text: As previously disclosed, beginning on August 18, 2023, some of the notified individuals filed lawsuits against Umpqua Bank in various federal and state courts seeking monetary recovery and other relief on behalf of themselves and one or more putative classes of other individuals similarly situated. The cases collectively allege claims for negligence, negligence per se, breach of contract, breach of implied contract, breach of third-party beneficiary contract, breach of fiduciary duty, invasion of privacy, breach of the covenant of good faith and fair dealing, unjust enrichment and violation of certain statutes, namely the Washington Consumer Protection Act, the California Consumer Legal Remedies Act, the California Consumer Privacy Act, and the California Unfair Competition Law. Umpqua Bank has engaged defense counsel and intends to vigorously defend against these suits and any similar or related suits or claims. Umpqua Bank has notified relevant insurance carriers and business counterparties and continues to reserve all of its relevant rights to indemnity, defense, contribution, and other relief in connection with these matters. We cannot predict or determine the timing or outcome of these lawsuits or the impact they may have, if any, on our financial condition, results of operations or cash flows. We believe that if one or more outcomes that are determined in favor of the plaintiffs in the litigation arising from the Vendor Incident it could have a material adverse effect on our business, operations, or financial results.


text: Separately and as previously disclosed, Umpqua Bank experienced an on-premises MOVEit security incident in May 2023. The on-premises instance was removed from the network immediately and decommissioned, and the unauthorized actor did not obtain any customer information or Umpqua Bank data. An independent forensics firm was engaged and confirmed our assessment of this on-premises MOVEit incident, which did not cause any interruption of business operations. We do not currently believe the on-premises incident will have a material adverse effect on our business, operations, or financial results.

companyName: COLUMBIA BANKING SYSTEM, INC.

ticker: COLB

secItem: Item 1C


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: Our Board of Director's Enterprise Risk Management Committee (the "ERMC") is responsible for the oversight of risks from cybersecurity threats. At least annually, the ERMC receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as anticipated emerging threats, cybersecurity posture, progress towards predetermined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials including a cybersecurity scorecard and other materials indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer, Chief Information Officer, and Chief Privacy and Information Risk Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Security Officer and Chief Privacy and Information Risk Officer. Such individuals have collectively over 40 years of prior work experience in various roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. They also have several relevant degrees and certifications, including Certified Information Security Manager, Certified Information Systems Auditor, Certified Information Systems Security Professional, Global Information Assurance Certification, and Certified Professional Hacker.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. As discussed above, these members of management report to the ERMC about cybersecurity threat risks, among other cybersecurity related matters, at least annually.


text: Risk Management and Strategy We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. We believe these risks include, among other things, operational risks resulting in system disruption; intellectual property theft; fraud; extortion; harm to associates or customers including by way of inadvertent release of information; violation of privacy or security laws and other litigation and legal risk; and reputational risks. We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage such material risks. We have invested in data security and privacy protections, and we follow what we believe to be industry-standard recommendations for data security. However, if we fail to properly assess and identify cybersecurity threats, we may become increasingly vulnerable to such risks.


text: To identify and assess material risks from cybersecurity threats, our corporate risk management program considers cybersecurity threat risks alongside other Company risks as part of our overall risk assessment process. Our corporate risk professionals collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations. We employ a range of tools and services, including programs across identity and access management, training and awareness, threat management, cybersecurity operations, cybersecurity enablement, and cybersecurity data, host, and network security. This includes regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to inform our professionals' risk identification and assessment.


text: We also have a cybersecurity-specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Federal Financial Institutions Examination Council's Cybersecurity Assessment Tool. These standards are aligned to the National Institute of Standards and Technology ("NIST"), International Organization for Standardization, Center for Internet Security, and experts are engaged by us to evaluate the integrity of our information systems, as such term is defined in Item 106(a) of Regulation S-K.


text: To help us preserve the availability of critical data and systems, maintain regulatory compliance, and achieve our goal of managing our material risks from cybersecurity threats, and with an aim to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities: • Closely monitor emerging data protection laws and implement changes to our processes designed to comply with such data protection laws; • Undertake regular reviews of our policies and standards related to cybersecurity; • Proactively inform our customers of substantive changes related to customer data handling; • Conduct annual customer data handling and use requirements training for associates; • Conduct annual cybersecurity management and incident training for associates involved in our systems and processes that handle sensitive data; • Conduct regular cybersecurity training and awareness for all associates and all contractors with access to corporate systems; • Through policy, practice, and contract (as applicable) require associates, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • Run tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • Leverage the NIST incident handling framework to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; and • Maintain what we believe to be customary and appropriate third-party information security coverage for incident loss mitigation.


text: We also maintain an incident response plan designed to coordinate the activities we take with a goal to prepare for, detect, respond to, and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: As part of the above processes, we regularly engage with regulatory examiners, internal and external auditors, and other third-parties, as well as a regular review by both our technology risk management team and corporate risk management team to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also aim to address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our enterprise risk management assessment program, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data, or facilities that house such systems or data, and monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: As disclosed above, we have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. However, any failure in, or unauthorized access to, our information systems, as such term is defined in Item 106(a) of Regulation S-K, could disrupt our business, result in unintentional disclosure or misuse of confidential or proprietary information, damage our reputation, increase our costs and cause losses, and have a material adverse effect on our business, financial condition, results of operations and prospects. Failures, interruptions, or data breaches involving our information systems, or the information systems of our vendors, could damage our reputation, result in a loss of customer business, result in a violation of privacy or other laws, or expose us to civil litigation, regulatory fines or losses not covered by insurance, all of which could have a material adverse impact on our business, financial condition, results of operations, and prospects.


text: As of the date of this Annual Report on Form 10-K, we do not believe that any risks from cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. The expenses we have incurred from cybersecurity incidents, including the Vendor Incident have been immaterial to date. Nevertheless, we also believe risks from certain cybersecurity threats, including as a result of our previously disclosed Vendor Incident could potentially result in charges, settlements or other potential liabilities that could materially affect our business strategy, results of operations, and financial condition, depending on the outcome of pending lawsuits as discussed further below.


text: As previously disclosed, on June 21, 2023, our wholly-owned subsidiary Umpqua Bank was informed by one of its technology service providers (the "Vendor") that a widely reported security incident involving MOVEit, a filesharing software used globally by government agencies, enterprise corporations, and financial institutions, resulted in the unauthorized acquisition by a third-party of the names and social security numbers or tax identification numbers of certain of Umpqua Bank's consumer and small business customers (the "Vendor Incident"). Other than the information described above, no Umpqua Bank account information was compromised as a result of the Vendor Incident, and no information from Umpqua Bank's commercial customers was involved in the Vendor Incident. On June 22, 2023, Umpqua Bank sent an email to potentially affected consumer and small business customers informing them of the Vendor Incident. In August 2023, the Vendor, on behalf of Umpqua Bank, also sent notice via U.S. mail to the 429,252 Umpqua Bank customers whose information was involved in the Vendor Incident.


text: As previously disclosed, beginning on August 18, 2023, some of the notified individuals filed lawsuits against Umpqua Bank in various federal and state courts seeking monetary recovery and other relief on behalf of themselves and one or more putative classes of other individuals similarly situated. The cases collectively allege claims for negligence, negligence per se, breach of contract, breach of implied contract, breach of third-party beneficiary contract, breach of fiduciary duty, invasion of privacy, breach of the covenant of good faith and fair dealing, unjust enrichment, and violation of certain statutes, namely the Washington Consumer Protection Act, the California Consumer Legal Remedies Act, the California Consumer Privacy Act, and the California Unfair Competition Law. Umpqua Bank has engaged defense counsel and intends to vigorously defend against these suits and any similar or related suits or claims. Umpqua Bank has notified relevant insurance carriers and business counterparties and continues to reserve all of its relevant rights to indemnity, defense, contribution, and other relief in connection with these matters. We cannot predict or determine the timing or outcome of these lawsuits or the impact they may have, if any, on our financial condition, results of operations, or cash flows. We believe that if one or more outcomes that are determined in favor of the plaintiffs in the litigation arising from the Vendor Incident it could have a material adverse effect on our business, operations, or financial results.


text: Our Board of Director's Enterprise Risk Management Committee (the "ERMC") is responsible for the oversight of risks from cybersecurity threats. At least annually, the ERMC receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as anticipated emerging threats, cybersecurity posture, progress towards predetermined risk-mitigation-related goals, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the ERMC generally receives materials indicating current and emerging cybersecurity threat risks, and describing the Company's ability to mitigate those risks, and discusses such matters with our Chief Information Security Officer, Chief Information Officer, and Chief Privacy and Information Risk Officer. Members of the ERMC are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like enterprise risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters. Additionally, the Disclosure Committee periodically receives reports on cybersecurity threat risks to ensure that required disclosures are accurate and timely.


text: We recognize the importance of assessing, identifying, and managing material risks associated with cybersecurity threats, as such term is defined in Item 106(a) of Regulation S-K. These risks include, among other things, operational risks; intellectual property theft; fraud; extortion; harm to employees, customers or consumers; violation of data privacy or data security laws and other litigation and legal risk; and reputational risks.

companyName: CENTRAL GARDEN & PET CO

ticker: CENT


text: We also maintain an incident response plan to coordinate the activities we take to protect against, detect, respond to and remediate cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, as well as to comply with potentially applicable legal obligations and mitigate risk, including reputational damage.


text: We have implemented several cybersecurity processes, technologies, and controls to aid in our efforts to identify, assess, and manage material risks, as well as to test and improve our incident response plan. Our approach includes, among other things: • conducting regular network and endpoint monitoring, vulnerability assessments, and penetration testing to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • running tabletop exercises to simulate a response to a cybersecurity incident and use the findings to improve our processes and technologies; • regular, mandatory cybersecurity training programs for relevant employees; • comparing our processes to standards set by the International Organization for Standardization ("ISO"); • leveraging the ISO information security incident management model to help us identify, protect, detect, respond, and recover when there is an actual or potential cybersecurity incident; • leveraging third-party threat intelligence services designed to model and research our adversaries; • closely monitoring emerging data protection laws and implementing changes to our processes designed to comply; • periodically reviewing our consumer facing policies and statements related to cybersecurity; • conducting regular phishing email simulations for relevant employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • through policy, practice and contract (as applicable) requiring employees, as well as third parties who provide services on our behalf, to treat customer information and data with care; and • carrying information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident. These approaches vary in maturity across the business and we work to continually improve them.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process appropriate disclosure personnel will collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.


text: As part of the above approach and processes, we periodically engage with assessors, consultants, auditors, and other third-parties, for purposes of evaluating our cybersecurity posture and identifying areas for continued focus, improvement and/or compliance.


text: We describe how risks associated with a potential cybersecurity incident are reasonably likely to materially affect us, including our business, results of operations and financial condition, under the heading "A significant information security or operational technology incident, including a cyberattack or a data breach, could disrupt our operations and adversely impact our operating results, cash flows and reputation," included as part of our risk factor disclosures at Item 1A of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: In the last three fiscal years, we have not experienced any material cybersecurity incidents and the expenses we have incurred from cybersecurity incidents were immaterial. This includes penalties and settlements, of which there were none.


text: Cybersecurity is an important part of our risk management processes and an area of increasing focus for our Board and management.


text: The Audit Committee of our Board of Directors is responsible for the oversight of risks from cybersecurity threats. At least annually, the Audit Committee receives an overview from management of our cybersecurity threat risk management, including topics such as data security posture, results from third-party assessments, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the Audit Committee generally receives materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Information Security Leadership Team, comprised of Chris Walter, our Chief Information Officer, Frank Madigan, our Vice President, Information Technology and Security and Kelvin James, our Senior Manager, Information Security (the "InfoSec Leadership Team").


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our InfoSec Leadership Team. The executives on this team have collectively over 60 years of prior work experience in the management of information security, developing cybersecurity strategy and implementing effective information and cybersecurity programs. In addition to their work experience, Mr. Madigan has a Master of Business Administration in Information Technology Management and Mr. James has a Master of Science in Information Security and Assurance.


text: The InfoSec Leadership Team is informed about and monitors the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response plan and cybersecurity disclosure controls and procedures define the process to disclose such material cybersecurity incident.


text: As discussed above, the InfoSec Leadership Team reports about cybersecurity threat risks, among other cybersecurity related matters, to senior management and the Audit Committee, which provides updates to the full Board of Directors.


text: Risk Management and Strategy We operate our segments and their practices through FTI Consulting and its subsidiaries in 31 countries with different business, client, and geographic cybersecurity risk profiles. We aim to proactively identify and assess our vulnerability to cybersecurity threats and actual cybersecurity incidents on an ongoing basis at both the enterprise level, as well as at a more operational level, differentiating unique risks related to our segments, practices, clients, employees, and the locations in which business is conducted. Our Information Technology Group ("ITG") closely monitors and analyzes cybersecurity incidents and risks and our progress mitigating and resolving such threats. This information is regularly discussed with our outside directors and executive management and other interested parties.

companyName: FTI CONSULTING, INC

ticker: FCN


text: Approach and Integration Cybersecurity risk is integrated and managed as part of our broader enterprise risk management program under the direction of our Vice President – Chief Risk and Compliance Officer – who works closely with our Chief Information Officer and others, including the Head of our Cybersecurity & Privacy division to identify, review, assess and address cybersecurity and other security risks. Our Chief Risk and Compliance Officer, Chief Information Officer and the Head of our Cybersecurity & Privacy division are members of the Company's cybersecurity response team (the "Cyber Response Team"). The Cyber Response Team's responsibilities include maintaining a Cybersecurity Incident Response Plan, which sets out a path for how cyber threats and incidents are identified and escalated up to and including the Board of Directors and other leadership, when appropriate. Direct threats are escalated promptly to the appropriate team, following a path that considers both the nature of the threat, the level of risk, and the degree to which it has been substantiated. Indirect threats, such as third-party incidents, are escalated through the ITG to the appropriate corporate functions, as the situation warrants.


text: Third-Party Engagement and Oversight Where appropriate, we engage reputable third-party vendors to provide cybersecurity-related services, including security monitoring, risk evaluations, penetration testing, audit, and incident response services, which are aligned with internationally accepted frameworks. Our vendors are selected based on specific due diligence activities, such as evaluations of controls, policies, and processes of such vendors for protecting data, and resolving incidents, as well as entering into written contracts with such vendors that include terms addressing data security, privacy, and incident response expectations, responsibilities and liabilities, and termination rights of the parties. We routinely monitor vendor performance, review compliance with contract terms, and address concerns.


text: Further, our Vendor Code of Conduct addresses our expectations with respect to data security. When our Procurement group processes a vendor relationship involving information systems, various groups will review the vendor and its systems for potential data security-related issues and risks associated with using the tools, technology, data processing and other services of such vendor. Our contracts include terms addressing the safeguarding of our data.


text: Incident Response Plan and Training In the event of the detection of a potentially significant cybersecurity incident or threat, an escalation of cybersecurity threat, or changes with respect to a current incident, the Company has processes in place to notify relevant employees who assist in the response, as well as third-party vendors. Our ITG and management, in consultation with the Company's third-party legal counsel and accountants, will assess materiality, informed by ongoing discussions about what criteria would constitute potential materiality considerations. The Audit Committee and necessary directors will be informed of all material events.


text: To educate our management, employees, and consultants, and mitigate the risk of human failure in exposing our Information Technology systems to cybersecurity threats from bad actors; management, employees, and consultants are required to complete on-line cybersecurity training annually. We also provide regular reminders to employees regarding suspicious emails or other communications and conduct periodic phishing simulations and remedial spot testing and training to reinforce recognition and response techniques.


text: In 2023, we conducted a tabletop training with an executive officer and an outside director simulating cybersecurity events and appropriate responses. We intend to continue to conduct such simulation training with this group on a periodic basis. Other directors and officers of the Company will be given the opportunity to participate in such training. In addition, our outside directors are encouraged to attend continuing education relating to cybersecurity. In 2023, two directors received certificates in cybersecurity oversight or emerging technologies.


text: Materiality of Risks We are subject to and routinely face cyber-based attacks and attempts by hackers and similar unauthorized users seeking to gain access to or corrupt our information technology systems. As of December 31, 2023, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition, or that we believe are reasonably likely to have such an effect over the long term. However, there can be no assurance that we will be able to successfully mitigate the negative impacts of cybersecurity threats in the future. Accordingly, we continue to prioritize our cybersecurity risk management despite the lack of identified material impacts to date.


text: Management and Board of Directors' Role The Audit Committee meets regularly with management to manage and assess risk exposures and potential damages related to information security, cybersecurity, and data protection and the steps management has taken to identify, monitor, and control such exposures, as well as associated mitigation and remediation action, and actions to continue our operations. Information distributed to and discussed with the Audit Committee includes data on cybersecurity incidents and risks, company-wide enterprise risks, training programs, risk assessments, internal controls, security software, incident response plans, and forward-looking information security and business continuity strategies. The Audit Committee reports directly to the Board of Directors on a quarterly basis.


text: Expertise of Management Our Chief Information Officer, who has led our ITG since 1999, holds degrees in Cybersecurity Management and Policy and Information Management and is certified in various information security applications. The Head of our Cybersecurity and Privacy division has been with FTI since 2007 and has extensive experience in the cybersecurity field. The members of Cybersecurity & Privacy division have experience and education in cybersecurity, risk management, data assurance, and compliance. Among them they hold various certifications in information systems security and privacy. The practices and activities of our cybersecurity and information technology teams align with internationally accepted management frameworks.


text: Furthermore, we offer cybersecurity consulting as a service to clients. Our client-facing cybersecurity and information security experts periodically advise our cybersecurity and information technology teams regarding best practices. In addition, from time-to-time, they address our executives, directors, and other segment or regional leaders regarding complex issues faced by other companies that arise from data-security-related challenges. Among other things, they discuss new and evolving types and levels of threats and attacks, hacking and ransomware, foreign actors, risks driven by new and evolving technologies, including artificial intelligence, potential damages, and liability, and technological and other solutions potentially available to mitigate such risks, as well as other company responses. The existence of this team within FTI serves to aid in our ability to have current incident and threat intelligence that we can use to bolster our own security posture and defenses. Our cybersecurity practice also provides us with supplemental incident response investigation services in partnership with independent, external consultants, as needed and as appropriate.


text: For additional information on the risks we face related to cyber and information security threats, please see the related risk factor in Item 1A. Risk Factors.


text: Risk Management and Strategy We operate our segments and their practices through FTI Consulting and its subsidiaries in 34 countries with different business, client, and geographic cybersecurity risk profiles. We aim to proactively identify and assess our vulnerability to cybersecurity threats and actual cybersecurity incidents on an ongoing basis at both the enterprise level, as well as at a more operational level, differentiating unique risks related to our segments, practices, clients, employees, and the locations in which business is conducted. Our Information Technology Group ("ITG") helps monitor and analyze cybersecurity incidents and risks and our progress mitigating and resolving such threats. This information is regularly discussed with our outside directors and executive management.


text: Approach and Integration Cybersecurity risk is integrated and managed as part of our broader enterprise risk management program under the direction of our Vice President – Chief Risk and Compliance Officer – who works closely with our Chief Information Officer and others, including the Head of our Cybersecurity & Privacy division to help identify, review, assess and address cybersecurity and other security risks. Our Chief Risk and Compliance Officer, Chief Information Officer and the Head of our Cybersecurity & Privacy division are members of the Company's cybersecurity response team (the "Cyber Response Team"). The Cyber Response Team's responsibilities include maintaining a Cybersecurity Incident Response Plan, which sets out a path for how cyber threats and incidents are identified and escalated up to and including the Board of Directors and other leadership, when appropriate. Direct threats are escalated promptly to the appropriate team, following a path that considers both the nature of the threat, the level of risk, and the degree to which it has been substantiated. Indirect threats, such as third-party incidents, are escalated through the ITG to the appropriate corporate functions, as the situation warrants.


text: Further, our Vendor Code of Conduct addresses our expectations with respect to data security. When our Procurement group processes a vendor relationship involving information systems, various groups will review the vendor and its systems for potential data security-related issues and risks associated with using the tools, technology, data processing and other services of such vendor. Our contracts include terms that help address the safeguarding of our data.


text: To educate our management, employees, and consultants, and help mitigate the risk of human failure in exposing our Information Technology systems to cybersecurity threats from bad actors; management, employees, and consultants are required to complete on-line cybersecurity training annually. We also provide regular reminders to employees regarding suspicious emails or other communications and conduct periodic phishing simulations and remedial spot testing and training to reinforce recognition and response techniques.


text: In 2024, we conducted two tabletop exercises, simulating cybersecurity events and appropriate responses, with the senior leadership team of FTI including an executive officer and an outside director. We intend to continue to conduct such simulation training with this group on a periodic basis. Other directors and officers of the Company have been and will continue to be given the opportunity to participate in such training. In addition, our outside directors are encouraged to attend continuing education relating to cybersecurity.


text: Materiality of Risks We are subject to and routinely face cyber-based attacks and attempts by hackers and similar unauthorized users seeking to gain access to or corrupt our information technology systems. Since the beginning of the last fiscal year, we have not identified risks from known cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition, or that we believe are reasonably likely to have such an effect over the long term. However, there can be no assurance that we will be able to successfully mitigate the negative impacts of cybersecurity threats in the future. Accordingly, we continue to prioritize our cybersecurity risk management despite the lack of identified material impacts to date.


text: Management and Board of Directors' Role The Audit Committee meets regularly with management to help manage and assess risk exposures and potential damages related to information security, cybersecurity, and data protection and the steps management has taken to help identify, monitor, and control such exposures, as well as associated mitigation and remediation action, and actions to continue our operations. Information distributed to and discussed with the Audit Committee includes data on cybersecurity incidents and risks, company-wide enterprise risks, training programs, risk assessments, internal controls, security software, incident response plans, and forward-looking information security and business continuity strategies. The Audit Committee reports directly to the Board of Directors on a quarterly basis.


text: Furthermore, we offer cybersecurity consulting as a service to clients. Our client-facing cybersecurity and information security experts periodically advise our cybersecurity and information technology teams regarding best practices. In addition, from time-to-time, they address our executives, directors, and other segment or regional leaders regarding complex issues faced by other companies that arise from data-security-related challenges. Among other things, they discuss new and evolving types and levels of threats and attacks, hacking and ransomware, foreign actors, risks driven by new and evolving technologies, including artificial intelligence, potential damages, and liability, and technological and other solutions potentially available to mitigate such risks, as well as other company responses. The existence of this team within FTI aids in our ability to have current incident and threat intelligence that we can use to bolster our own security posture and defenses. Our cybersecurity practice also provides us with supplemental incident response investigation services in partnership with independent, external consultants, as needed and as appropriate.


text: The General Partner has written procedures and policies that govern the Partnership's general cybersecurity program. These policies and procedures include, among other things, the identification of risks, locations of information, management of third party risk and incident response, among other factors, and are designed to address real world concerns.

companyName: NESTOR PARTNERS


text: The Cybersecurity Committee (the "Committee") of the General Partner is responsible for overseeing cyber and information security. The Committee meets at least quarterly to discuss cybersecurity risks and frequently holds more informal discussions in the interim. The Committee is subject to oversight by the board of directors of the General Partner (the "Board"). The Committee is co-chaired by the General Partner's President/Chief Operating Officer, Chief Technology Officer/Co-Head of Trading, and General Counsel/Chief Compliance Officer who oversee day-to-day implementation of cyber and information security by employees with specialized expertise and experience in such matters. The Board is kept apprised of the cybersecurity policies and procedures on a formal basis at least annually, and is kept informed on a less formal basis through participation in training and policy updates. The Committee meets at least quarterly to discuss and review testing, cybersecurity risks/events and all other relevant matters. Committee members are given the opportunity at these meetings to ask questions of all relevant personnel.


text: The General Partner utilizes a combination of statistics, data and testing by third party service providers and software in order to monitor and identify cybersecurity threats. To the extent those threats require immediate attention, they are dealt with and reported to the Committee thereafter in accordance with the procedures outlined in the General Partner's incident response plan. Other threats, as well as follow ups once threats are properly dealt with, are then discussed and analyzed by the Committee. Reports on these activities are discussed with the Board on at least an annual basis, with any material issues raised promptly to the Board as well.


text: To assess the effectiveness of the General Partner's cybersecurity programs and to mitigate exposure, the General Partner has consulted with strategic partners, such as outside counsel specializing in this subject matter as well as the General Partner's cyber insurance provider. The General Partner also undertook a table top exercise designed to identify and mitigate issues and train personnel.


text: The General Partner's head of risk management (who is also mentioned above as one of the co-chairmen of the Committee) participates in all Committee meetings and, as part of the risk management function, the Committee applies principles of risk management to its information security program. As with all risks identified by the General Partner, risks are identified and evaluated, with higher risk items receiving priority attention.


text: The General Partner has undertaken efforts to mitigate cyber risks and their impact, including, but not limited to, certain implementation of firewalls, anti-virus/anti-malware, controls around remote network access, multi-factor authentication, system event monitoring and notifications and electronic surveillance, frequent backups, encryption and password protection, education and testing, supervision of third parties, limitations on access, vulnerability scanning, patch installation, physical safeguards, virus scanning, and penetration testing.


text: Employees are required to complete initial cybersecurity training upon commencement of employment and, thereafter, on an annual basis. The training is designed by a third party service provider. The General Partner carries cyber insurance. The General Partner maintains formal cybersecurity procedures that are considered during contract review with respect to third party vendors handling and having access to information.


text: The General Partner has not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected the General Partner or the Partnership's business strategy, results of operation or financial condition. Nonetheless, there is no guarantee that a future cyber incident would not materially affect the General Partner or the Partnership's business strategy, results of operations or financial condition. Despite the various efforts the General Partner has undertaken to mitigate cyber risks and their impact, systems, networks and/or devices potentially can be breached. Such cybersecurity breaches may cause: (i) disruptions and impacts to business operations, potentially resulting in financial losses to the Partnership and limited partners; (ii) interference with the General Partner's ability to calculate the value of an investment; (iii) impediments to trading; (iv) the inability of the Partnership and its service providers to transact business; (v) violations of applicable privacy and other laws; (vi) regulatory fines, penalties, reputational damage, reimbursement or other compensation costs or additional compliance costs; and (vii) the inadvertent release of confidential information. Similar adverse consequences could result from cybersecurity breaches affecting counterparties with which the Partnership engages in transactions; governmental and other regulatory authorities; exchange and other financial market operators, banks, brokers, dealers, insurance companies and other financial institutions; and other parties. In addition, substantial costs may be incurred by these entities in order to prevent any cybersecurity breaches in the future. The nature of malicious cyber-attacks is becoming increasingly sophisticated and the Partnership cannot control the cyber systems and cybersecurity systems of counterparties or third party service providers. While, to date, we have not been subject to cyberattacks that, individually or in the aggregate, have been material to our operations or financial condition, the preventive actions we take to reduce the risks associated with cyberattacks may be insufficient to repel or mitigate the effects of a major cyberattack in the future.


text: Our Board and management exercise oversight over the Company's cybersecurity program, which represents an important component of the Company's overall approach to enterprise risk management.

companyName: OMEGA HEALTHCARE INVESTORS INC

ticker: OHI


text: Omega's Vice President of Information Technology ("VP of IT") manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes and risk assessment related to information security and data protection, including data privacy and network security (our "Cybersecurity Program"). The VP of IT has served in various roles in information technology and information security for over 30 years and, along with other members of the IT department, holds relevant and applicable certifications. The VP of IT reports directly to the Company's Chief Financial Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our Board and the Audit Committee of our Board.


text: Our Board, in coordination with our Audit Committee, oversees our management of cybersecurity risk, with the Audit Committee reviewing and discussing with management quarterly matters related to our Cybersecurity Program as related to financial reporting. The Board and Audit Committee receive periodic reports about the prevention, detection, mitigation and remediation of cybersecurity incidents, including material security risks and information security vulnerabilities. Additionally, risks associated with the Cybersecurity Program are integrated into the Company's enterprise risk management assessment and reported to our Board at least twice per year. We also share the key results of third-party assessments with our Board and Audit Committee.


text: Technical Safeguards As part of our Cybersecurity Program, the Company deploys technical safeguards that are designed to protect our information systems from cybersecurity threats, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: Our Cybersecurity Program also includes an annual risk assessment which is generally based on frameworks established by the National Institute of Standards and Technology ("NIST").


text: Third-Party Risk Management We also maintain policies and procedures designed to identify and mitigate cybersecurity threats related to our use of material third-party vendors. This includes reviewing the internal controls of certain third-party service providers to assess their procedures to mitigate material security risks.


text: Incident Response and Recovery Planning We maintain an Information Security Incident Response Plan (the "Response Plan") governing prevention, detection, mitigation and remediation of cybersecurity incidents and threats. The Response Plan includes controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding public disclosure and reporting of such incidents can be made by management in a timely manner, with appropriate involvement by our Board. We regularly test the effectiveness of the Response Plan.


text: External Assessments We obtain periodic assessments by third party experts to assess our vulnerability management and security controls and to assist us in identifying and mitigating security risks.


text: Education and Awareness We provide cybersecurity training for all directors, officers and employees and periodic additional training of senior management through our cyber insurance carrier.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations, or financial condition. For information regarding cybersecurity risks that may materially affect our Company, see the risk factor titled " We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology could harm our business. Privacy and security laws and regulations may also increase costs for our business. " under "Risk Factors" in Part I, Item 1A to this Annual Report on Form 10-K.


text: Omega's Vice President of Information Technology (" VP of IT ") manages a team responsible for leading enterprise-wide strategy, policy, standards, architecture, processes and risk assessment related to information security and data protection, including data privacy and network security (our "Cybersecurity Program"). The VP of IT has served in various roles in information technology and information security for over 30 years and, along with other members of the IT department, holds relevant and applicable certifications. The VP of IT reports directly to the Company's Chief Financial Officer and provides periodic reporting on our Cybersecurity Program to our senior management team, our Board and the Audit Committee of our Board.


text: As of the date of this report, we are not aware of any risks from cybersecurity threats that have materially affected the Company, including our business strategy, results of operations, or financial condition. For information regarding cybersecurity risks that may materially affect our Company, see the risk factor titled " We rely on information technology in our operations, and any material failure, inadequacy, interruption or security failure of that technology, including related to artificial intelligence, could harm our business. Privacy and security laws and regulations may also increase costs for our business. " under "Risk Factors" in Part I, Item 1A to this Annual Report on Form 10-K.


text: The cybersecurity and data protection program at Littelfuse is based on foundational principles outlined in applicable industry and internationally accepted-cybersecurity frameworks. The Company has experienced and will continue to experience cyber-attacks, attempts to breach its systems, and other similar incidents, however we do not believe that the prior cyber incidents have materially affected or currently are reasonably likely to materially affect the Company. Littelfuse faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows, or reputation. Like all cybersecurity programs, there is no guarantee that every attack method and technique has been fully addressed, as these change constantly, but Littelfuse is diligent in its attempts to protect data of the Company and its stakeholders.

companyName: LITTELFUSE INC /DE

ticker: LFUS


text: Littelfuse strives to assess and update its cybersecurity program on a regular basis using an Information Security Management System (ISMS) comprised of three main elements – 1) independent internationally recognized vendors and technologies for assessments and monitoring, 2) strong internal controls based on industry standards, and 3) Board and Senior Leadership governance and support.


text: From an external assessment and monitoring perspective, Littelfuse engages third parties to monitor and report on known exploitable vulnerabilities, within and external to Littelfuse's information technology (IT) ecosystems. These third parties provide assessment and vulnerability scanning tools to detect exploitable unauthorized access into the Littelfuse environments.


text: The Audit Committee of the Board of Directors is tasked with reviewing the Company's policies and procedures related to cybersecurity risks and incidents. The Company's Chief Information Officer ("CIO") oversees its cybersecurity program, and regularly provides updates to Littelfuse Senior Leadership and the Audit Committee, as well as the full Board, which include information regarding our cybersecurity program initiatives, insurance coverage, acquisition integration processes, program performance as well as the maturity of the Littelfuse cybersecurity program. These cybersecurity maturity updates are based on cybersecurity maturity reporting and analysis by the Littelfuse internal IT team, as well as reporting provided by independent third parties. The updates help Senior Leadership, the Audit Committee, and the Board to understand the risks the organization faces based on changing cybersecurity threats and on changes to the Littelfuse environment due to factors such as acquisitions and new technology upgrades and improvements. Representatives from Littelfuse's technology team and other business functions receive regular cybersecurity risk reports and use this information for its decision making in operational improvements as well as budget and resource allocations. The CIO has managed and evolved the cyber security function at Littelfuse for the past five years and is supported by a cyber security leader with over 20 years of Littelfuse experience in IT infrastructure, IT operations, and cybersecurity.


text: The ISMS within Littelfuse consists of internationally recognized program elements that reduce the risk of an operational or cybersecurity incident from significantly impacting Littelfuse and its customers, vendors, and employees. These ISMS elements include but are not limited to:


text: Security Awareness and Training – Littelfuse has an IT security awareness program consisting of training on the fundamentals of information security protection. These training courses are provided annually.


text: Network Protection – Network protection, detection, and monitoring technologies have been deployed on all external and internal network connections to segment different sections of the business from each other to strengthen key protection capabilities.


text: Identity and Access Management (IAM) – Littelfuse has implemented user authentication controls on its systems, devices, data, and applications. In addition, multi-factor authentication is implemented for all personnel who remotely access or have privileged account access to Littelfuse systems and networks.


text: Data Classification and Protection – Littelfuse has implemented data loss prevention and classification labels and encryption on its internal unstructured data to prevent unauthorized data loss and data sharing. Structured data in ERP systems and core business systems are encrypted and protected by industry cybersecurity standards and procedures.


text: Endpoint Protection – Littelfuse has implemented anti-virus, malware, and endpoint protection management detection and monitoring solutions on end-user devices and servers. Logs and alerts from these monitoring solutions are routed to independent third-party monitoring vendors that provide 24/7 monitoring, around the world.


text: Threat and Vulnerability Management – Littelfuse uses an internationally recognized managed security services provider (MSSP) and technologies to collect security alert and audit logs on a 24/7 basis, monitor and assess latest threat intelligence, provide analysis on new identified potential vulnerabilities, and provide response and support services to rapidly reduce any identified vulnerabilities.


text: Security Incident Management – Security incident response plans and procedures have been developed in collaboration with our MSSP. They allow us to assess potential threats, first and second level notification and response protocols, and supporting notification protocols – both internally and externally. These plans, procedures, and protocols are tested and updated on a regular basis.


text: Resiliency and Contingency Planning – Risk assessments are performed on a regular basis to assess the IT risk of single points of failure, security maturity, and security vulnerabilities. The results of these assessments are used to define various resiliency and contingency mitigation strategies, corrective action plans, on-site and remote data back-up strategies and technologies and allocation of IT resources.


text: The cybersecurity and data protection program at Littelfuse is based on foundational principles outlined in applicable industry and internationally accepted-cybersecurity frameworks. The Company has experienced and will continue to experience cyber-attacks, attempts to breach its systems, and other similar incidents, however we do not believe that the prior cyber incidents have materially affected or are reasonably likely to materially affect the Company. Littelfuse faces risks from cybersecurity threats that could have a material adverse effect on its business, financial condition, results of operations, cash flows, or reputation. Like all cybersecurity programs, there is no guarantee that every attack method and technique has been fully addressed, as these change constantly, but Littelfuse is diligent in its attempts to protect data of the Company and its stakeholders.


text: Littelfuse strives to assess and update its cybersecurity program on a regular basis using an Information Security Management System ("ISMS") comprised of three main elements – 1) independent internationally recognized vendors and technologies for assessments and monitoring, 2) strong internal controls based on industry standards, and 3) Board and Senior Leadership governance and support.


text: From an external assessment and monitoring perspective, Littelfuse engages third parties to monitor and report on known exploitable vulnerabilities, within and external to Littelfuse's information technology ("IT") ecosystems. These third parties provide assessment and vulnerability scanning tools to detect exploitable unauthorized access into the Littelfuse environments.


text: Identity and Access Management ("IAM") – Littelfuse has implemented user authentication controls on its systems, devices, data, and applications. In addition, multi-factor authentication is implemented for all personnel who remotely access or have privileged account access to Littelfuse systems and networks.


text: Threat and Vulnerability Management – Littelfuse uses an internationally recognized managed security services provider ("MSSP") and technologies to collect security alert and audit logs on a 24/7 basis, monitor and assess latest threat intelligence, provide analysis on new identified potential vulnerabilities, and provide response and support services to rapidly reduce any identified vulnerabilities.


text: We have implemented and maintain a cybersecurity program that is aligned with the NIST Framework and designed to protect our information and to assess, identify, and manage risks from cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of our information systems.

companyName: PATTERSON UTI ENERGY INC

ticker: PTEN


text: Our Board of Directors has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee periodically reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives reports and presentations from members of our senior leadership for overseeing the company's cybersecurity risk management, including the Senior Vice President of Information Technology, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. We have protocols by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board of Directors and Audit Committee.


text: Our Audit Committee is responsible for overseeing information security and cybersecurity risk. Senior leadership communicates with the Audit Committee at least quarterly regarding information security and cybersecurity risk and formally reports to the entire Board of Directors on information security and cybersecurity risk at least annually.


text: At the management level, our Senior Vice President of Information Technology, who has extensive cybersecurity knowledge and skills gained from over 19 years of work experience at our company and elsewhere, heads the team responsible for implementing, monitoring, and maintaining information security and cybersecurity practices across our businesses and reports directly to our Chief Financial Officer.


text: The Senior Vice President of Information Technology receives reports on information security and cybersecurity threats from our Director of Infrastructure and Cybersecurity and in conjunction with management, regularly reviews risk management measures implemented by our company to identify and mitigate information security and cybersecurity risks. A number of experienced information security team members responsible for various parts of the business also report to the Senior Vice President of Information Technology on an ongoing basis. In addition to our internal cybersecurity capabilities, we also regularly engage assessors, consultants, auditors, and other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: We have adopted a cybersecurity incident reporting process ("IRP") that applies in the event of a cybersecurity threat or incident to provide a standardized framework for response. The IRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management, the Board of Directors and other key stakeholders informed and involved as appropriate.


text: Risk Management and Strategy Our senior management and representatives from our business units regularly communicate with the Board of Directors on risk management matters, including cybersecurity risks. Senior management conducts regular risk assessments to identify risks that have the potential to significantly affect our business over the short-, medium- and longer term and reviews with the Board of Directors risk mitigation and oversight measures, including prioritization of risk management and allocation of responsibility within our company for the management of a particular risk.


text: We continue to improve our cybersecurity risk assessment program and activities for assessing, identifying and managing cybersecurity risks through industry standard security frameworks and leading practices, including risk assessments and remediations, software and services, continuous systems monitoring, vendor risk management processes, incident response plans, phishing simulations, employee training, tabletop exercises and communication programs, among other measures. We also employ processes designed to assess, identify, and manage the potential impact of a security incident at critical third-party vendors, service providers or customers or otherwise implicating the third-party technology and systems we use.


text: All employees with a company-provided email are assigned annual cyber awareness training. In addition, we perform monthly phishing simulations, with remediation training required as necessary.


text: While we have not experienced material cybersecurity threats or incidents, or threats or incidents that are reasonably likely to materially affect us, there can be no guarantee that we will not be the subject of future successful attacks, threats or incidents. Information on cybersecurity risks and threats we face can be found in Part I, Item 1A "Risk Factors" of this Report under the heading "Our business is subject to cybersecurity risks and threats."


text: The Company has integrated the assessment, identification, and management of cybersecurity threats within its overall risk assessment process. In general, cybersecurity risk is overseen by management which reports and discusses cyber risks and developments, if any, with the Board of Directors. In addition, the Company has engaged an outside managed IT services company which provides continuous monitoring of any events that could cause a business interruption or degradation of technology performance as well as any information regarding security incidents that may pose a risk to the Company.

companyName: Lightning Gaming, Inc.


text: A process for assessing, identifying, and managing cybersecurity related risks is integrated into our overall enterprise risk management ("ERM") process. Cybersecurity related risks are included in the risk universe that the ERM process participants evaluate to assess top risks to the Company on an annual basis. The Audit Committee of the Board oversees the ERM annual risk assessment. Furthermore, as a digital innovation and transformation company, we are committed to our ever-evolving cyber protocols that safeguard our people, clients, and data. Every year, we assess our approach to information and physical security, risk management, incident response, business continuity management, and personal data privacy and protection.

companyName: ASGN Inc

ticker: ASGN


text: ASGN takes an enterprise approach to data protection and cybersecurity, focusing on continual process and technology improvements to enable safety, security, and information privacy. All ASGN's brands align to the Department of Defense's Cybersecurity Maturity Model Certification ("CMMC") 2.0 framework and have implemented common technology and data protection and cybersecurity controls and processes, which provides a unified approach to our cybersecurity measures. We have invested in endpoint protection, cloud security, vulnerability management, and data loss prevention, featuring insider threat detection, we also conduct regular threat actor risk assessments and assess the risk posed by third-party vendors. Further, ASGN conducts penetration tests to detect potential security gaps in cloud and on-premise systems. These tests continuously simulate cyber-attacks on physical hardware, network endpoints, and critical applications such as Oracle, SQL and web services.


text: ASGN maintains a vigilant approach to cybersecurity and operational readiness, with cybersecurity practices designed to reduce the impact of any incident. ASGN has business continuity and disaster recovery policies. Our plans are tested annually to confirm critical business functions can continue with minimal disruption in unforeseen circumstances.


text: We conduct regular internal and external audits to adhere to our security policies and procedures and identify improvement areas. Our audits include: annual audits conducted by third-party service providers, internal audits, compliance audits, risk assessments, and incident response audits. In addition to these audits, ASGN collaborates with industry partners, law enforcement agencies, and government organizations to share intelligence and best practices related to cybersecurity. This collaboration helps us stay ahead of emerging threats and continuously improve our security posture.


text: In 2023, ASGN has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.


text: ASGN's data protection and cybersecurity governance structure enables transparency and visibility to key stakeholders: the Company's Board and its Strategy and Technology and Audit Committees, and the Company's Chief Executive Officer. The Board's Strategy and Technology Committee focuses on technology and cybersecurity, while the Board's Audit Committee reviews data security breaches or other issues. Each committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from the Company's chief information officers across our brands ("CIOs") and external experts as part of the Board's continuing education on topics that impact public companies.


text: Two key enabling bodies, ASGN's Enterprise Security Council and the Security Operations Center ("SOC"), have primary responsibility for our overall cybersecurity risk management program and provide the structure necessary to set policy and direction as well as operationalize our required security posture.


text: • Our CIOs lead our internal Enterprise Security Council collectively representing ASGN and its Segments which reports to our Chief Executive Officer and the Board's Strategy and Technology Committee. These leaders bring a wealth of experience in security operations, business process re-engineering, software development, ERP systems, and the management of multinational wide area networks. Complementing this expertise, the Enterprise Security Council includes a dedicated team of Cybersecurity Information Professionals (CISP), consisting of brand-specific system engineers and security administrators. The council's primary mandate is to formulate comprehensive data protection and cybersecurity policies for ASGN, oversee the management of emerging security threats, proactively mitigate security risks, and safeguard our valuable assets. • ECS Federal, LLC ("ECS"), ASGN's Federal Government Segment, plays a vital role in safeguarding ASGN through its essential security control function. Serving as a managed services provider for both clients and internal operations, ECS oversees the SOC which is dedicated to monitoring, detecting, and responding to cybersecurity threats across our organization. Operating 24 hours a day, seven days a week, our SOC diligently filters system logs, leveraging proprietary AI/ML tools to identify global threats. We conduct continuous active hunts and forensic analysis inspections on our network, proactively seeking out malware and intrusions.


text: ASGN takes an enterprise approach to data protection and cybersecurity, focusing on continual process and technology improvements to enable safety, security, and information privacy. All ASGN brands align to the Department of Defense's Cybersecurity Maturity Model Certification ("CMMC") 2.0 framework and have implemented common technology and data protection and cybersecurity controls and processes, which provides a unified approach to our cybersecurity measures. This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the CMMC 2.0 framework as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business. We have invested in endpoint protection, cloud security, vulnerability management, and data loss prevention, featuring insider threat detection, we also conduct regular threat actor risk assessments and assess the risk posed by third-party vendors. Further, ASGN conducts penetration tests to detect potential security gaps in cloud and on-premise systems. These tests continuously simulate cyber-attacks on physical hardware, network endpoints, and critical applications such as Oracle, SQL and web services.


text: In 2024, ASGN has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial conditions.


text: Two key enabling bodies, ASGN's Enterprise Security Council ("Council") and the Security Operations Center ("SOC"), have primary responsibility for our overall cybersecurity risk management program and provide the structure necessary to set policy and direction as well as operationalize our required security posture.


text: • The Council includes the CIOs and is led by the Chief Information Security Officer ("CISO"). Our CISO joined the Company in 2018 in connection with the acquisition of ECS Federal, LLC ("ECS") and has decades of experience in oversight of cybersecurity operations. Collectively, the Council represents ASGN and its brands, and reports to the Chief Executive Officer and the Board's Strategy and Technology Committee. The Council members bring a wealth of experience in security operations, business process re-engineering, software development, ERP systems, and the management of multinational wide area networks. Complementing this expertise, the Council also includes a dedicated team of Cybersecurity Information Security Professionals, consisting of brand-specific system engineers and security administrators. The Council's primary mandate is to formulate comprehensive data protection and cybersecurity policies for ASGN, oversee the management of emerging security threats, proactively mitigate security risks, and safeguard our valuable assets. • ECS, ASGN's Federal Government Segment, plays a vital role in safeguarding ASGN through its essential security control function. Serving as a managed services provider for both clients and internal operations, ECS oversees the SOC which is dedicated to monitoring, detecting, and responding to cybersecurity threats across our organization. Operating 24 hours a day, seven days a week, our SOC diligently filters system logs, leveraging proprietary AI/ML tools to identify global threats. We conduct continuous active hunts and forensic analysis inspections on our network, proactively seeking out malware and intrusions.


text: Cybersecurity Governance and Risk Management Information security is a significant operational risk for financial institutions such as Radian and includes the risk of loss resulting from cyberattacks.

companyName: RADIAN GROUP INC

ticker: RDN


text: To help mitigate this risk, Radian has designed and maintains an Information Security Program that is intended to protect our corporate data as well as data entrusted to us by our customers and partners. The Information Security Program is built on a risk-based approach that identifies and prioritizes cyber threats based on their potential impact on our strategy, operations, and assets. This program extends across all business lines and encompasses written policies on cybersecurity.


text: The Company has assigned executive ownership of and accountability for the Information Security Program to the Chief Information Security Officer, who leads a dedicated team of trained staff to protect the confidentiality, integrity and availability of information assets. Our Chief Information Security Officer has over 20 years of diverse industry experience, including serving in similar roles overseeing cybersecurity programs, as well as serving in numerous board and advisory capacities. Several members of the Information Security team hold advanced degrees as well as industry-recognized certifications in cybersecurity and related disciplines. The Information Security Program also utilizes third-party managed security services where appropriate.


text: Our Information Security Program utilizes multiple layers of security controls that are intended to protect information assets and operations. As a guideline to manage our cybersecurity-related risk, we use the National Institute of Standards and Technology Cybersecurity Framework, which outlines information security measures and controls over five functions: Identify, Protect, Detect, Respond and Recover. This does not imply that we meet any particular technical standards, specifications, or requirements. Our risk management process is designed for the purpose of identifying, assessing and mitigating potential threats and uncertainties that may impact the achievement of our business objectives. This process involves engaging relevant stakeholders, conducting regular risk assessments, and staying informed about industry-specific risks and market trends. Identified risks are evaluated based on their potential impact and likelihood of occurrence.


text: As a Company, we have developed key security services, including data governance, encryption, vulnerability management, systems and network monitoring, access controls, application security, threat detection, incident response, employee awareness training, and assessment of our third-party service providers. We regularly test our incident response readiness and reporting through tabletop exercises, external and internal penetration testing and internal security testing so that identified risks and incidents are escalated and communicated for appropriate remediation activities that are intended to reduce risks to an acceptable level.


text: Our board of directors has ultimate oversight of cybersecurity risk, which it manages in coordination with our Risk Committee as part of our enterprise risk management program. The Risk Committee regularly reviews the Company's enterprise risk management program and Information Security Program with management and reports to the board of directors.


text: To maintain governance and oversight over the Information Security Program, we have established an Information Security Council and Executive Information Security Committee composed of our Chief Information Security Officer and colleagues with experience, education and ongoing training in information security, cybersecurity risk and information governance. We also utilize both internal and external auditors to provide independent assessments of our Information Security Program. Cybersecurity incidents are reviewed at least quarterly by management, the appropriate executive committees and the board of directors or its committees. The Chief Information Security Officer reports directly to our General Counsel and presents at least annually to the Company's full board of directors about the overall effectiveness of the Information Security Program, as well as quarterly to the Risk Committee of the Company's board of directors. Radian's board of directors approves the written Information Security Policy and Information Security Program documents annually. Collectively, these documents describe the structure, scope, organization and requirements of the Information Security Program, as well as the responsibility and authority of the Chief Information Security Officer.


text: During the reporting period, we were not impacted by any cybersecurity incidents that we believe are reasonably likely to materially affect our business strategy, results of operations, or financial condition.


text: While the Information Security Program is reasonably designed to mitigate the risk of cybersecurity events, we cannot provide assurance that we will not be subject to a cybersecurity event. In "Item 1A. Risk Factors," see "We could incur significant liability or reputational harm if the security of our information technology systems, or of our third-party vendors or service providers, is breached, including as result of a cyberattack, or we otherwise fail to protect confidential information, including personally identifiable information that we maintain."


text: Risk Management and Strategy The Company has processes, policies and procedures for identifying, assessing, managing, and responding to cybersecurity threats and incidents. These are integrated into our overall risk management systems, as overseen by our Board of Directors, primarily through the Audit Committee. Our policies and procedures include protocols for assessing potential material impact from cybersecurity threats and incidents, escalating to executive leadership and the Board of Directors, engaging external stakeholders, and reporting incidents based on applicable legal requirements. Our incident response plan provides guidance in the event of a cybersecurity incident, including processes with assigned roles and responsibilities to triage, contain, assess severity, escalate, investigate, and remediate incidents, as well as to comply with potentially applicable legal obligations and mitigate reputational damage.

companyName: MINERALS TECHNOLOGIES INC

ticker: MTX


text: We use cybersecurity technologies, products, specialized IT tools and services including cyber threat intelligence and external cyber technology experts to understand, manage, mitigate and continually remediate identified risks. A cybersecurity incident may be detected in a number of ways, including through the following avenues: Security Operations Center (SOC) events, employee reports such as helpdesk incidents, and Cybersecurity tool and service stacks (e.g., vulnerability detection, threat intelligence, anti-virus, and malware detection tools). All cybersecurity risks are logged into the Company's cyber security risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.


text: We periodically test our security controls through internal and external penetration testing that covers both corporate and plant IT networks by external specialized vendors, as well as in connection with auditing of our financial systems. We also conduct regular cybersecurity tabletop exercises to test established policies and procedures for responding to cybersecurity threats and incidents. In addition, we conduct an annual independent review of our cybersecurity posture.


text: Throughout the year, we conduct cybersecurity training and awareness for our employees to help identify, avoid and mitigate cybersecurity threats utilizing various delivery methods such as phishing campaigns, training sessions, and informational bulletins.


text: We conduct risk assessments of third-party suppliers and service providers including due diligence assessments of third-party suppliers and service providers that have access to the Company's networks, confidential information, and information systems. We provide all third-party vendors, consultants, and partners with detailed security requirements for securing their connections into our IT networks. Third parties service providers are also typically contractually responsible for identifying and remediating security issues within their technology and service environment.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information, see "Item 1A. Risk Factors, Our operations have been and will continue to be subject to cyber-attacks that could have a material adverse impact on our business, consolidated results of operations, and consolidated financial condition ".


text: The Board of Directors is responsible for overseeing the assessment and management of enterprise-level risks that may impact the Company. The Audit Committee has primary responsibility for overseeing risk management, including oversight of risks from cybersecurity threats. Management reports on cybersecurity matters, including material risks and threats, to the Audit Committee at regularly scheduled Audit Committee meetings, which is then discussed with the Board of Directors. The reports discuss specific risks and mitigation efforts, including critical and high cyber risks from the risk register, the results of our annual independent review of the Company's cybersecurity posture and other third party assessments and benchmarking information.


text: It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention material risks. Under the oversight of the Audit Committee, and as directed by the Company's Chief Executive Officer, the Company's Chief Information Officer (CIO) is primarily responsible for the assessment and management of cybersecurity risks. The CIO, who reports to the Chief Financial Officer, is aided by a third party Chief Information Security Officer with over 40 years of experience, in addition to other external professionals. Management's risk oversight is also accomplished through the Company's Strategic Risk Management Committee and Operating Risk Management Committee, which provides cross-functional support for cybersecurity risk management, as well as the Company's Chief Compliance Officer.


text: We use cybersecurity technologies, products, specialized IT tools and services including cyber threat intelligence and external cyber technology experts to understand, manage, mitigate and continually remediate identified risks. A cybersecurity incident may be detected in a number of ways, including through the following avenues: Security Operations Center (SOC) events, employee reports such as helpdesk incidents, and cybersecurity tool and service stacks (e.g., vulnerability detection, threat intelligence, anti-virus, and malware detection tools). All cybersecurity risks are logged into the Company's cybersecurity risk register where they are tracked for remediation. These cybersecurity risks are discussed with management for resolution planning and escalation. We leverage recognized cybersecurity frameworks to drive strategic direction and maturity improvement and engage third party security experts for risk assessments, risk mitigation actions, vulnerability identification, and program enhancements.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For more information, see "Item 1A. Risk Factors, Our operations have been and will continue to be subject to cyber-attacks and other disruptions to our information systems that could have a material adverse impact on our business, consolidated results of operations, and consolidated financial condition ".


text: It is management's responsibility to manage cybersecurity risks, as described above, and bring to the Board's attention material risks. Under the oversight of the Audit Committee, and as directed by the Company's Chief Executive Officer, the Company's Chief Information Officer (CIO) is primarily responsible for the assessment and management of cybersecurity risks. The CIO, who reports to the Chief Financial Officer, is aided by a third party Chief Information Security Officer with over 40 years of experience, in addition to other external professionals.


text: Management's risk oversight is also accomplished through the Company's Strategic Risk Management Committee and Operating Risk Management Committee, which provides cross-functional support for cybersecurity risk management, as well as the Company's Chief Compliance Officer.


text: Risk management and strategy Our processes for assessing, identifying, and managing material risks from cybersecurity threats are incorporated into our overall enterprise risk management framework. We take a cross-functional approach to cybersecurity risk, which includes input from information security, information technology, legal, compliance, internal audit, finance, and operations, as appropriate. Under the oversight of our Board, including its Audit and Finance Committee, our senior management, information security team, and our Cybersecurity Risk Committee (comprised of key executive and senior leaders from primary corporate functions) devote resources to cybersecurity and implement risk management processes designed to adapt to the changing cybersecurity landscape, respond to emerging threats and proactively coordinate our people, processes and procedures to respond to cybersecurity incidents. We regularly assess the threat landscape and cybersecurity risks. Our internal audit team reviews enterprise risk management-level cybersecurity risks as part of our overall enterprise risk management framework. In addition, our information security team oversees regular monitoring of our information technology and other operating systems that are designed to detect potential security incidents. We have operationalized a written incident response plan designed to assess, identify and coordinate among various functions the response activities to cyber incidents and determine the impact of any such cybersecurity incidents that may jeopardize the confidentiality, integrity or availability of our information systems or adversely affect our business and information systems. In the event of a significant cybersecurity incident, the incident response plan provides guidance on roles, responsibilities, procedures and reporting processes.

companyName: PATTERSON COMPANIES, INC.


text: Depending on the environment and system, we have implemented a number of measures and policies designed to enhance the security and resiliency of our network, information and data systems, including but not limited to: encryption standards; antivirus protection; remote access; multifactor authentication; treatment of confidential information and the use of the internet, artificial intelligence, social media, email and wireless devices; user access control management; intrusion monitoring systems; information security continuity measures, including redundant systems and information backups; network segmentation; encryption of certain data; event logging; and implementation of an application patching and update cadence. These measures and policies go through an internal review process and are approved by appropriate members of management.


text: We have performed simulations and tabletop exercises at a management level. Our employees are required to complete cybersecurity training at least once every year and have access to more frequent cybersecurity trainings online. We also require certain employees to complete additional role-based cybersecurity trainings. Our information security team regularly monitors for potential cybersecurity incidents and we have processes in place designed to escalate within the company more serious incidents, as appropriate.


text: We use consultants and other third parties to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example, cybersecurity software providers, managed cybersecurity service providers, professional cybersecurity advisors, and penetration testing firms.


text: Depending on the nature of the services provided, the sensitivity of the systems and data at issue, and the identity of the service provider, we take various measures designed to help manage cybersecurity risk associated with our use of third-party service providers, which may include due diligence; monitoring of cybersecurity threat risks identified through such diligence in connection with our use of third-party service providers; and imposing certain contractual obligations.


text: While we face a number of cybersecurity risks in connection with our business and from time to time we have had to address non-material security incidents and expect to experience security incidents in the future, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face that may materially affect the Company, see the risk factor entitled "Risks generally associated with information systems, software products and cybersecurity attacks could adversely affect our results of operations" in Item 1A - Risk Factors.


text: Our Chief Information Security Officer (CISO) is responsible for developing and implementing our cybersecurity risk management and information security program, including regularly reporting on cybersecurity matters to management and the Audit and Finance Committee. He has a Bachelor of Science degree in Information Technology from Saint Mary's University of Minnesota and over 25 years of experience covering a wide range of enterprise IT and Information Security programs for large, global corporations. He also has multiple industry certifications, including as a Certified Information Systems Security Professional (CISSP), and participates in various security leadership forums and committees. Our CISO has led our cybersecurity program since joining our company in 2018, and was recently promoted to CISO from Senior Director, Information Security.


text: Our CISO reports to our Chief Information Officer (CIO), who has held that role for 7 years and oversees our broader information technology program. He has over 30 years of information technology experience, including over 20 years in leadership roles.


text: Among other matters, our Board delegates to our Audit and Finance Committee the oversight of our programs, policies, and procedures related to cybersecurity, information asset security, and network security. Broad oversight is maintained by our full Board, which receives regular reports from the Audit and Finance Committee as well as management, as appropriate. The Audit and Finance Committee and the full Board actively participate in discussions with management and among themselves regarding cybersecurity risk. Our CIO and CISO present to the Audit and Finance Committee at least a bi-annual review of our strategies, policies and internal controls relating to information technology and cybersecurity (including network security, cloud security and physical security), with respect to corporate goals, industry trends and competitive advantages. To aid the Board with its cybersecurity oversight responsibilities, the Board also receives regular presentations on these topics. Our incident response plan is designed to escalate certain cybersecurity incidents, from our information security team and CISO, through our Chief Legal Officer and CIO, to our Audit and Finance Committee, depending on the impact of the incident.


text: Risk Management and Strategy Match Group maintains an enterprise-wide information security program designed to identify, protect against, detect, respond to, and manage reasonably foreseeable cybersecurity risks and threats. Our information security teams, led by our Senior Vice President, Security Engineering, are responsible for assessing and managing our exposure to information security risks, including by: • Implementing and enforcing physical, operational and technical security policies, procedures and controls; • Conducting, and engaging independent third-party experts to conduct, regular internal and external security assessments and audits, including assessments of the security posture of third-party vendors and partners; • Collaborating with our development teams to engineer and integrate security throughout the product development lifecycle; • Implementing scalable and continuous data protection practices; and • Detecting, monitoring, investigating, and responding to potential security threats and incidents.

companyName: Match Group, Inc.

ticker: MTCH


text: With a focus on both product and enterprise security, the security program has been set up to protect our information systems from cybersecurity threats as part of our development lifecycles and our ongoing business operations. We implement various technical and operational processes to help prevent, identify, escalate, investigate, resolve, and recover from vulnerabilities and security incidents in a timely manner. These include, but are not limited to, monitoring and detection tools, internal and third-party penetration testing, continuous testing by a dedicated red team, a comprehensive bug bounty program to allow security researchers to assist us in identifying vulnerabilities in our services before they are exploited, and annual and ongoing security awareness training for employees.


text: We have implemented cybersecurity controls to detect and address threats arising from our use of third-party service providers. Security risk assessments are conducted during onboarding, contract renewal, and when an increased risk profile is identified. We also require specified security controls and other responsibilities from our service providers and we investigate security incidents affecting them as deemed necessary.


text: Our policies, standards, processes and practices for assessing, identifying, and managing material risks from cybersecurity threats are integrated into our overall risk management program and are based on frameworks established by the International Organization for Standardization ("ISO") and other applicable industry standards. Our cybersecurity policies, standards, processes and practices are regularly assessed by consultants and external auditors. These assessments include a variety of activities, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. Cybersecurity processes are adjusted based on the information provided from these assessments. We have also obtained industry certifications and attestations that demonstrate our dedication to protecting the data our users entrust to us, including Tinder obtaining certification for its Information Security Management System (ISMS) under the ISO/IEC 27001:2022 standard.


text: We conduct regular reviews and tests of our information security program and leverage audits by our internal audit team and ongoing testing by our red team. We employ external services to conduct tabletop exercises, penetration and vulnerability testing, simulations, and other exercises to evaluate the effectiveness of our information security program and improve our security measures and planning across Match Group's businesses. The results of these assessments are reported to the Audit Committee of our Board of Directors.