics. • Integration into enterprise risk management program. By aligning the identification, assessment, and management of risks related to information security, cybersecurity, and data privacy with our overall approach to risk oversight by the Board of Directors, its committees, and management, we have integrated these practices into our enterprise risk management program. • Management expertise. Our Chief Information Officer leads the strategic direction and management of Target's enterprise technology systems. He is responsible for Target's technology roadmap and oversees Target's global product engineering, infrastructure, cybersecurity, data sciences, and architecture teams. He has held a variety of leadership roles across the company and has developed significant knowledge and skills regarding enterprise technology systems, including cybersecurity. Our Chief Information Security Officer has a strong background in technology, information security, cybersecurity, risk management, audit, and compliance and held executive roles in information security prior to joining Target. He continues to develop his expertise in these areas and contributes to the broader cybersecurity community by serving in several board and advisory roles and promoting collaboration, best practice sharing, and talent development. Our Chief Legal & Compliance Officer and Chief Corporate Affairs Officer have extensive experience, and have developed critical knowledge and skills, in the areas of risk oversight and compliance, including as such areas relate to cybersecurity. • Systems and processes. We use a combination of industry-leading tools and in-house technologies to protect Target and our guests, operate a proactive threat intelligence program to identify and assess risks, including from threats associated with our use of third-party service providers, and we run a cyber fusion center to investigate and respond to threats. Our program is based on recognized industry security standards and control frameworks, which we seek to validate through internal and independent assessments. Our cybersecurity team regularly tests our controls through penetration testing, vulnerability scanning, and attack simulation. In addition, we have an incident response program to address potential security and privacy incidents. As part of this incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of potential security and privacy incidents. The program uses a coordinated escalation model to provide information to, and engage with, relevant members of management and the Board of Directors, as needed, throughout the incident response process.


text: • Understanding evolving threats in the industry and with our suppliers. Our cybersecurity and data privacy teams work to understand evolving threats, developing issues, and industry trends, and our vendor teams monitor and assess risks with our suppliers. • Collaboration with organizations across different industries. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. • Investment, training, and development of our cybersecurity and data privacy teams. We invest in building and developing cybersecurity talent and engineering expertise in-house rather than relying solely on third-party providers. We also offer in-house training and educational courses through our Cyber Plus Institute, which is a security training curriculum leveraging internal subject matter expertise along with curated resources. Our data privacy team has industry certifications, works to understand changing technologies that impact consumer privacy, and regularly participates in training and conferences.


text: Index to Financial Statements • Regular training and compliance activities for our team members. Our team members receive annual training on information security, cybersecurity, and data privacy topics to understand the behaviors and technical requirements necessary to protect company and guest information, and appropriately collect, use, and share personal information. We also offer ongoing practice and education for team members to recognize and report suspicious activity. • Use of third parties. Beyond our in-house capabilities we engage with leading security and technology vendors to assess our information security and cybersecurity program and test our technical capabilities. • Insurance coverage. We maintain insurance coverage intended to limit our exposure to certain network security and privacy matters.


text: See "Information Security, Cybersecurity, and Data Privacy Risks" in Part I, Item 1A, Risk Factors for additional information regarding risks from cybersecurity threats.


text: Our Chief Information and Product Officer, Chief Information Security Officer, Chief Legal & Compliance Officer, Chief Corporate Affairs Officer, and other senior members of our cybersecurity, risk, and compliance and ethics teams are responsible for identifying, assessing, and managing risks related to these topics, and reporting to the Audit & Risk Committee and/or the full Board of Directors Our program and practices regarding information security, cybersecurity, and data privacy include the following: • Audit & Risk Committee and Board of Directors updates. To inform and educate the Audit & Risk Committee in its primary oversight responsibility for information security, cybersecurity, and data privacy, management provides updates on these topics. For example, the Chief Information Security Officer addresses information security risks and controls, cyber threats, and other program updates, and senior members of the risk team provide enterprise risk management program updates. In addition, the Board of Directors receives updates from management regarding Target's overall risks, which include risks related to these topics. • Integration into enterprise risk management program. By aligning the identification, assessment, and management of risks related to information security, cybersecurity, and data privacy with our overall approach to risk oversight by the Board of Directors, its committees, and management, we have integrated these practices into our enterprise risk management program. • Management expertise. Our Chief Information and Product Officer leads the strategic direction and management of Target's product and engineering teams. He is responsible for Target's enterprise technology systems and oversees Target's cybersecurity, data platforms, data science, infrastructure, product engineering, and enterprise product teams. He previously served as Target's Chief Digital and Product Officer and held a variety of leadership roles in enterprise technology and product management prior to joining Target. He has developed significant knowledge and skills regarding enterprise technology systems, including cybersecurity. Our Chief Information Security Officer has a strong background in technology, information security, cybersecurity, risk management, audit, and compliance and held executive roles in information security prior to joining Target. He contributes to the broader cybersecurity community by serving in several board and advisory roles and promoting collaboration, best practice sharing, and talent development. Our Chief Legal & Compliance Officer and Chief Corporate Affairs Officer have extensive experience, and have developed critical knowledge and skills, in the areas of risk oversight and compliance, including as such areas relate to cybersecurity.


text: Index to Financial Statements • Systems and processes. We use a combination of industry-leading tools and in-house technologies to protect Target and our guests, operate a proactive threat intelligence program to identify and assess risks, including from threats associated with our use of third-party service providers, and we run a cyber fusion center to investigate and respond to threats. Our program is based on recognized industry security standards and control frameworks, which we seek to validate through internal and independent assessments. Our cybersecurity team regularly tests our controls through penetration testing, vulnerability scanning, and attack simulation. In addition, we have an incident response program to address potential security and privacy incidents. As part of this incident response program, members of management are informed about and monitor the prevention, detection, mitigation, and remediation of potential security and privacy incidents. The program uses a coordinated escalation model to provide information to, and engage with, relevant members of management and the Board of Directors, as needed, throughout the incident response process. • Understanding evolving threats in the industry and with our suppliers. Our cybersecurity and data privacy teams work to understand evolving threats, developing issues, and industry trends, and our vendor teams monitor and assess risks with our suppliers. • Collaboration with organizations across different industries. We share threat intelligence and collaborate with organizations across different industries to share best practices, fight cybercrime, enhance privacy, discuss new technologies, better understand the evolving regulatory environment, and advance capabilities in these areas. • Investment, training, and development of our cybersecurity and data privacy teams. We invest in building and developing cybersecurity talent and engineering expertise in-house rather than relying solely on third-party providers. We also offer in-house training and educational courses through our Cyber Plus Institute, which is a security training curriculum leveraging internal subject matter expertise along with curated resources. Our data privacy team has industry certifications, works to understand changing technologies that impact consumer privacy, and regularly participates in training and conferences. • Regular training and compliance activities for our team members. Our team members receive annual training on information security, cybersecurity, and data privacy topics to understand the behaviors and technical requirements necessary to protect company and guest information, and appropriately collect, use, and share personal information. We also offer ongoing practice and education for team members to recognize and report suspicious activity. • Use of third parties. Beyond our in-house capabilities we engage with leading security and technology vendors to assess our information security and cybersecurity program and test our technical capabilities. • Insurance coverage. We maintain insurance coverage intended to limit our exposure to certain network security and privacy matters.


text: Our Board is engaged in the oversight of cybersecurity threat risk management. As reflected in the Audit Committee's charter, the Board has specifically delegated responsibility for oversight of cybersecurity matters to the Audit Committee as part of its review of our ERM framework. The Audit Committee regularly receives updates on cybersecurity risks and the security and operations of our information technology systems from our Chief Information Officer and our Chief Information Security Officer. In 2023, the Audit Committee received briefings on information security matters at all of its regular meetings. In addition, our Chief Information Officer, our Chief Information Security Officer, other members of our information technology leadership team and an outside legal expert on cybersecurity matters held a special session with all members of our Board of Directors to provide an overview of the information security environment. In addition to information provided in these meetings, members of our Board also have access to internal and external education on cybersecurity risks. The Board also benefits from the expertise of one of our members who has significant experience in management of cybersecurity companies.

companyName: DELTA AIR LINES, INC.

ticker: DAL


text: Our information security team is led by our Senior Vice President & Chief Information Security Officer, who reports directly to our Executive Vice President - Chief Information Officer. Leadership of the information security team has extensive dedicated cybersecurity experience. Additionally, the collective leadership team holds 21 certifications in cybersecurity and related fields, including Certified Information Systems Security Professional, Certified Information Security Manager, and Certified Information Systems Auditor.


text: Our Chief Information Security Officer and other members of our cybersecurity leadership team regularly participate in threat intelligence briefings provided through various government and industry entities. Both our Chief Information Officer and our Chief Information Security Officer are members of the Delta Risk Council, which is the management group that oversees all areas of our business risk. Cybersecurity threat risks are a regular subject addressed by this group. In addition, our Chief Information Officer is a member of the Delta Leadership Committee and provides updates to this group as needed about cybersecurity matters. Our cybersecurity incident response plan includes processes for communication about cybersecurity incidents to appropriate levels of management, including to the Risk Council and Leadership Committee, as well as the Audit Committee and the Board, as merited.