text: We engage multiple independent third-party cybersecurity services and consulting firms to review our cybersecurity program and we collaborate with entities such as the Health Information Sharing and Analysis Center, the Cybersecurity & Infrastructure Security Agency, InfraGard, the Department of Homeland Security, the Cyber Fraud Task Forces and the Center for Internet Security to complement our program and bolster our data protection and privacy efforts. To monitor and minimize the risks from cybersecurity threats associated with our use of third-party service providers, we require the completion of standardized information gathering questionnaires from applicable service providers prior to entering any engagement for services focused on information technology or processing sensitive information. Further, we utilize security ratings from industry-recognized sources to provide an external analysis of such third-party service providers. We work closely with these industry-recognized sources to interpret the security ratings results in the context of the specific characteristics of our information technology and cybersecurity systems, which helps inform our assessment of the efficacy and reliability of the third-party vendors we use. We also conduct periodic internal reviews of the performance and reliability of the third-parties we have engaged for cybersecurity services.


text: Management and Board Oversight The Board has responsibility for the oversight of risk management at the Company, which includes our process for identifying, assessing and mitigating significant financial, operational, strategic, cybersecurity and other risks that may affect the Company. Our Chief Information Officer, or CIO, leads our cybersecurity program and our Director, Cybersecurity leads our cybersecurity team. Our CIO provides periodic (at least semi-annual) reports relating to cybersecurity matters to the Board, as well as our Chief Executive Officer and other members of our senior management, as appropriate. Our executive leadership team and Board provide principal oversight and guidance of our cybersecurity risk management programs and processes. We have established a cybersecurity executive steering committee to review and discuss cybersecurity issues and review our security metrics. The committee is comprised of a cross-functional group of senior executives, including our Chief Executive Officer, Chief Financial Officer, Chief Legal Officer, Chief Information Officer and Director, Cybersecurity, and is responsible for the implementation and oversight of the processes and systems we use to assess and manage risk from cybersecurity threats as well as cybersecurity incidents. Our CIO and committee members have significant work experience related to cybersecurity issues or oversight and members of our cybersecurity team hold vendor-neutral and vendor-specific certifications from organizations such as the Information Systems Audit and Control Association ("ISACA"), the Computing Technology Industry Association ("CTIA") and the International Information System Security Certification Consortium ("ISC2"). In addition, we require new employees to complete cybersecurity training so they are better able to understand how to identify, protect, and preserve sensitive data and minimize risks related to cybersecurity matters. We supplement this new hire training with annual training and certification programs, which includes social engineering simulations. We continue to expand and improve our global training programs to raise employee awareness of security obligations and members of senior management regularly provide employees with communications regarding the cybersecurity environment to increase employee awareness of cybersecurity trends and emerging risks.

companyName: INTEGRA LIFESCIENCES HOLDINGS CORP

ticker: IART

secItem: Item 1C


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our monitoring capabilities, including our internal auditing procedures, internal control over financial reporting and corporate compliance programs, are designed in part to inform management about our material risks, including those related to cybersecurity risks. In the event of an incident which jeopardizes the confidentiality, integrity, or availability of our information assets, and our risk management systems, we maintain a regularly tested incident response program. Pursuant to the incident response program and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery or data and access to systems, analyzing the reporting and disclosure obligations associated with the incident, and performing post-incident analysis and program improvements. Although the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the team is generally led by the CIO or another member of the cybersecurity executive steering committee and will include other information technology and legal personnel. For incidents that meet certain characteristics under the program, the incident response team will escalate and update both the Company's Board and members of senior management, including the Chief Executive Officer, Chief Financial Officer and Chief Legal Officer.


text: In addition, our Board receives regular reports from management on matters relating to strategic and operational initiatives, financial performance, cybersecurity and legal developments. The Company's Enterprise Risk Management program, which has been adopted by the Company to further enhance oversight of risks inherent to our business and allow members of the Board and management to gain a greater understanding of the efforts being undertaken to manage the risks confronting the Company, covers cybersecurity risks.


text: To support current needs and future growth, w e use a strategic information systems multi-year planning process that involves senior management and is integrated into our overall business planning. Information systems projects, including those for cybersecurity, are prioritized based upon strategic, financial, regulatory, risk and other business advantage criteria.


text: Cybersecurity Risks As of December 31, 2024, we have not experienced any material risks from cybersecurity threats, including from previous cybersecurity incidents, that have materially affected the business strategy, results of operations or financial condition of the Company or are reasonably likely to have such a material effect. However, we previously have and anticipate we will continue to face risks associated with cybersecurity incidents. Although we make efforts to maintain the security and integrity of our networks and systems, and the sensitive information that resides on or is transmitted through them, and we have implemented various cybersecurity policies and procedures to manage the risk of a security incident or disruption, there can be no assurance that our security efforts and measures will be effective or that attempted security incidents or disruptions would not be successful or damaging. We also carry insurance that provides protection against the potential losses arising from a cybersecurity incident, although the amount of coverage may not be sufficient or provide applicable coverage for a given incident. See "Risk Factors–Risks Related to Cybersecurity and Data Privacy—Cyber-attacks or other disruptions to our information technology systems could adversely affect our business" and "—Failure to comply with laws relating to the confidentiality of sensitive personal information or standards related to the transmission of electronic health data, may require us to make significant changes to our products, or incur penalties or other liabilities."


text: Cybersecurity Overview We rely on proprietary and third-party information systems to process, transmit and store information and to manage or support our business processes. We store and maintain confidential financial and business information regarding us and persons with whom we do business on our information technology systems. We also collect and hold personally identifiable information of our employees in connection with their employment. In addition, we engage third-party service providers that may collect and hold personally identifiable information of our employees in connection with providing business services to us, including web hosting, accounting, payroll and benefit services.

companyName: NN INC

ticker: NNBR


text: Cybersecurity Governance The protection of the information technology systems on which we rely is critically important to us. The Audit Committee of the Board of Directors has oversight for the reliability and security of our information systems, including identifying material risks and cybersecurity threats arising in our business. The Audit Committee receives updates from management of the ongoing cybersecurity initiatives and events at least once per quarter. In the event of a material cybersecurity incident, management will notify the Cybersecurity Sub-Committee of the Board of Directors, which will provide oversight for the Company's response and mitigation to the incident.


text: Our Chief Financial Officer is responsible for the management of the Company's information systems and oversees the Company's information technology team ("IT Team"). The IT Team has in place documented procedures for cybersecurity response plans, which are reviewed annually or as events warrant. The IT Team utilizes third party security experts to provide continuous external penetration testing, conduct security reviews, and to provide a managed security operations center that does 24/7 monitoring as well as provide additional resources for threat and incident response activities.


text: Cybersecurity Risk Management and Strategy We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts for any breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of any potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.


text: A cybersecurity incident could interrupt our operations, result in downtime, divert our planned efforts and resources from other projects, damage our reputation and brand, damage our competitive position, subject us to liability claims or regulatory penalties under laws protecting the privacy of personal information. Although impacts of past cybersecurity incidents have been immaterial to date, the impacts of such events in the future may materially and adversely affect our business, financial condition, or results of operations.


text: Cybersecurity Risk Management and Strategy We employ a multi-layered approach to protect our information systems from cybersecurity threats. We have around the clock security operations center coverage that uses an industry leading security information and event management tool to aggregate and analyze data and provide immediate alerts of potential breaches. All hardware within our information systems run an industry-standard anti-virus solution, and we have an established patching program in place to keep security updates current. Penetration testing is conducted by an outside party on a continual basis, resulting in rapid discovery and remediation of potential weaknesses. To ensure employee compliance with our processes, we require yearly cybersecurity training and conduct phish testing, including simulated phishing attempts, multiple times per month. Additional training is assigned to employees as deemed necessary to reduce the risk of cybersecurity threats. In case of a cybersecurity incident, we maintain a cybersecurity insurance policy to reduce any direct costs that could be incurred.


text: Risk Management and Strategy Our cybersecurity risk management program is intended to protect the confidentiality, integrity, and availability of our critical IT systems and information. Our program is integrated into, and cybersecurity risks are among the risks evaluated and considered by, our broader enterprise risk management program, which is designed to identify, assess, prioritize and mitigate risks across the organization to enhance our resilience and support the achievement of our strategic objectives.

companyName: SCANSOURCE, INC.

ticker: SCSC


text: Our cybersecurity risk management program is led by our Vice President of Information Security ("VP"), who manages our security team principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents, and cross-functional coordination, and planning for business continuity and disaster recovery. We rely on our information security management system supported by a set of policies based upon industry frameworks, including the NIST Cybersecurity Framework. We have a Cyber Incident Response Team ("CIRT") in place to respond to, and prepare appropriate responses to cybersecurity threats or incidents. Components of our program include: • risk assessments designed to help identify and assess cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • monthly, mandatory cybersecurity awareness training for our employees, covering such topics such as phishing tactics, ransomware and developments in the current landscape of cyber-threats; • assessments of [and improvements to], among others, disaster recovery testing, access control, remote access, personnel security, system and communications protection, media protection, change management, data backup and recovery, audit logging, vulnerability and patch management, physical security, configuration management;


text: Index to Financial Statements • periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with various aspects of our cybersecurity processes and controls; and • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team assisted by external consultants.


text: We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.


text: As part of our overall risk mitigation strategy, we maintain insurance coverage that is intended to address certain aspects of cybersecurity risks; however, such insurance may not be sufficient in type or amount to cover us against claims related to cybersecurity breaches, cyberattacks and other related breaches.


text: As of the date of this report, we do not believe that any risks from cybersecurity threats, including as a result of the May 2023 ransomware incident or any other previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations or financial condition. Despite our security measures, however, there can be no assurance that we, or third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information on our cybersecurity related risks, see Item IA, "Risk Factors - "Cybersecurity risk."


text: Our Board has primary responsibility for oversight of our cybersecurity and other information technology risks, including our plans to mitigate cybersecurity risks and to respond to data breaches.


text: The Board receives regular reports from our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our VP leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our VP is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our VP reports to our CIO who, in turn, reports directly to our CEO.


text: Our VP and our CIO, are both experienced cybersecurity executives. Our VP has more more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Our CIO has nearly 30 years of experience and has held a variety of senior information technology leadership roles at multiple Fortune 500 organizations. Members of our security team also hold industry-recognized cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: Our cybersecurity risk management program is led by our Vice President of Information Security, who manages our security team that is principally responsible for managing our cybersecurity risk assessment processes, our security controls, and our detection and response to cybersecurity incidents. Our program includes protocols for preventing, detecting and responding to cybersecurity incidents; cross-functional coordination; and planning for business continuity and disaster recovery. We rely on our information security management system supported by a set of policies based upon industry frameworks, including the NIST Cybersecurity Framework. We have a Cyber Incident Response Team ("CIRT") in place to respond to prepare appropriate responses and respond to cybersecurity threats or incidents. Components of our program include: • risk assessments designed to help identify and assess cybersecurity threats to our critical IT systems, information, and our broader enterprise IT environment; • monthly, mandatory cybersecurity awareness training for our employees, covering such topics such as phishing tactics, ransomware and developments in the current landscape of cyber-threats; • assessments of and improvements to, among others, disaster recovery testing, access control, remote access, personnel security, system and communications protection, media protection, change management, data backup and recovery, audit logging, vulnerability and patch management, physical security, configuration management; • periodic engagement of independent security firms and other third-party experts, where appropriate, to assess, test, and certify components of our cybersecurity program, and to otherwise assist with various aspects of our cybersecurity processes and controls; and • regular assessments of the design and operational effectiveness of the program's key processes and controls by our internal audit team with the assistance of external consultants.


text: Index to Financial Statements We also have a cybersecurity incident response plan for the CIRT to assess and manage cybersecurity incidents, which includes escalation procedures based on the nature and severity of the incident including, where appropriate, escalation to the Board.


text: The Board receives regular reports from our Chief Information Officer ("CIO") on cybersecurity matters. These reports include a range of topics, including our cybersecurity risk profile, the current cybersecurity and emerging threat landscape, the status of ongoing cybersecurity initiatives, incident reports, and the results of internal and external assessments of our information systems. The Audit Committee of the Board also annually reviews the adequacy and effectiveness of our information and technology security policies and the internal controls regarding information and technology security and cybersecurity, and periodically receives updates from our internal audit function on the results of our cybersecurity audits and related mitigation activities. The Chair of the Audit Committee reports to the full Board on these discussions as appropriate. In addition, Board members periodically receive presentations on cybersecurity matters from external experts as part of the Board's continuing education and overall risk oversight.


text: At the management level, our VP of Information Security leads our enterprise-wide cybersecurity program, and is responsible for assessing and managing our materials risks from cybersecurity threats. In performing his role, our VP is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through the management of, and participation in, the cybersecurity risk management program and other processes described above, including the maintenance and execution of our cyber incident response plan. Our VP reports to our CIO who, in turn, reports directly to our CEO.


text: Our CIO and our VP of Information Security are both experienced cybersecurity executives. Our CIO has nearly 30 years of experience and has held a variety of senior information technology leadership roles at multiple Fortune 500 organizations. Our VP has more more than 20 years of experience building and leading cybersecurity, risk management, and information technology teams. Members of our security team also hold industry-recognized cybersecurity certifications, including the Certified Information Systems Security Professional (CISSP) certification.


text: Risk Management and Strategy HTLF Bank's Risk Management program is designed to identify, assess, monitor and mitigate risks based on various key risk factors we face including, but not limited to financial, operational, regulatory and legal. Cybersecurity is a critical component of our risk management framework given internal dependencies on technology, the evolving digital environment and the rapid acceleration of cyber-threats. HTLF's cybersecurity risk management program is built on three lines of defense Risk Management framework. HTLF's first line of defense provides frontline business, operational and technical controls and support to securely deliver access to HTLF applications and data to HTLF users. As part of the Risk Management function, HTLF's second line of defense is primarily responsible for infrastructure defense and security controls, performing vulnerability assessments, identity access management, business continuity, third-party information security assessments, employee awareness and training programs, and security incident management. Internal Audit functions as HTLF's third line of defense and independently provides assurance, via multiple audit and testing engagements to validate the effectiveness of HTLF's cybersecurity risk management practices, while measuring against regulatory requirements and HTLF's Policies and Standards.

companyName: HEARTLAND FINANCIAL USA INC


text: HTLF's first line of defense is led by our Chief Operations Officer and our Chief Information Officer. HTLF's second line of defense is led by our Chief Risk Officer ("CRO") and includes the Security function, led by our Chief Information Security Officer ("CISO") who is primarily responsible for the cybersecurity component. The primary responsibilities of the HTLF Security function are to protect HTLF assets including networks, systems, application, data, funds, and staff, and facilitate incident response and resolution. HTLF's third line of defense is led by our Chief Audit Executive.


text: Our primary objectives for managing cybersecurity risk are to avoid or minimize the impacts of external threat events or other efforts to penetrate, disrupt, exploit or misuse our information or systems. The structure of our information security program is designed around the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, regulatory guidance, and other industry standards. The NIST cybersecurity framework is a nationally recognized industry standard for mitigating organizational cybersecurity risks, which includes identifying risks, protecting assets, detecting threats, responding to incidents, and recovery from incidents. The NIST cybersecurity framework uses standards, procedures and best practices, and is integrated into the HTLF Security team's overall risk management system and processes, including oversight of third-party service providers. Management of the HTLF's third parties, including vendors and service providers, is conducted through a risk-based approach and the level of due diligence is driven from risk factors established by Enterprise Risk Management through its Third Party Risk Management Program. The process provides awareness and collaboration across all internal teams including Information Security and Business Continuity. A technical requirements review process is conducted on new or significantly changed third parties, applications, or technology to ensure that systems or third parties meet certain security baseline requirements. Further, HTLF's Security program also provides for annual mandatory training for employees regarding security awareness and understanding of how to properly use and protect the company assets, including computing resources entrusted to them, and to communicate the company's information security policies, standards, processes and practices.


text: To address evolving cybersecurity risks and corresponding regulations, the HTLF Security team uses Federal Financial Institutions Examination Council ("FFIEC") booklets and Cybersecurity and Infrastructure Agency ("CISA") guidance; identifies and defines emerging risks using third-party research and subject matter expert consultants; executes strategic cyber threat assessments; performs new product and initiative reviews; performs data management risk oversight; and conducts cyber risk reviews as part of HTLF's Third Party Risk Management process, which oversees and identifies risks, including cybersecurity threats, associated with our use of third-party service providers. The HTLF Security team conducts periodic tabletop exercises to test HTLF business units' capabilities to respond to various security incidents, including cyber-attacks.


text: Our CISO is accountable for managing our enterprise information security department and delivering our information security program. The responsibilities of this department include cybersecurity governance (policies and procedures), risk assessment, defense operations, incident response, vulnerability monitoring, threat intelligence, identity access governance, information security/cyber related third-party risk management, and business continuity. Moreover, the Security function is responsible for assessing, managing and remediating material risks from cybersecurity threats. The Security management team has the technical, management and project leadership experience in mid-sized or larger banks, maintains appropriate technical certifications, and stay abreast of industry, technical and regulatory best practices and requirements.


text: If a cybersecurity event occurs, the CISO leads the HTLF Incident Response Team as part of our Incident Response Plan designed to help reduce the risks related to security incidents by providing guidelines on responding to incidents by focusing on a roadmap for coordinating personnel, policies, and procedures to ensure incidents are detected, analyzed, and handled to mitigate material risks. The CISO and CRO work with key cross functional stakeholders, including members of executive leadership and provide updates to the HTLF Risk Committee on the status and impact of the cybersecurity event, as well as review the event with the Risk Committee following its ultimate resolution in order to share root cause and lessons learned from the incident.


text: HTLF has implemented a robust corporate governance framework comprised of the HTLF Board of Directors and its committees; which in turn delegate authority to management for implementation of the risk management program including cybersecurity as an integral component. The corporate governance framework is designed to provide transparency through routine reporting as provided by the CISO to facilitate effective oversight of cybersecurity risk by the Board and executive management. The management committee layer of the corporate governance framework is supported by an Operational Risk Committee which serves as a key forum for the CISO to report quarterly updates on HTLF's cybersecurity risk profile, key metrics and risk indicators used to monitor the operating environment, emerging risks and threats as well as any cybersecurity incidents or events. In addition, the CISO has a routine reporting cadence with the Executive Risk Management Committee and the HTLF Risk Committee on the status of the cyber security management program, including trending of key risk metrics, results of risk assessments, audits and regulatory examinations.


text: HTLF has not been materially affected by any cyber security incidents to date, nor are we aware of any cyber security incident which we believe would have a material impact on us in the future. Nevertheless, like all financial institutions, we are subject to the risk that cybersecurity threats will continue to evolve and may materially impact us in the future. These factors are further detailed in the "Risk Factors" section included under Item 1A of Part I of this Annual Report on Form 10-K, including under the caption "Security breaches, cyber-attacks or other similar incidents with respect to our or our vendors' systems or network security, as well as the resulting theft or compromise of business and customer information, including personal information, could adversely affect our business or reputation, and create significant legal, regulatory or financial exposure."


text: Risk Management and Strategy Protecting the information maintained by the Company about its patients, customers, colleagues, and partners against external and internal threats is a priority for the Company. Accordingly, the Company invests in the development and implementation of cybersecurity policies, control standards, and control procedures, including a risk management and assessment program, security and event monitoring capabilities, an incident response plan, and other detection, prevention, and protection capabilities, including practices and tools to monitor and mitigate external and insider threats. The Company engages in a risk monitoring process through its Office of Information Security (OIS) within the Information Technology organization that seeks to identify the likelihood and impact of threats to its systems and data, and assesses the effectiveness of the controls in place.

companyName: LABCORP HOLDINGS INC.

ticker: LH


text: Consistent with business requirements, components of the Company's information technology and controls are assessed by independent third parties against various frameworks and standards. With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, and assesses those systems pursuant to the Company's cybersecurity policies, control standards, and control procedures. Mitigation of identified threats and vulnerabilities may be delayed.


text: The Company has implemented an Incident Response Plan (IR Plan), which is aligned to its overall crisis management program. The IR Plan provides a framework for responding to and managing cybersecurity incidents. The IR Plan identifies applicable requirements for incident response, outlines processes for any applicable reporting, as well as provides protocols for incident evaluation, processes for notification and internal escalation of information to the Company's senior management, and the Board and/or appropriate Board committees, as applicable. The IR Plan is reviewed, tested, and updated under the leadership of the Company's Chief Information and Technology Officer (CITO) and Chief Information Risk Officer (CIRO).


text: The Company's cybersecurity team also provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company's mitigation against human-driven risk.


text: Engagement with External Cybersecurity Professionals The Company engages with third parties to assess the effectiveness of, and assist with, its cybersecurity risk and response systems and processes. These third parties include cybersecurity assessors, consultants, and other cybersecurity professionals who assist in the identification, verification, and validation of cybersecurity risks, as well as support associated mitigation or incident response plans when necessary.


text: Oversight of Third-Party Service Providers The Company's processes also are designed to evaluate the cybersecurity threat risks associated with its use of third-party service providers that have applicable levels of access to the Company's data or information technology systems. The Company performs due diligence on third parties that have access to its systems, data, or facilities that house such systems or data, and it monitors cybersecurity threat risks identified through such due diligence.


text: Cybersecurity Incident Impact The Company describes whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect it, including its business and operating results, financial condition, and impact on the Company's reputation and customer relationships, under the Summary of Material Risks section of this Annual Report, and under the "Risks Related to Technology and Cybersecurity" heading and subheadings thereunder in Part I, Item 1A. "Risk Factors" of this Annual Report, which disclosures are incorporated by reference herein.


text: In July 2018, the Company experienced a ransomware incident which affected certain Dx information technology systems. The incident also temporarily affected certain other information technology systems involved in conducting Company-wide operations. An investigation determined that the ransomware did not and could not transfer patient or client data outside of Company systems and that there was no theft or misuse of patient or client data. This incident did not have a material effect on the Company.


text: On May 14, 2019, Retrieval-Masters Credit Bureau, Inc. d/b/a/ American Medical Collections Agency (AMCA), an external collection agency, notified the Company about a security incident AMCA experienced that may have involved certain personal information about some of the Company's patients (the AMCA Incident). The Company is involved in pending and threatened litigation related to the AMCA Incident, as well as various government and regulatory inquiries and processes. For additional information about the AMCA Incident, see Note 15 Commitments and Contingencies to the Consolidated Financial Statements "Cybersecurity" and "Risk Factors - Risks Related to Technology and Cybersecurity".


text: The Company's board of directors has oversight responsibility for the Company's enterprise risk management process and it delegates oversight responsibility for certain significant functional areas of risk management to the board's committees. The Audit Committee of the board of directors is responsible for oversight and review of the Company's cybersecurity and other information technology risks, controls, and procedures, including the potential impact of such risks on the Company's business, financial results, operations, and reputation, as well as the Company's plans to mitigate cybersecurity risks and to respond to cybersecurity incidents.


text: The CIRO and CITO routinely present cybersecurity reports to the Audit Committee at its regularly scheduled meetings. These reports may address cyber risks and threats, the status of projects to strengthen the Company's information security systems, assessments of the Company's security program, prior incidents, and the emerging cyber threat landscape. In addition, the full Board receives briefings from the CIRO and CITO on at least an annual basis.


text: Management is responsible for day-to-day assessment and oversight of cybersecurity risks. At the senior management level, the CITO is responsible for overseeing the Company's information technology systems, technology capabilities, and cybersecurity practices. The CITO has more than 30 years of experience working in information technology-related roles and is a member of the Company's executive leadership team and reports to the Chief Executive Officer. Prior to joining the Company, the CITO held various chief information officer roles with global companies.


text: The CIRO, under the direction of the CITO, is responsible for overseeing the OIS. In this role, the CIRO oversees the cyber risk management function, which identifies cybersecurity threats, assesses cybersecurity risks, and supports the CITO and the Company in managing such risks. The CIRO has over 30 years of experience in information security, and prior to joining the Company held various chief information security officer roles, including seven years at a global healthcare company. The CIRO has also served on the board of directors of Health-ISAC, an organization of critical infrastructure owners and operators within the health and public health sectors.


text: The CITO and CIRO together lead efforts to design, implement and operate controls deemed appropriate for the management of Company information assets and systems. OIS manages the policies, control procedures, and control standards designed to identify, detect, protect against, respond to, and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for the information technology security monitoring and incident response activities, the latter covering the response coordination to cybersecurity incidents under the leadership and pursuant to the direction of the CIRO. OIS also oversees the Company's cybersecurity training program for employees.


text: The Company has implemented a formal cybersecurity program aligned to the Secure Controls Framework (SCF), a cybersecurity and privacy framework that consolidates and maps controls across multiple regulations, standards, and best practices. The Company's program includes the evaluation of the cybersecurity posture of third-party suppliers and vendors that have access to the Company's data or information technology systems. Consistent with business requirements, components of the Company's information technology and controls are assessed by independent third parties against various frameworks and standards. With the assistance of these frameworks and standards, the Company assesses risks from cybersecurity threats, monitors its information systems for potential vulnerabilities, assesses those systems pursuant to the Company's cybersecurity policies, control standards, and control procedures, and implements appropriate mitigation measures. Mitigation of identified threats and vulnerabilities may be delayed.


text: The Company has implemented an Incident Response Plan (IR Plan), which is aligned to its overall crisis management program. The IR Plan provides a framework for responding to and managing cybersecurity incidents. The IR Plan outlines incident response requirements, reporting processes, protocols for incident evaluation, and procedures for notifying and escalating information to the Company's senior management, and the Board and/or appropriate Board committees, as applicable. The IR Plan is reviewed, tested, and updated under the leadership of the Company's Chief Information and Technology Officer (CITO) and Chief Information Risk Officer (CIRO).


text: The Company's cybersecurity team also provides enterprise-wide cybersecurity training for employees to maintain and continuously improve the Company's mitigation against human-driven risk. Cybersecurity training is conducted annually, in addition to periodic simulations and exercises to test the efficacy of this training, and expanded training is required for specific roles.


text: Engagement with External Cybersecurity Professionals The Company engages with third parties to assess the effectiveness of, and assist with, its cybersecurity risk and response systems and processes. These third parties include cybersecurity assessors, consultants, and professionals who help identify, verify, and validate cybersecurity risks and support mitigation or incident response plans as needed.


text: Cybersecurity Incident Impact The Company describes whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect it, including its business and operating results, financial condition, and impact on the Company's reputation and customer relationships under the "Risks Related to Technology and Cybersecurity" heading and subheadings thereunder in Part I, Item 1A. "Risk Factors" of this Annual Report, which disclosures are incorporated by reference herein.


text: Management is responsible for day-to-day assessment and oversight of cybersecurity risks. At the senior management level, the CITO is responsible for overseeing the Company's information technology systems, technology capabilities, and cybersecurity practices. The CITO has more than 15 years of experience working in information technology-related roles and is a member of the Company's executive leadership team and reports to the Chief Executive Officer. Prior to joining the Company, the CITO held various leadership positions with global companies.


text: The CIRO, under the direction of the CITO, is responsible for overseeing the OIS. In this role, the CIRO oversees the cyber risk management function, which identifies cybersecurity threats, assesses cybersecurity risks, and supports the CITO and the Company in managing such risks. The CIRO has over 30 years of experience in information security, and prior to joining the Company held various chief information security officer roles, including seven years at a global healthcare company. The CIRO has also served on the board of directors of Health-ISAC, an organization of critical infrastructure owners and operators within the health and public health sectors. The CITO and CIRO together lead efforts to design, implement and operate controls deemed appropriate for the management of Company information assets and systems. OIS manages the policies, control procedures, and control standards designed to identify, detect, protect against, respond to, and recover from cybersecurity threats and cybersecurity incidents. This group includes a cybersecurity operations team that is responsible for the information technology security monitoring and incident response activities, the latter covering the response coordination to cybersecurity incidents under the leadership and pursuant to the direction of the CIRO. OIS also oversees the Company's cybersecurity training program for employees.


text: Risk Management and Strategy Our cybersecurity risk management efforts are an integral part of our overall risk management processes, and we are deeply committed to safeguarding our digital and information technology environment for our employees, customers and vendors. We employ a robust, global and multi-layered security strategy, known as "defense-in-depth," to assess, identify and manage cybersecurity risks and protect our cyber work environment from potential threats and vulnerabilities. These risks, threats and vulnerabilities include those that could result in significant operational disruption to the Company, such as production disruption, business downtime or loss of containment, as well as risks that could have significant reputational or compliance/regulatory impact.

companyName: Simpson Manufacturing Co., Inc.

ticker: SSD


text: The Simpson Information Security Team monitors information security risks that target both technology and manufacturing environments and identifies potential risks to Simpson's information security posture. Any identified risks are prioritized in terms of impact to Simpson's information security posture and, if critical, addressed immediately or added to Simpson's information security roadmap. To supplement our internal cybersecurity resources, we also engage external third parties to perform information security assessments, penetration tests and related services to enhance our information security program.


text: Risks Associated with Third-Party Service Providers In addition, we implement robust processes to oversee and manage risks associated with our business arrangements with third-party service providers. All new Simpson third-party business agreements are reviewed and assessed by our Information Security Team. We also perform information security program investigations on the security posture of, and assess any publicly known information security events related to, these third-party service providers. If a third party service provider with a business agreement with Simpson experiences an information security breach or incident, our Information Security Team reviews and assesses such event to understand Simpson's overall exposure to the security incident.


text: We maintain cybersecurity insurance coverage at industry standard levels as a part of our comprehensive insurance portfolio to help mitigate risk in the event an information security event occurs.


text: Risks from Cybersecurity Threats Despite our security measures, our information technology and infrastructure may remain vulnerable to disruptions, including as a result of attacks by increasingly sophisticated intruders or others who attempt to cause harm to, or otherwise interfere with the normal use of our systems. We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to our information systems and computer networks, and we could in the future experience similar attacks. On October 11, 2023, we announced that we had experienced disruptions in our Information Technology (IT) infrastructure and applications resulting from a cybersecurity incident. We identified unauthorized activity in our IT systems and took immediate steps to stop, remediate and investigate such activity. We also notified relevant law enforcement. The incident, which caused disruption of our business operations for approximately three days, has been resolved due to steps we took to address the incident. As a result of our ability to restore our operations within three days, we were able to fulfill our backlog of orders caused by the operational disruption within one week, and therefore, we experienced no material financial impact to our business.


text: We do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incident, have materially affected or are reasonably likely to materially affect the Company or our business strategy, results of operations, or financial condition. For additional information regarding the risks from cybersecurity threats we face, see the section captioned "Risks Relating to Our Intellectual Property and Information Technology" under Part I, Item 1A "Risk Factors" above.


text: Board and Committee Oversight Although our full Board of Directors is ultimately responsible for risk oversight, our Board is assisted in discharging its risk oversight responsibility by its committees. The Audit and Finance Committee of the Board is responsible for providing oversight of our information security program and cybersecurity risks. In connection with this oversight role, the Audit and Finance Committee receives information technology updates from management at least quarterly. Cybersecurity risks facing the Company and updates on the Company's practices and progress to mitigate such risks are also the subject of management reports to the Audit and Finance Committee on a more frequent basis, as necessary or appropriate.


text: Management's Role in Assessing and Managing Risk The Company's information security efforts are led by our Senior Vice President, Information Technology ("SVP, IT") and our Director of Information Security ("IT Director"), supported by our executive management team. These efforts are designed to address information security governance and risk, product security, identification and protection of critical assets, third-party risk, security awareness, cyber defense operations and related risk management matters. Our SVP, IT and IT Director have an average of over 35 years of prior work experience in various roles involving information technology, including security, auditing compliance, systems and programming. These individuals have relevant educational and industry experience, including holding similar positions at other large companies.


text: Our SVP, IT provides relevant cybersecurity and information technology reports to the Audit and Finance Committee, and to the executive leadership team. These reports are provided at quarterly Audit and Finance Committee meetings and at our quarterly Information Technology Steering Committee ("IT Steering Committee") meetings. These reports typically include analyses of recent significant cybersecurity threats and incidents at the Company and across the industry, as well as a review of our security controls, assessments and program maturity, risk mitigation status, and a review of our third-party service providers as appropriate. Simpson's information security roadmap and posture are also reviewed quarterly with members of the executive leadership team and the Audit and Finance Committee. In accordance with our information security program, any information security event is assessed and reviewed by our IT Steering Committee.


text: The IT Steering Committee is responsible for assessing and reviewing our information security program and the Company's material risks from cybersecurity threats. Additional supervision and management is provided by our IT Leadership team, comprised of our SVP, IT; VP, IT Infrastructure and Operations; VP, IT Enterprise Applications; and International IT Director.


text: The Company's Information Security team monitors information security risks that target both technology and manufacturing environments and identifies potential risks to Simpson's information security posture. Any identified risks are prioritized in terms of impact to Simpson's information security posture and, if critical, addressed immediately or added to Simpson's information security roadmap. To supplement our internal cybersecurity resources, we also engage external third parties to perform information security assessments, penetration tests and related services to enhance our information security program.


text: Risks Associated with Third-Party Service Providers In addition, we implement robust processes to oversee and manage risks associated with our business arrangements with third-party service providers. All new Simpson third-party business agreements are reviewed and assessed by our Information Security team. We also perform information security program investigations on the security posture of, and assess any publicly known information security events related to, these third-party service providers. If a third party service provider with a business agreement with Simpson experiences an information security breach or incident, our Information Security Team reviews and assesses such event to understand Simpson's overall exposure to the security incident.


text: Risks from Cybersecurity Threats Despite our security measures, our information technology and infrastructure may remain vulnerable to disruptions, including as a result of attacks by increasingly sophisticated intruders or others who attempt to cause harm to, or otherwise interfere with the normal use of our systems. We have experienced targeted and non-targeted cybersecurity attacks and incidents in the past that have resulted in unauthorized persons gaining access to our information systems and computer networks, and we could in the future experience similar attacks. When we do experience cybersecurity incidents like these and the one we disclosed in October 2023, we aim to utilize that experience to inform and strengthen our cybersecurity management efforts. In response to the October 2023 incident, we increased our phishing awareness training and testing, deployed a cybersecurity tool that continuously monitors and verifies the security posture of individual devices within our network, and deployed technology that provides visibility into our sensitive data across different cloud environments, allowing the identification of potential vulnerabilities and take proactive measures to protect data from unauthorized access, misuse, or theft.


text: Management's Role in Assessing and Managing Risk The Company's information security efforts are led by our Executive Vice President, Chief Technology Officer ("CTO") and our Director of Information Security ("IT Director"), supported by our executive management team. These efforts are designed to address information security governance and risk, product security, identification and protection of critical assets, third-party risk, security awareness, cyber defense operations, artificial intelligence and data protection governance, and related risk management matters. Our CTO and IT Director have an average of over 25 years of prior work experience in various roles involving information technology, including security, auditing compliance, systems and programming. These individuals have relevant educational and industry experience, including holding similar positions at other large companies.


text: Our CTO provides relevant cybersecurity and information technology reports to the Audit and Finance Committee, and to the executive and senior leadership teams. These reports are provided at quarterly Audit and Finance Committee meetings and at our Digital Quarterly Business Review ("Digital QBR") meetings. These reports typically include analyses of recent significant cybersecurity threats and incidents at the Company and across the industry, as well as a review of our security controls, assessments and program maturity, top risks, risk mitigation status, and a review of our third-party service providers as appropriate. Simpson's information security roadmap and posture are also reviewed quarterly with members of the executive leadership team and the Audit and Finance Committee. In accordance with our information security program, any information security event is assessed and reviewed by our Digital Leadership team and members of the executive leadership team.


text: Through the Digital QBR process, the executive leadership team is responsible for assessing and reviewing our information security program and the Company's material risks from cybersecurity threats. Additional supervision and management is provided by our Digital Leadership team, comprised of our CTO; VP, Digital Infrastructure and Operations; VP, Digital Enterprise Applications; and International IT Director.


text: Risk Management and Governance Cybersecurity is a material part of Unity Bank's business. As a technology forward financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation. To date, the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition. See "Item 1A- Risk Factors – The Company cannot predict how changes in technology will impact its business"; as increased use of technology may expose us to service interruptions or breaches in security.

companyName: UNITY BANCORP INC /NJ/

ticker: UNTY


text: Cybersecurity risk is initially overseen by the management Information Technology Steering Committee (the "ITSC"). The members of this committee include the Company's Chief Technology Officer, Chief Compliance Officer (who is also the Information Security Officer), Chief Executive Officer, Chief Financial officer and other critical executive management members. The ITSC also includes a non-voting member that is an outsourced cybersecurity expert. The ITSC includes multiple members, including the Chief Technology Officer and an outsourced consultant, who serves as the Company's Virtual Information Security Officer.


text: Over his 16-year career, the Company's Chief Technology Officer has served in multiple Information Technology and Cybersecurity roles, such as Senior Engineer, responsible for implementing hardened infrastructure for both physical and cloud applications; Solutions Architect, designing infrastructures for highly regulated industries including Financial Services, Local/State Government and Healthcare; Director of Service Delivery, overseeing engineering, solutions architecture and maintains the System and Organization Controls (SOC) program prior to joining Unity Bank. During his tenure at Unity Bank, he is a member of various Risk and Cybersecurity Committees of the New Jersey Bankers Association, is a member of FS-ISAC, The Independent Community Bankers of America and our primary banking vendors advisory and risk management committees. The Company's Chief Compliance Officer was appointed as the Company's Information Security Officer in 2016.


text: The Virtual Information Security Officer (vISO) has an over 18-year career in Information Technology, Cybersecurity and both Internal/External Audit experience. He presently holds a position of Partner of Herbein, COA Advisor & Audit, where he's held multiple positions within Information Technology and Cybersecurity.


text: The Company's Information Technology Manager has an over 25-year career in Information Technology, during which the prior 13-years have been in Information Technology, Security and Cybersecurity, working primarily in regulated industries.


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, the ITSC and Chief Technology Officer provide reports and updates to the Board of Directors, or a Committee thereof on a quarterly basis.


text: The Company's cybersecurity risk mitigation program involves a combination of internal resources and the use of third parties. The Company's internal IT team performs monthly vulnerability scanning and performs an annual risk assessment based on the National Institute of Standards and Technology Cybersecurity Framework. The results are reported to the ITSC. The Company's IT and compliance staff also review potential cybersecurity threats associated with the Company's third party vendors, including performing a review of and obtaining a System of Organization Controls report from all vendors rated as "high risk" by the Company's internal vendor management program. The Company also has an internal Incident Response Plan and Team, which is charged with overseeing the Company's response to any cybersecurity incident. The team performs a table top exercise at least annually to prepare to respond in the event of any actual cybersecurity incident. In addition to these internal resources, the Company uses a third party vendor to complete annual penetration and vulnerability testing, with the results reported to the ITSC. Finally, the Company's cybersecurity compliance program is audited by the Bank's outsourced internal auditor.


text: The Company also maintains insurance which may provide coverage for expenses and certain losses incurred in connection with a cybersecurity incident.


text: Risk Management and Governance Cybersecurity is a material part of Unity Bank's business. As a technology forward financial institution offering products through multiple digital delivery channels, cybersecurity incidents could have a material effect on the Company, its results of operations and its reputation. To date, the Company has not experienced any cybersecurity incident which has had a material effect on the Company's business strategy, results of operations or financial condition, although increased use of technology will expose us to greater risk of breaches in security and or service disruptions.


text: Cybersecurity risk is initially overseen by the management Information Technology Steering Committee (the "ITSC"). The members of this committee include the Company's Chief Information Officer, Chief Compliance Officer (who is also the Information Security Officer), Chief Executive Officer, Chief Financial officer and other critical executive management members. The ITSC also includes a non-voting member that is an outsourced cybersecurity expert.


text: Over his 17-year career, the Company's Chief Information Officer has served in multiple Information Technology and Cybersecurity roles, such as Senior Engineer, responsible for implementing hardened infrastructure for both physical and cloud applications; Solutions Architect, designing infrastructures for highly regulated industries including Financial Services, Local/State Government and Healthcare; Director of Service Delivery, overseeing engineering, solutions architecture and maintaining the System and Organization Controls (SOC) program prior to joining Unity Bank. During his tenure at Unity Bank, he is a member of various Risk and Cybersecurity Committees of the New Jersey Bankers Association, is a member of FS-ISAC, The Independent Community Bankers of America and our primary banking vendors advisory and risk management committees. The Company's Chief Compliance Officer was appointed as the Company's Information Security Officer in 2016.


text: The Virtual Information Security Officer (vISO), an outsourced consultant, has an over 19-year career in Information Technology, Cybersecurity and both Internal/External Audit experience. He presently holds a position of Partner of Herbein, COA Advisor & Audit, where he's held multiple positions within Information Technology and Cybersecurity.


text: The Company's Information Technology Manager has an over 26-year career in Information Technology, the prior 13-years of which have been in Information Technology, Security and Cybersecurity, working primarily in regulated industries.


text: In order to ensure that cybersecurity risk management is integrated into the Company's overall risk management plans, systems and processes, the ITSC and Chief Information Officer provide reports and updates to the Board of Directors, or a Committee thereof on a quarterly basis.


text: Cybersecurity Incident Response Planning The Company has established a comprehensive cybersecurity incident response plan to ensure the swift and effective handling of any potential security breaches. This plan includes detailed procedures for identifying, assessing, and mitigating cybersecurity threats, as well as protocols for communication and coordination with relevant stakeholders. Regular training and simulations are conducted to keep the Company's response team prepared for various scenarios, ensuring minimal disruption to its operations and safeguarding the Company's customers' data.


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of its critical systems and information. The Company's cybersecurity risk management program employs several different measures, including perimeter monitoring, endpoint monitoring and user management, designed to assess and identify cybersecurity risks. The Company's technology management team is principally responsible for managing the Company's cybersecurity risk assessment and management processes. The Company's technology management team performs enterprise-level risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. The Company's technology management team and third-party professionals perform penetration tests, vulnerability scans, and patch management to assess and protect the confidentiality, integrity and availability of its critical systems and information. The Company provides training to its employees on cybersecurity matters, performs periodic awareness testing to facilitate compliance with the Company's cybersecurity policies, and maintains a method for its employees and consultants to communicate any suspected cybersecurity incident. In addition, the Company evaluates key third-party service providers before the Company grants the service provider access to its information systems and has a process in place to ensure that future access is appropriate.

companyName: ESSEX PORTFOLIO LP


text: The Company has an established incident response plan for responding to cybersecurity incidents. The goal of the incident response plan is to detect and react to cybersecurity incidents, evaluate the scope and risk, respond appropriately, communicate effectively to all stakeholders, and ultimately reduce the likelihood of an incident recurrence. The Company's incident response team consists of seasoned information technology, legal and financial reporting Company personnel. The incident response plan, members of the incident response team and the steps to respond to a security incident are evaluated for appropriateness and effectiveness, and key personnel from cross-functional departments are involved.


text: The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of enterprise level risks, including any cybersecurity-related risks faced by the Company. At least quarterly, the Audit Committee reviews cyber risks and mitigation strategies with senior management. The Audit Committee reports to the full Board regarding its activities, including those relating to cybersecurity. Additionally, on an annual basis, the Chief Technology Officer ("CTO") presents to the Audit Committee on any material updates to the cybersecurity program, such as process improvements, new initiatives and key vendor performance. Material cybersecurity events, if any, are escalated to the Board on an ongoing basis. The Board is also briefed annually on all major enterprise risks, including cybersecurity risks.


text: The Company's management team, including the CTO, is responsible for assessing and managing the Company's material risks from cybersecurity threats. The CTO leads the technology management team and has extensive cybersecurity knowledge and expertise developed through a career of serving in various roles in information technology for over 20 years. The CTO oversees the Company's initiatives to address existing or evolving cyber risks and is a member of the Enterprise Risk Committee. The CTO reports to the Chief Executive Officer ("CEO") and provides updates to the Company's senior leadership team on a regular basis, at least quarterly, about risks from cybersecurity threats, the results of penetration tests, vulnerability scans and userbase issues.


text: Over the past fiscal year, the Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations or financial condition. See "Risk Factors – We are subject to laws and regulations relating to the handling of personal information and we rely on information technology to sustain our operations. Any failure by us to comply with applicable requirements or material failure, inadequacy, interruption or breach of the Company's privacy or information systems, or those of our vendors or other third parties, could materially adversely affect the Company's business, results of operations and financial condition".


text: The Company has developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of its critical systems and information. The Company's cybersecurity risk management program is integrated into our overall risk management program, and shares common methodologies, reporting channels and governance processes that apply across the risk management program to other legal, compliance, strategic, operational and financial risk areas.


text: The Company's cybersecurity risk management program employs several different measures, including perimeter monitoring, endpoint monitoring and user management, designed to assess and identify cybersecurity risks. The Company's technology management team is principally responsible for managing the Company's cybersecurity risk assessment and management processes. The Company's technology management team performs enterprise-level risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment. The Company's technology management team and third-party professionals perform penetration tests, vulnerability scans, and patch management to assess and protect the confidentiality, integrity and availability of its critical systems and information. The Company provides training to its employees on cybersecurity matters, performs periodic awareness testing to facilitate compliance with the Company's cybersecurity policies, and maintains a method for its employees and consultants to communicate any suspected cybersecurity incident. In addition, the Company evaluates key third-party service providers before the Company grants the service provider access to its information systems and has a process in place to ensure that future access is appropriate.


text: The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of enterprise level risks, including any cybersecurity-related risks faced by the Company. At least quarterly, the Audit Committee reviews cyber risks and mitigation strategies with senior management. The Audit Committee periodically reports to the full Board regarding its activities, including those relating to cybersecurity. Additionally, on an annual basis, the Chief Technology Officer ("CTO") presents to the Audit Committee on any material updates to the cybersecurity program, such as process improvements, new initiatives and key vendor performance. Material cybersecurity events, if any, are escalated to the Board on an ongoing basis. The Board is also briefed annually on all major enterprise risks, including cybersecurity risks.


text: The Company's management team, including the CTO, is responsible for assessing and managing the Company's material risks from cybersecurity threats. The CTO leads the technology management team and has extensive cybersecurity knowledge and expertise developed through a career of serving in various roles in information technology for over 20 years. The CTO oversees the Company's initiatives to address existing or evolving cyber risks and is a member of the Enterprise Risk Committee. The CTO reports to the Chief Executive Officer ("CEO") and provides updates to the Company's senior leadership team on a regular basis, at least quarterly, about risks from cybersecurity threats, the results of penetration tests, vulnerability scans and userbase issues. The CTO and other members of the Company's management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate and remediate cybersecurity risks and incidents through various means, such as briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged; and alerts and reports produced by security tools deployed in our IT environment.


text: Over the past fiscal year, the Company has not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its operations, business strategy, results of operations or financial condition. See the discussion under the caption, "Risks Related to Our Real Estate Investments and Operations - We are subject to laws and regulations relating to the handling of personal information and we rely on information technology to sustain our operations. Any material failure, inadequacy, interruption or breach of the Company's privacy or information systems, or those of our vendors or other third parties, could materially adversely affect the Company's business, financial condition and results of operations. " in Item 1A, Risk Factors of this Form 10-K for further information.


text: We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, and other significant disruptions of information technology networks and related systems. See also "Item 1A. Risk Factors – Risks Related to our Operations – We face risks associated with security breaches through cyber attacks, cyber intrusions, ransomware or otherwise, as well as other significant disruptions of our information technology ("IT") networks and related systems." We have never experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. With the assistance of a third party technology consulting firm, we have adopted and implemented an approach to identify and mitigate cybersecurity risks. For example, we are in the process of adopting and implementing many of the voluntary practices recommended under the National Institute of Standards and Technology cybersecurity framework, which we believe is a best practice for U.S.-based real estate companies.

companyName: HIGHWOODS PROPERTIES, INC.

ticker: HIW


text: Management's information technology steering committee, which is led by the chief information officer and includes all of our executive officers, is responsible for assessing and managing material risks from cybersecurity threats from our own information technology networks and systems we use that are owned by third party service providers. Ryan Hunt has served as our chief information officer since June 2021. Mr. Hunt joined us in 1997 and quickly transitioned his focus to technology. He began his technology career on the IT help desk, served in various other roles within the technology department and most recently served in the role of senior director of application development. Mr. Hunt earned his Bachelor of Science degree in Management Information Systems from North Carolina State University.


text: Under the direction of our chief information officer with oversight from management's steering committee, the Company has implemented a cybersecurity incident response plan that sets forth a process for detecting and responding to cybersecurity incidents, determining their scope and risk, developing an appropriate response to mitigate and remediate the incident, communicating effectively to all stakeholders and participants and reducing the likelihood of similar future incidents. In the event of a real or perceived cybersecurity incident, the chief information officer would, as soon as practicable, inform management's steering committee, the members of which would then collaborate with the chief information officer to manage material risks.


text: As part of our overall enterprise risk management processes and to better evaluate our cybersecurity risks, we have conducted a business impact analysis by leveraging our annual company-wide enterprise risk management assessment to understand the relationship between our critical business operations and our information technology systems. We partner with a third party service provider to assist us on a real-time basis with detecting advanced threats, streamline and collaborate on investigations and recommend actions to further strengthen our systems and, if and when necessary, respond to incidents. In addition, we regularly engage independent third parties to test our cybersecurity processes and systems through consulting, independent audits and penetration testing. We also have a cyber risk insurance policy designed to help us mitigate risk exposure by offsetting costs involved with recovery and remediation after a cybersecurity breach or similar event.


text: We regularly conduct cybersecurity training to ensure all employees are aware of cybersecurity risks and to enable them to take steps to mitigate such risks. For example, all employees are required to successfully complete a cybersecurity risk module and assessment on a quarterly basis. As part of this program, we also take reasonable steps to ensure any employee who may come into possession of confidential financial or health information has received appropriate cybersecurity awareness training and, if applicable, payment card industry (PCI) training.


text: The audit committee of the Company's Board of Directors is responsible for overseeing management's information technology steering committee as well as management's risk assessment and risk management processes designed to monitor and control cybersecurity threats. Management's steering committee, led by the Company's chief information officer, regularly briefs the audit committee on cybersecurity matters. These briefings generally occur on a quarterly basis. In the event we experience a cybersecurity incident that could materially affect us, including our business strategy, results of operations or financial condition, the Company's chief information officer and other members of management's steering committee (which include executive officers who are also part of our disclosure committee) would review the incident with the audit committee to consider whether and to what extent disclosure is required under Item 1.05 of Form 8-K.


text: We face risks associated with security breaches through cyber attacks, cyber intrusions or otherwise, and other significant disruptions of information technology networks and related systems. See also "Item 1A. Risk Factors – Risks Related to our Operations – We face risks associated with security breaches through cyber attacks, cyber intrusions, ransomware or otherwise, as well as other significant disruptions of our information technology ("IT") networks and related systems." We have never experienced any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. With the assistance of a third party technology consulting firm, we have adopted and implemented an approach to identify and mitigate cybersecurity risks. For example, we have adopted and implemented, or are in the process of adopting and implementing, many of the voluntary practices recommended under the National Institute of Standards and Technology cybersecurity framework 2.0, which we believe is a best practice for U.S.-based real estate companies.


text: The Company is not aware of any cybersecurity threats or incidents to date that have materially affected its strategy, results of operations, or financial condition. However, the scope and impact of any future cybersecurity incident cannot be predicted with certainty. More information on how material cybersecurity attacks may impact the Company's business is provided in "Item 1A. Risk Factors ".

companyName: IMAX CORP

ticker: IMAX


text: CYBERSECURITY RISK MANAGEMENT FRAMEWORK The Company employs a multi-faceted cybersecurity risk management framework, which is integrated into its enterprise risk management system. The Company aligns its security policies and practices with the ISO 27001 framework and manages its cybersecurity risks through a dedicated information security team, reporting to the Head of Information Security. The information security team is tasked with, among other things, assessing, identifying and managing material cybersecurity risks and overseeing the implementation of the Company's cybersecurity strategy. The Company's cybersecurity risk management includes, but is not limited to, the following elements.


text: Risk Identification and Assessment The information security team conducts periodic risk assessments, which includes penetration testing and vulnerability scanning, on the Company's Information Technology ("IT") infrastructure, systems, and networks to identify potential vulnerabilities, weaknesses, and risks, and evaluates the potential impact of cybersecurity risks on the Company's operations, financials, and business.


text: Risk Mitigation Measures The information security team implements and maintains a multi-layered defense approach to safeguard the Company's information technology infrastructure in accordance with industry best practices and updates the Company's systems and software to address identified vulnerabilities. The Company has also developed an incident response and disaster recovery plan to respond to cybersecurity incidents.


text: Vendor Risk Management The Company evaluates the risk profile of its third-party service providers and may include cybersecurity enhancement or compliance requirements in its service agreements, as needed. The information security team periodically reviews key vendors and counterparties' cybersecurity practices and may conduct audits or assessments at its discretion.


text: In addition, the Company has established clear lines of communication with key stakeholders, including executives, IT teams, employees, and customers, to ensure transparency and an effective response to cybersecurity incidents. Furthermore, the information security team develops and provides cybersecurity awareness training to the Company's employees and regularly communicates updates on best cybersecurity practices and improvements in the cybersecurity program.


text: The Company may use third-party programs and software and engage assessors, consultants, cybersecurity auditors, or other third parties to review, test, and advise on improvements to the Company's cybersecurity infrastructure.


text: ROLE OF THE BOARD OF DIRECTORS The Audit Committee oversees the Company's risk management and assessment, including its mitigation strategies, and updates the entire Board on the Company's risk profile and exposures on an as needed basis. With respect to cybersecurity, the Company's Chief Technology Officer ("CTO") and Head of Information Security updates the Audit Committee on at least an annual basis on matters such as external cybersecurity threats and attack trends; updates to threat monitoring processes; the composition of the Company's information security team; cybersecurity awareness training and testing; cybersecurity strategy; cybersecurity metrics, and assessments the progress of cybersecurity programs; and the potential scope and impact of cybersecurity risks and incidents on the Company's operations and financial condition. The Audit Committee may also meet with management on an ad hoc basis to discuss and review any material cybersecurity incidents or threats.


text: Management is responsible for managing risks and informing the Board of the Company's material near- and long-term risks and risk management strategies. Management presents the Company's risk assessment, which includes its cybersecurity risks, to the Audit Committee on at least an annual basis.


text: The CTO leads management's assessment and management of cybersecurity risks. The Company's Head of Information Security leads the information security team, which is responsible for managing day-to-day cybersecurity risks and implementing and maintaining the Company's cybersecurity strategy. The Head of Information Security reports to and regularly briefs the CTO on cybersecurity matters, including results of vulnerability testing and remediation, cyber incident responses, and progress on cybersecurity infrastructure initiatives. The CTO and Head of Information Security update the Audit Committee about cybersecurity risks and any investigation of a material cybersecurity incident.


text: The Company's current CTO has over 20 years of experience in senior technology leadership roles, involving oversight of all aspects of technology development and technical operations, including cybersecurity.


text: The Company's current Head of Information Security has over 20 years of experience in cybersecurity roles, including in cybersecurity engineering, information security assessment, and development and management of corporate security policies and governance problems.


text: Risk Management and Strategy The strength and resilience of the Company's information systems, assets, data, and network infrastructure is critical to its business operations. The Company takes cybersecurity risk seriously and has implemented a cybersecurity risk management program that is integrated in the Company's enterprise risk management system and processes. The enterprise risk management program, which is led by our executive leadership team, includes a process that identifies, assesses, mitigates and manages the risks from both internal and external factors that could significantly impact the Company and influence our business strategy and performance.

companyName: SSR MINING INC.

ticker: SSRM


text: Our cybersecurity risk management program is centered on the following principles: • Risk-based approach to managing controls, cost benefit and control effectiveness; • Defense-in-depth approach with the assumption of breach mindset; • Resiliency to mitigate, manage and recover from incidents or disasters; • Zero-trust architecture with services well secured and networks be untrusted; and • Least privilege identity and access management.


text: The cybersecurity risk management program is designed to provide ongoing detection and monitoring of cybersecurity threats and intrusions. The Company's Information Technology ("IT") department leads the identification of critical applications, systems and data, and possible points of failure and takes a proactive approach to the detection of unauthorized activity, intrusion attempts and compromised equipment. The IT department also carries out automated and ad hoc network-based vulnerability, compromise and business impact assessment and guideline compliance scans of our networks, systems and devices to detect vulnerabilities, compromised hosts and compliance failures. We rely on information technology systems provided by third parties, and our IT department implements procedures that seek to identify cybersecurity risks of these third-party providers to whom we outsource certain of our services or functions, or with whom we interface, store or process company, employee or other confidential information. The Company also provides regular information security training to its employees. The Company engages external consultants and other third parties to provide cybersecurity controls assessment relying on the National Institute of Standards and Technology's Cybersecurity Framework and for other advisory support. The Company will continue to take additional steps designed to further protect its networks, information and operations as needed.


text: The Company's Cybersecurity Committee, which is comprised of cross-functional management team members, is notified following discovery of a potential or actual cybersecurity breach. Subject to the severity of the actual or potential breach, the Company's Executive Committee may also be notified, and an external breach team may be retained, including mitigation experts and external legal counsel. The Cybersecurity Committee will convene to evaluate the materiality of the breach, with input from the external breach team as required. Internal and external legal counsel will determine whether any disclosures are required pursuant to all relevant jurisdictional rules and regulations. The Company's Board of Directors will be notified as necessary.


text: No cybersecurity incident during the year ended December 31, 2023, or prior, resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations. The scope of any future incident cannot be predicted. See "Item 1A. Risk Factors" for more information.


text: The Company's Vice President of Finance and Technology ("VP FT"), assisted by the Company's Information Technology ("IT") Director and Cyber Security and Architecture Manager ("CSA"), is responsible for leading the team assessing, identifying and managing cybersecurity risks, including implementation of our cybersecurity risk management program and leading day-to-day cybersecurity operations. The VP FT has more than eight years of experience overseeing and managing IT operations, including cybersecurity, within the mining industry and has extensive hands-on, practical experience navigating real-world cyber challenges. The Company's CSA has more than 25 years of IT, cyber security, and cyber auditing experience. The CSA holds both a bachelor's degree and master's degree in IT/Cyber, several certifications in the industry, including the Certified Information Systems Security Professional ("CISSP") and Information Systems Security Architecture Professional ("ISSAP") credentials, Certified Information Systems Auditor ("CISA") certification, Certified in Risk and Information Systems Control ("CRISC") certification, Certified Data Privacy Solutions Engineer ("CDPSE") certification, and other IT technical, cloud, and cyber governance certifications.


text: Longer term cybersecurity risk management strategic planning is addressed by the Company's management Cybersecurity Committee, which is comprised of the VP FT, the CSA and members from various departments within the Company, including Legal, Operations and Internal Audit. The Cybersecurity Committee meets quarterly to review cybersecurity threats and risks, strategic objectives, and progress on the Company's cybersecurity initiatives.


text: The Board recognizes the importance of robust cybersecurity risk management programs and is actively engaged in overseeing and reviewing the Company's cybersecurity risk profile and exposures. The Board has overall responsibility for the oversight of the Company's enterprise risk management, including cybersecurity risks and ensuring the implementation of appropriate controls to manage these risks. The Board receives updates on the Company's ongoing cybersecurity risk management efforts, and updates on the activities of the Cybersecurity Committee at least twice per year, with more frequent updates as needed. The Board has also directed management to inform them promptly of any investigation of a material cybersecurity incident. The Board may, from time to time, engage third party advisors and experts, and meet with the Company's external advisors on cybersecurity matters, as appropriate.


text: The cybersecurity risk management program is designed to provide ongoing detection and monitoring of cybersecurity threats and intrusions. The Company's Information Technology ("IT") department leads the identification of critical applications, systems and data, and possible points of failure and takes a proactive approach to the detection of unauthorized activity, intrusion attempts and compromised equipment. The IT department also carries out automated and ad hoc network-based vulnerability, compromise and business impact assessment and guideline compliance scans of our networks, systems and devices to detect vulnerabilities, compromised hosts and compliance failures. We rely on IT systems provided by third parties, and our IT department implements procedures that seek to identify cybersecurity risks of these third-party providers to whom we outsource certain of our services or functions, or with whom we interface, store or process company, employee or other confidential information. The Company also provides regular information security training to its employees. The Company engages external consultants and other third parties to provide cybersecurity controls assessment relying on the National Institute of Standards and Technology's Cybersecurity Framework and for other advisory support. The Company will continue to take additional steps designed to further protect its networks, information and operations as needed.


text: The Company's Cybersecurity Committee, which is comprised of cross-functional management team members, is notified following discovery of a potential or actual cybersecurity breach. Subject to the severity of the actual or potential breach, the Company's Executive Committee may also be notified, and an external breach team may be retained, including mitigation experts and external legal counsel. The Cybersecurity Committee will convene to evaluate the materiality of the breach, with input from the external breach team as required. Internal and external legal counsel will determine whether any disclosures are required pursuant to all relevant jurisdictional rules and regulations. The Board will be notified as necessary.


text: The Company has not experienced a cybersecurity incident during the year ended December 31, 2024, or prior, that resulted in an interruption of our operations, known losses of critical data or otherwise had a material impact on our strategy, financial condition or results of operations. The Company's Turkish subsidiary, Anagold Madencilik Sanayi ve Ticaret Anonim irketi ("Anagold"), was the target of a minor ransomware attack in November 2022, which did not cause serious disruption to the Company's or Anagold's operations. The scope of any future incident cannot be predicted. See Item 1A. Risk Factors for more information.


text: The Company's Director of Cybersecurity, assisted by the Company's IT department, is responsible for leading the team assessing, identifying and managing cybersecurity risks, including implementation of our cybersecurity risk management program and leading day-to-day cybersecurity operations. The Director of Cybersecurity has more than thirty years of experience overseeing and managing cybersecurity, cyber auditing, and IT operations within the U.S. federal defense, commercial and mining sectors and has extensive hands-on, practical experience navigating real-world cyber challenges. The Director of Cybersecurity holds both a bachelor's degree and master's degree in IT/Cyber, several certifications in the industry, including the Certified Information Systems Security Professional ("CISSP") and Information Systems Security Architecture Professional ("ISSAP") credentials, Certified Information Systems Auditor ("CISA") certification, Certified in Risk and Information Systems Control ("CRISC") certification, Certified Data Privacy Solutions Engineer ("CDPSE") certification, and other IT technical, cloud, and cyber governance certifications.


text: Longer term cybersecurity risk management strategic planning is addressed by the Company's management Cybersecurity Committee, which is comprised of the Director of Cybersecurity and members from various departments within the Company, including Legal, Operations and Internal Audit. The Cybersecurity Committee meets quarterly to review cybersecurity threats and risks, strategic objectives, and progress on the Company's cybersecurity initiatives.


text: Cybersecurity represents a critical component of the Company's overall approach to risk management. The Company's cybersecurity policies, standards, and practices are fully integrated into the Company's enterprise risk management ("ERM") approach, and cybersecurity risks are among the core enterprise risks that are subject to oversight by the Company's Board of Directors (the "Board"). The Company's cybersecurity policies, standards, and practices follow recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization, and other applicable industry standards. The Company generally approaches cybersecurity threats through a cross-functional, multilayered approach, with the specific goals of: (i) identifying, preventing, and mitigating cybersecurity threats to the Company; (ii) preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; (iii) protecting the Company's intellectual property; (iv) maintaining the confidence of our customers, clients, and business partners; and (v) providing appropriate public disclosure of cybersecurity risks, and incidents when required.

companyName: PENN Entertainment, Inc.

ticker: PENN