text: BNY Mellon's Technology Risk Committee is responsible for, among other things, overseeing and reviewing significant cybersecurity incidents. The Technology Risk Committee receives reports from management and has protocols for escalating certain issues and risks to the Senior Risk and Control Committee and the Risk Committee of the Board. The Technology Risk Committee is co-chaired by the Head of Technology Risk and Control and the Chief Technology Risk Officer, and the CISO is a member.


text: BNY Mellon's CIO, CISO and Chief Technology Risk Officer each have extensive experience in assessing and managing risks from cybersecurity threats. BNY Mellon's CISO joined BNY Mellon in 2022 and previously served as head of information security at a Fortune 500 biopharmaceutical company and an information technology company, as well as the Global Chief Technology Officer at a large cybersecurity company. BNY Mellon's CIO has served in that position since 2017 and previously held roles as Chief Information Officer, Chief Technology Officer, and numerous other technology management positions at other large financial institutions. BNY Mellon's Chief Technology Risk Officer joined BNY Mellon in 2021 and previously served as Global Head of Technology Risk Management, Chief Information Security Officer, Global Head of Cyber Risk and Operational Resilience and Chief Risk Officer for Technology and Operations at other large financial institutions.

companyName: CHESAPEAKE GRANITE WASH TRUST

ticker: CHKR

secItem: Item 1C


text: The Operator, Diversified, is responsible for the oversight and overall management of the Underlying Properties. The Trust also relies on Diversified's Enterprise Risk Management ( ERM) framework for cybersecurity risk management and strategy relating to the operation of the Underlying Properties. Key aspects of Diversified's cybersecurity risk management, strategy and governance are summarized below. As of December 31, 2023, cybersecurity risks have not materially affected the business of the Underlying Properties or the Trust's results of operations or financial condition.


text: Cybersecurity is a component of Diversified's ERM Program. The ERM program entails risk identification, assessment, prioritization, monitoring and mitigation processes, which are continually evaluated and enhanced. The risk assessment process takes into account broader risks such as strategic, operational and regulatory and financial implications. Additionally, the ERM program risk assessment is discussed with members of Diversified's Senior Leadership Team and its Audit Risk Committee, which includes members of Diversified's Board of Directors. In addition to Diversified's ERM Program, Diversified's governing policies and procedures create a structured approach to managing cybersecurity risk. Diversified's network is designed using a Zero Trust Approach ( ZTA) and is segmented to include several layers of security, including least privilege access, conditional access policies, and multi-factor authentication ( MFA). The ZTA encompasses identity, endpoints, infrastructure, data, and applications for enhanced visibility, intelligence and automation for Diversified's security team. Diversified network environment is completely cloud based and is therefore continuously tested from both trusted and untrusted sources - both external and internal to its networks, rather than relying on a one-time penetration testing approach. Additionally, Diversified's employees are subject to annual cybersecurity training and e-learning sessions as employees are viewed as the first line of defense against cybersecurity attacks.


text: Diversified engages with key technology partners and suppliers to ensure potentially vulnerable systems are identified and secured, including continuous incident monitoring, regular threat testing, and control and protection of confidential information. Third-party providers are subject to an assessment every 90 days, based on various criteria, such as whether the third-party provider has access to Diversified's network, data and information systems. Third-party providers that have access are required to use MFA and their system and organization controls reports are obtained and reviewed annually.


text: A dedicated Cybersecurity Council is responsible for Diversified's cybersecurity risk management and strategy. The Cybersecurity Council includes certain members of Diversified's Senior Leadership Team, including the Chief Operating Officer, Chief Financial Officer, Chief Information Officer and General Counsel. This Council meets at least once a quarter to discuss cybersecurity issues, risks and strategies. The Cybersecurity Council briefs Diversified's Board of Directors at least quarterly, on all security initiatives, including assessing risks, incidents and any remediation taken. Additionally, the Council is briefed on efforts to improve Diversified's network security systems and enhanced employee trainings. The membership of this council is adequately trained and educated to provide proper governance, risk management and control of the cybersecurity program utilizing the National Institute of Standards and Technology framework.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: CHUY'S HOLDINGS, INC.


text: We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. The Company evaluates and addresses cybersecurity risks in alignment with our business objectives and operational needs. The Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: The board of directors recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees. The board of directors is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The board of directors has established robust oversight mechanisms to ensure effective governance in managing risks.


text: The Audit Committee bears the primary responsibility for the board of directors' oversight of cybersecurity risks. The Audit Committee is composed of board members with diverse expertise, including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively.


text: Our Vice President of Information Technologies ("IT") and our Chief Financial Officer ("CFO") play a pivotal role in informing the Audit Committee about cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of once per quarter. These briefings encompass a broad range of topics, including: • the current cybersecurity landscape and emerging threats • the status of ongoing cybersecurity initiatives and strategies • incident reports and learnings from any cybersecurity events and • compliance with regulatory requirements and industry standards. In addition to its scheduled meetings, the Audit Committee, Vice President of IT and CFO maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity domain, ensuring the board of directors' oversight is proactive and responsive. The Audit Committee actively participates in strategic decisions related to cybersecurity, offering guidance and input for major initiatives. This involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives. Additionally, on an annual basis, the board of directors discusses the Company's approach to cybersecurity risk management with the Vice President of IT and CFO.


text: Our Vice President of IT, in his capacity, regularly informs the CEO and CFO of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant cybersecurity matters, and strategic risk management decisions are escalated to the board of directors, ensuring that they have comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: Risk Management Personnel Primary responsibility for assessing, monitoring and managing our cybersecurity risks rests with our Vice President of IT and our Security and Compliance Engineer. Our Vice President of IT and Security and Compliance Engineer have served in various roles in information technology and information security for over 30 years and bring a wealth of expertise to their roles. Their in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies.


text: Recognizing the complexity and evolving nature of cybersecurity threats, we engage with external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain at the forefront of industry best practices. Our collaboration with these third-parties includes regular audits, threat assessments, and consultation on security enhancements.


text: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: The Company provides training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Monitoring Cybersecurity Threats and Incidents Our Vice President of IT remains informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition is crucial for the effective prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Vice President of IT implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and regular system audits to identify potential vulnerabilities. The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. The Company conducts an annual review of its cybersecurity measures and the effectiveness of its risk management strategies. This review helps in identifying areas for improvement and ensuring the alignment of cybersecurity efforts with the overall risk management framework.


text: In the event of a cybersecurity incident, the Vice President of IT is equipped with a incident response and recovery plan. This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention of future incidents. The board of directors and senior management also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds.


text: Cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For additional information, see Item 1A. "Risk Factors—Information technology system failures or breaches of our network security could interrupt our operations and harm our business, financial condition and results of operations."


text: Our cybersecurity strategy, which is effected through our Cybersecurity Risk Management Model, prioritizes the security and protection of our information technology networks and systems, through the detection, analysis and response to known, anticipated or unexpected threats and effective management of security risks. Our Cybersecurity Risk Management Model provides for four levels of industry-standard response activities to protect the Company against cyber threats. These are:

companyName: Bristow Group Inc.

ticker: VTOL


text: 1.Policy Framework: Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems, including our Information Security Policy, which establishes guidelines for the safe and secure use of the Company's information systems and data, and our Electronic Communication Policy, which outlines the responsibilities of those using the Company's network and IT equipment. Employees and third-party service providers are required to comply with our Information Security Policy and our Electronic Communication Policy.


text: 2.Awareness Programs: All employees participate in an ongoing program of mandatory annual training and receive periodic communications regarding the cybersecurity environment to increase awareness throughout the Company. We also implemented an enhanced annual training program for specific specialized employee populations.


text: 3.Security Engineering: We leverage a combination of the International Organization for Standardization (the "ISO") best practice standards and other global standards, including Control Objectives for Information and Relevant Technology and GDPR, to measure our security posture and manage risk. In addition, we completed several cybersecurity-related initiatives such as multifactor authentication and the ISO 27001 certification, which is globally recognized as one of the highest standards of compliance and control for information security management systems. We have also implemented critical preventive measures, such as monthly phishing simulations, email and endpoint security and monitoring, database encryption, continuous patching, and network firewall security using both internal resources and independent third-party service providers. 4.IT Resiliency: Our IT Team has formalized disaster recovery processes, business continuity procedures and an incident response plan.


text: Our Data Privacy Officer is responsible for leadership, compliance, and oversight of applicable cyber and privacy laws and policies, which are designed to protect data belonging to our employees and customers and the Company's information security; while our IT Cyber Incident Management Team oversees Bristow's cyber incident response and remains in close contact with the Executive Leadership Team and the Audit Committee throughout the cyber incident resolution process.


text: Our IT Steering Committee is responsible for reviewing, approving and funding IT projects, including cybersecurity initiatives. This committee consists of five (5) members: the Chief Information Officer, the President and Chief Executive Officer, the Chief Financial Officer, the Chief Operating Officer, Government Services and the Chief Operating Officer, Offshore Energy Services.


text: The Chief Executive Officer, with the assistance of the other members of the executive leadership team, is responsible for, among other risk management measures, implementing measures designed to ensure the safety standards for personnel, information technology systems and data security, the environment and property in performing the Company's operations. The Company's Enterprise Risk Management Committee (ERM), sponsored by the CEO, was established to oversee the risk management processes and to report upon and ensure that sound policies, procedures and practices are in place for the enterprise wide management of the Company's material risks and to report the results of the Committee's activities to the Company the Board at least annually. These include risks associated with cybersecurity and any of the topics identified in our materiality assessment. Responsibilities for risk management and compliance are distributed throughout various functional areas of the business, including but not limited to a Compliance Committee established to understand and support business integrity and compliance efforts globally, and to oversee Bristow's compliance efforts with respect to COBI, relevant policies, and applicable laws.


text: Our Cybersecurity Committee consists of four (4) members: the Chief Information Officer, the Chief Financial Officer, the Director of Internal Audit and the Director of IT, Infrastructure and Flight Systems. Together with our Executive Leadership Team and the Board, the Cybersecurity Committee assists with prioritizing our cybersecurity programs as well as providing oversight around cybersecurity practices and guidance in responding to cyber incidents. Members of the Cybersecurity Committee have work experience managing cybersecurity and information security risks, an understanding of the cybersecurity threat landscape and/or knowledge of emerging privacy risks in our industry. Committee members are also experienced and knowledgeable across Information Technology disciplines including strategy, governance, infrastructure, applications, data management, audit controls & compliance, risk management, disaster recovery, business continuity, and incident response planning.


text: The Cybersecurity Committee meets quarterly and delivers updates to management periodically and to the Audit Committee on an annual basis (and as needed). Under its charter, our Audit Committee, comprised of independent directors from our Board, must conduct at least annual reviews of any emerging cybersecurity developments and threats and the strategies to mitigate cybersecurity risks. The Cybersecurity Committee also delivers periodic updates to the Board on the status of the information security program, including but not limited to relevant cyber threats, roadmap and key initiative updates, and the identification and management of information security risks. The Board reviews cybersecurity opportunities relating to our business strategy, and cybersecurity-related matters are also factored into business continuity planning.


text: As of the December 31, 2023, we are not aware of any material risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect our Company, including our business strategy, results of operations, or financial condition.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. We design and assess our program based on industry practices and accepted frameworks (e.g. the NIST framework).

companyName: Global Net Lease, Inc.

ticker: GNL


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, services, and our broader enterprise IT environment; • our IT team, in coordination with senior management, is principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls and designed to anticipate cyber-attacks and prevent breaches; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a risk management process for third parties, including, but not limited to service providers, suppliers, and vendors.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our Board considers cybersecurity risk and other information technology risks as part of its risk oversight function. Our Audit Committee reviews policies with respect to major risk assessment and risk management and reviews with management the steps taken to monitor and control such exposures. As part of this function, our Audit Committee oversees management's implementation of our cybersecurity risk management program, including reviewing risk assessments from management with respect to our information technology systems and procedures, and overseeing our cybersecurity risk management processes.


text: The Audit Committee receives periodic reports from management on our cybersecurity risks. In addition, management will update the Audit Committee, as necessary and appropriate, regarding cybersecurity incidents that we may experience.


text: The Audit Committee reports to the full Board regarding its activities, including those related to cybersecurity. The Audit Committee receives briefings from management on our cyber risk management program and receive presentations on cybersecurity topics from management, our internal auditors IT personnel or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Our management team supervises efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from IT personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the IT environment.


text: Our management team is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants.


text: Risk Management and Strategy We regularly assess risks from cybersecurity threats, monitor our information systems for potential vulnerabilities, and test those systems pursuant to our cybersecurity policies, standards, processes, and practices, which are integrated into our overall risk management system. To protect our information systems from cybersecurity threats, we use various security tools that help us identify, protect against, detect, respond to, and recover from security incidents. These efforts are implemented by our Global Technology & Solutions ("GTS") team in partnership with our business, legal, and compliance teams, and are essential for us to conduct investment activities, manage internal administration activities, and connect our global enterprise.

companyName: Carlyle Group Inc.

ticker: CG


text: Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the firm's data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with our business segment teams to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment, and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as our acceptable use policy, upon hire and annually.


text: In addition, we partner with third parties to assess the effectiveness of our cybersecurity program, including audits and assessments performed under the direction of Carlyle's Internal Audit team, which co-sources with third-party cybersecurity experts in conducting its reviews. GTS also administers the firm's cyber third-party risk management program, which assesses external service providers before onboarding and provides ongoing monitoring in accordance with certain risk-based cybersecurity criteria.


text: To our knowledge, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see Part I, Item 1A "Risk Factors—Risks Related to Our Company—Operational risks (including those associated with our business model), system security risks, breaches of data protection, cyberattacks, or actions or failure to act by our employees or others with authorized access to our networks, including our ability to insure against such risks, may disrupt our businesses, result in losses, or limit our growth."


text: Our Board of Directors oversees our enterprise risk management strategy, including our strategy on cybersecurity risks, directly and through its committees. In this respect, the Audit Committee of the Board of Directors (the "Audit Committee") oversees our risk management program, which focuses on the most significant risks we face in the short-, intermediate-, and long-term timeframe. Audit Committee meetings include discussions of specific risk areas throughout the year, including, among others, those relating to cybersecurity, and reports from the Chief Audit Executive on our enterprise risk profile on an annual basis. In addition, our Chief Information Security Officer ("CISO") leads our cybersecurity program, chairs our Information Security Steering Committee ("ISSC"), and provides cybersecurity status reporting to our Audit Committee at least annually. The ISSC meets quarterly and ensures that cybersecurity initiatives are in alignment with Carlyle's strategic priorities.


text: We take a risk-based approach to cybersecurity and have implemented cybersecurity policies, standards, processes, and practices throughout our operations that are designed to address cybersecurity threats, events, and incidents. In particular, our cybersecurity program supports security governance, security awareness and training, security engineering and architecture, security risk management, vulnerability management, security monitoring, and incident response capabilities. In addition, our incident response plan contains escalation and reporting protocols, including reporting to the firm's Disclosure Committee to consider materiality of cybersecurity incidents. Policies and procedures are in place to assist the firm's Disclosure Committee with these materiality assessments and any resulting reporting requirements.


text: Our CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, Chief Information Officer, Chief Risk Officer, and Chief Audit Executive, among certain other senior executives, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 30 years of experience in information security and is a Certified Information Systems Security Professional. As described above, our CISO leads our cybersecurity program, chairs Carlyle's ISSC that is comprised of senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: Our systems, data, network, and infrastructure are monitored and administered by formal controls and risk management processes that log events and help protect the firm's data. In addition, our business continuity plans are designed to allow critical business functions to continue in an orderly manner in the event of an emergency. The GTS team works closely with our business segment teams to maintain operational resilience through business continuity planning and annual information technology disaster recovery and incident response plan testing, which collectively support the goal of mitigating risk were an emergency to occur. These efforts are underpinned by the implementation of security best practices, where possible, such as: • Multi-factor authentication for remote access, privileged access management for system administrators, application whitelisting, laptop encryption, mobile device management software, and advanced malware defenses on endpoints; • Incident preparedness and response planning and risk mitigation; • Independent and continuous security testing, assessment, and third-party risk and vulnerability management; • Regular security awareness training, including phishing simulations, for Carlyle authorized users; • Restrictions on access to personal email accounts, cloud storage, social media, risk-based categories of websites, and USB storage devices; • Device and system access management policies and procedures that restrict access upon employee or contractor separation from the company; and • Compliance attestations by Carlyle personnel on firm policies, such as our acceptable use policy, upon hire and annually.


text: To our knowledge, cybersecurity threats, including as a result of any previous detected or undetected cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition; however, we may learn new facts about these detected or undetected incidents and these facts may lead us to change this materiality assessment. The sophistication of cyber threats continues to increase and there can be no assurance that the various procedures and controls we utilize to mitigate these threats will be sufficient to prevent disruptions to our systems. Consequently, given that the magnitude of cybersecurity incidents or threats are difficult to predict, we are unable to determine at this time whether risks from cybersecurity threats are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For an additional description of cybersecurity risk and potential related impacts on us, see


text: Part I, Item 1A "Risk Factors—Risks Related to Our Company—Operational risks (including those associated with our business model), system security risks, breaches of data protection, cyberattacks, or actions or failure to act by our employees or others with authorized access to our networks, including our ability to insure against such risks, may disrupt our businesses, result in losses, or limit our growth."


text: Our CISO, in coordination with our Chief Financial Officer, Chief Compliance Officer, Chief Information Officer, Chief Risk Officer, and Chief Audit Executive, among certain other senior executives, is responsible for leading the assessment and management of cybersecurity risks. The current CISO has over 22 years of experience in information security that includes key roles managing cybersecurity risk in both government and the private sector. As described above, our CISO leads our cybersecurity program, chairs Carlyle's ISSC that comprises senior management and other sector representatives, and provides cybersecurity status reporting to our Audit Committee as necessary and at least annually.


text: We have developed a comprehensive information security program that is designed to protect and preserve the confidentiality, integrity, and continued availability of all information that we own or possess. The program is a critical component of our overall IT Security, Risk, and Compliance Management Program, which is based, in part, on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards.

companyName: Athene Holding Ltd.

ticker: ATH-PA


text: Key features of the program include: • Implementation of a detailed cyber incident response plan that provides controls and procedures for identifying, assessing, containing, remediating, escalating, and reporting cyber incidents. • Cross-functional approach to addressing cybersecurity risk, with engagement among internal working groups such as Risk, Information Technology, Operations, Procurement, Legal, Compliance, and Internal Audit functions. • Information security policies and procedures that are reviewed at least annually and updated to reflect changes in law, technology, practice, and emerging threats. • Cybersecurity awareness training for employees, upon hire and at least annually thereafter; • Ongoing monitoring, and periodic assessment and testing, of our networks and systems for threats, vulnerabilities, and other cybersecurity risks, internal and external. • Periodic tabletop exercises and response readiness assessments, with participation from senior executives, led by outside advisors who provide a third-party independent assessment of our technical program and internal response preparedness; results are provided to the audit committee. • Development of risk mitigation strategies that may defray costs associated with an information security breach. • Periodic cyber drills and disaster recovery tests which are designed to help ensure our business operations can continue in the event of a cybersecurity attack. • Comprehensive internal risk assessment of critical third-party service providers, including of their cybersecurity posture prior to onboarding; contractual requirements for critical third-party service providers to adhere to our standards and incidents reporting; once engaged, critical third-party service providers are required to maintain a comprehensive cybersecurity plan in conformity with industry standards. We engage industry specialists and other third parties in connection with such processes.


text: Our information security program is managed by our Chief Information Security Officer (CISO) with collaboration across lines of businesses and corporate functions. The CISO is a senior-level executive responsible for establishing and executing our information security strategy, including cybersecurity oversight. The CISO reports directly to our Chief Information Officer (CIO), who reports directly to our Chief Operating Officer (COO). The CIO and CISO are members of the management operational risk committee, which reports to the management risk committee. The COO is a member of the management risk committee, which reports to the board risk committee. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Committees of the Board of Directors—Management Committees for additional information about the management operational risk committee, which is responsible for overseeing operational risk, including cybersecurity risk, and the management risk committee, which is responsible for overseeing overall corporate risk.


text: In addition, the CIO, CISO, General Counsel and certain other members of senior management meet periodically with the audit, risk, and legal and regulatory committees of the board of directors to review our information technology and cybersecurity risk profile and to discuss risk mitigation plans. While the board risk committee is ultimately responsible for overseeing the management of our information security program at the board level, the audit and legal and regulatory committees assist the risk committees in fulfilling its duties. Each of the board committees regularly briefs the full board of directors on matters reported to them. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Risk Management Oversight for additional information regarding the role of our board of directors in risk management oversight, including its oversight of risks from cybersecurity threats. As of February 1, 2024, we have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. See Item 1A. Risk Factors—Risks Relating to Our Business Operations—Interruption or other operational failures in telecommunications, information technology and other operational systems, including as a result of threat actors attacking those systems, or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on those systems, including as a result of human error, could have a material adverse effect on our business and Item 1A. Risk Factors—Risks Relating to Our Relationship with Apollo—Interruption or other operational failures in telecommunications, information technology and other operational systems at Apollo or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on Apollo's systems, including as a result of human error, could have a material adverse effect on our business for further discussion of the risks we face from cybersecurity threats.


text: The CIO is responsible for managing our information technology strategy. Our CIO has over 30 years of insurance and financial services operations and technology experience, including as chief information officer at large insurance companies; and received a Bachelor of Science in business management and a Master of Business Administration in management information systems.


text: The CISO is responsible for managing our information security program. Our CISO has over 20 years of information technology experience and over 15 years of information security experience; is a Certified Information Systems Security Professional, Certified Information Systems Auditor, Certified Information Systems Manager, and Check Point Certified Engineer; and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.


text: In addition, the CIO, CISO, General Counsel and certain other members of senior management meet periodically with the audit, risk, and legal and regulatory committees of the board of directors to review our information technology and cybersecurity risk profile and to discuss risk mitigation plans. While the board risk committee is ultimately responsible for overseeing the management of our information security program at the board level, the audit and legal and regulatory committees assist the risk committees in fulfilling its duties. Each of the board committees regularly briefs the full board of directors on matters reported to them. See Item 10. Directors, Executive Officers and Corporate Governance—Corporate Governance—Risk Management Oversight for additional information regarding the role of our board of directors in risk management oversight, including its oversight of risks from cybersecurity threats. We have not identified any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected us, our business strategy, results of operation or financial condition. See Item 1A. Risk Factors—Risks Relating to Our Business Operations—Interruption or other operational failures in telecommunications, information technology and other operational systems, including as a result of threat actors attacking those systems, or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on those systems, including as a result of human error, could have a material adverse effect on our business and Item 1A. Risk Factors—Risks Relating to Our Relationship with Apollo—Interruption or other operational failures in telecommunications, information technology and other operational systems at Apollo or a failure to maintain the security, integrity, confidentiality or privacy of sensitive data residing on Apollo's systems, including as a result of human error, could have a material adverse effect on our business for further discussion of the risks we face from cybersecurity threats.


text: The CISO is responsible for managing our information security program. Our CISO has over 25 years of information technology experience and over 20 years of information security experience; is a Certified Information Systems Security Professional, a Certified Information Systems Manager, and holds a Bachelor of Arts in statistical science, a Bachelor of Science in computer science, and a Master of Business Administration in business.


text: Cybersecurity Risk Management and Strategy The Company depends on the proper functioning, availability and security of its information systems, including financial, data processing, communications and operating systems. Several information systems are software applications provided by third parties. Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems, including attempts to gain unauthorized access to our confidential data, and other electronic security breaches. Such cybersecurity attacks can range from individual attempts to gain unauthorized access to our information technology systems to more sophisticated security threats. While we employ a number of measures to prevent, detect and mitigate these threats, there is no guarantee such efforts will be successful in preventing a cybersecurity attack. A cybersecurity attack could compromise the confidential information of our employees, tenants and vendors. A successful cybersecurity attack could disrupt and otherwise adversely affect our business operations.

companyName: Wheeler Real Estate Investment Trust, Inc.

ticker: WHLR


text: Assessment, identification and management of cybersecurity related risks are integrated into our overall risk management process. Cybersecurity related risks are included in the risk universe we evaluate to assess top risks to the Company at least annually. To the extent our processes identify a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion.


text: Cybersecurity Governance Our Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity risk strategy and governance and of other information technology risks to the Audit Committee of the Board of Directors (the "Audit Committee"). The Audit Committee reports to the full Board of Directors regarding its activities, including those related to cybersecurity. Senior management, including the Company's CEO, CFO, and General Counsel, is responsible for assessing and managing cybersecurity risk, and provides briefings regarding the assessment and management of such risk to the Audit Committee, which then reports, as necessary, to the Board of Directors. Although members of our senior management do not have direct cybersecurity expertise obtained through certifications, their experience managing the Company, which includes consulting and coordinating as necessary with a third party information technology expert referred to below, enables them to effectively assess and manage material risks from cybersecurity threats.


text: The Company retained an information technology expert third party company to assist in managing relevant risks. In particular, the Company outsources its information technology function and monitoring to a third party provider whereby it benefits from a professionally managed network monitoring, management, maintenance, detection and response system and a 24/7 security operations center with both onsite and remote support services. Any cybersecurity incident would be reported to the Company promptly by our third party consultant and material and potentially material incidents would be assessed by management and the Audit Committee for remediation and future prevention and detection.


text: The Company, at least annually, updates its policies or procedures that could help mitigate cybersecurity risks. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. The Company has incorporated cybersecurity coverage in its insurance policies; however, there is no assurance that the insurance the Company maintains will cover all cybersecurity breaches or that policy limits will be sufficient to cover all related losses.


text: The Company does not believe that it has experienced any cybersecurity threats or incidents that have materially affected or are reasonably likely to materially affect the Company and its business strategy, results of operations and/or financial condition.


text: Risk management and strategy We have endeavored to implement a cybersecurity program that is structured on the National Institute of Standards and Technology ("NIST") framework, ensuring a comprehensive approach to managing and mitigating material risk from cybersecurity threats. We seek to assess, identify, and manage the risk from cybersecurity threats through a strategy that includes risk assessment, policies, vulnerability management, event management and continuous monitoring of threat detection. Through these measures we aim to safeguard our company's networks and digital assets and maintain the integrity of our operations.

companyName: Vital Energy, Inc.

ticker: VTLE


text: We have a robust cybersecurity training and awareness program. We require employees and contract employees to regularly participate in information security training and use internal phishing campaigns to measure the effectiveness of the training program.


text: Recognizing the complexity and evolving nature of cybersecurity threats, Vital engages with a range of third-party service providers to evaluate and monitor our cybersecurity risk management program. These providers conduct cybersecurity assessments, penetration testing, vulnerability assessments, and threat analysis. This collaboration aims to fortify our cybersecurity program on an ongoing basis. Our information security and financial controls are audited annually by third-party auditors.


text: In the event of a breach or cybersecurity incident, we have an incident response plan that is designed to provide for action to contain the incident, mitigate the impact, and restore normal operations efficiently. We conduct periodic incident response tabletop exercises to refine and update incident response processes. We have a management-level Breach Disclosure Committee, which is a subcommittee of our Disclosure Committee and includes our Chief Technology Officer ("CTO") and Chief Information Security Officer ("CISO") that is responsible for assessing and identifying material risk from cybersecurity threats. In the event of a cybersecurity incident, the Breach Disclosure Committee is responsible for making recommendations to the General Counsel regarding the materiality of the incident based on documented guidelines for assessing risk.


text: We engage third-party vendors, assessors, consultants, auditors, and other third-party service providers. We recognize that third-party service providers introduce risk from cybersecurity threats. In an effort to mitigate these risks, we endeavor to include cybersecurity requirements in our contracts with these providers and endeavor to require third-party service providers to adhere to certain security standards and protocols.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Risks from cybersecurity threats are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Impact of risks from cybersecurity threat As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity incidents, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our operational and financial results. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Board of directors' oversight and management's role Our board of directors has primary oversight of risks from cybersecurity threats. The board of directors delegates oversight of our enterprise risk management process with respect to material risks from cybersecurity threats to the Audit Committee. The Audit Committee is responsible for reviewing and discussing with management the Company's risk from cybersecurity threats and the security of the Company's data and information technology systems, reviewing management's cybersecurity strategy, as well as the implementation of cybersecurity policies, procedures and strategies. Additionally, on a periodic basis, management reviews results from assessments of key risks with the Audit Committee and the steps taken to mitigate new risks which have been identified.


text: The CISO briefs the Audit Committee on cybersecurity matters at each quarterly meeting, and annually meets with the Audit Committee in executive session to report on cybersecurity matters. In addition, cybersecurity training on the current cybersecurity landscape and emerging threats is provided to the board of directors.


text: Our CTO and CISO meet regularly to assess current cybersecurity threats and evaluate our potential vulnerability to cybersecurity risks. The CTO and CISO also engage periodically with external and internal auditors and engage periodically with the guidance of outside threat intelligent agencies including the Cybersecurity and Infrastructure Security Agency and the Oil and Natural Gas Information Sharing and Analysis Center.


text: With oversight from the CTO, the CISO is responsible for assessing and managing cybersecurity risks. With over 30 years of IT management experience, the CISO has over 15 years experience in developing, leading and managing cybersecurity programs. The CISO holds Bachelor's degree in Management Science and Computer Systems along with a Certification in Cybersecurity Oversight through the National Association of Corporate Directors ("NACD") and the Software Engineering Institute of Carnegie Mellon University.


text: Risk management and strategy We have endeavored to implement a cybersecurity program that is structured on the National Institute of Standards and Technology ("NIST") framework, ensuring a comprehensive approach to managing and mitigating material risk from cybersecurity threats. We seek to assess, identify, and manage the risk from cybersecurity threats through a strategy that includes risk assessment, policies, vulnerability management, event management and continuous monitoring of threat detection. Through these measures we aim to safeguard the Company's networks and digital assets and maintain the integrity of our operations.


text: We have a comprehensive cybersecurity training and awareness program. We require employees and contract employees to regularly participate in information security training and use internal phishing campaigns to measure the effectiveness of the training program.


text: Recognizing the complexity and evolving nature of cybersecurity threats, Vital Energy engages with a range of third-party service providers to evaluate and monitor our cybersecurity risk management program. These providers conduct cybersecurity assessments, penetration testing, vulnerability assessments, and threat analysis. This collaboration aims to fortify our cybersecurity program on an ongoing basis. Our information security and financial controls are audited annually by third-party auditors.


text: Impact of risks from cybersecurity threat As of the date of this Report, though the Company and our service providers have experienced certain cybersecurity threats, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company or our operational and financial results. However, we acknowledge that cybersecurity threats are continually evolving, and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences to the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Risk management and strategy We have implemented and maintain various information security processes designed to identify, assess, and manage material risks from cybersecurity threats to our critical computer networks, third-party hosted services, communications systems, hardware and software, and our critical data, including intellectual property, confidential information that is proprietary, strategic or competitive in nature, client data and patient data, or, collectively, Information Systems and Data.

companyName: NeuroPace Inc

ticker: NPCE


text: Our information security function is overseen by our Privacy and Security Officer and is supported by our Director of Information Technology and Vice President, Manufacturing and Commercial Operations and Information Technology. This function helps to identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. Our information security function helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: evaluating our industry's risk profile, deploying manual and automated tools in certain environments, subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging third parties to conduct threat assessments, conducting internal and external vulnerability and threat scans and assessments of certain environments, conducting internal audits, and penetration testing of certain systems.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management and disaster recovery policies, risk assessments, data encryption and data segregation of certain data, access controls and network security controls in certain environments, physical security controls, employee training, penetration testing, systems monitoring, cybersecurity insurance and asset and vendor management programs.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our overall risk management processes. For example, our Privacy and Security Officer works with Information Technology, Legal, and other NeuroPace leadership to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business.


text: We use third-party service providers to assist us from time to time to identify, assess, and manage material risks from cybersecurity threats, including for example: professional service firms, including outside legal counsel, threat intelligence service providers, cybersecurity consultants, cybersecurity service provider, and penetration testing firms.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires for certain vendors, imposition of information security contractual obligations on certain vendors, verification of relevant industry standard security certifications for certain vendors, and other vendor management program elements. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our board of directors addresses our cybersecurity risk management as part of its general oversight function. The board of directors' audit committee is responsible for overseeing our cybersecurity risk management processes, including oversight and mitigation of risks from cybersecurity threats.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain NeuroPace management, including our Privacy and Security Officer, who has more than 20 years of experience in healthcare privacy and security, in coordination with our Director of Information Technology, who has more than 30 years of experience with information technology operations and sixteen years as a corporate privacy and security officer, as well as our Vice President, Manufacturing and Commercial Operations and Information Technology.


text: Our Privacy and Security Officer, Director of Information Technology, and NeuroPace leadership are responsible for hiring appropriate personnel, helping to integrate cybersecurity risk considerations into our overall risk management strategy, and communicating key priorities to relevant personnel. Our Privacy and Security Officer in coordination with our Director of Information Technology is responsible for approving budgets, helping prepare for cybersecurity incidents, approving cybersecurity processes, and reviewing security assessments and other security-related reports.


text: Our incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Privacy and Security Officer, Director of Information Technology, Vice President, Manufacturing and Commercial Operations and Information Technology and other designated individuals. Our Privacy and Security Officer works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: The board of directors receives periodic reports from our Privacy and Security Officer concerning significant cybersecurity threats to us and risk and the processes we have implemented to address them. The board of directors also has access to various reports, summaries or presentations related to cybersecurity threats, risk and mitigation.


text: Our information security function is overseen by our Privacy and Security Officer and is supported by our Director of Information Technology and Chief of Operations and Development, as well as our engineering operations and third-party service providers. This function helps to identify, assess, and manage our cybersecurity threats and risks, including through the use of our risk register. Our information security function helps identify and assess risks from cybersecurity threats by monitoring and evaluating our threat environment using various methods including, for example: evaluating our industry's risk profile, deploying manual and automated tools in certain environments, subscribing to reports and services that identify certain cybersecurity threats, evaluating certain threats reported to us, engaging third parties to conduct threat assessments, conducting internal and external vulnerability and threat scans and assessments of certain environments, conducting internal audits, and penetration testing of certain systems.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards, and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: incident detection and response, vulnerability management and disaster recovery policies, risk assessments, data encryption and data segregation of certain data, access controls and network security controls in certain environments, physical security controls, employee training, phishing simulation exercises, penetration testing, systems monitoring, cybersecurity insurance and asset and vendor management programs.


text: We use third-party service providers to perform a variety of functions throughout our business, such as application providers and hosting companies. We have a vendor management program to manage cybersecurity risks associated with our use of these providers. The program includes security questionnaires and risk assessments for certain vendors, vulnerability scans for certain vendors, security assessment calls with certain vendor's security personnel, imposition of information security contractual obligations on certain vendors, verification of relevant industry standard security certifications for certain vendors, and other vendor management program elements. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under the section titled "Risks related to privacy, information technology and cybersecurity" located in Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by certain NeuroPace management, including our Privacy and Security Officer, who has more than 20 years of experience in healthcare privacy and security, in coordination with our Director of Information Technology, who has more than 30 years of experience with information technology operations and seventeen years as a corporate privacy and security officer.


text: Our incident response and vulnerability management policies are designed to escalate certain cybersecurity incidents to members of management depending on the circumstances, including our Privacy and Security Officer, Director of Information Technology, Chief of Operations and Development and other designated individuals. Our Privacy and Security Officer works with our incident response team to help us mitigate and remediate cybersecurity incidents of which they are notified. In addition, our incident response and vulnerability management policies include reporting to the audit committee of the board of directors for certain cybersecurity incidents.


text: Our products involve the collection, storage and processing of customer data (including, in some cases, personal data), and may provide business critical software and analytics necessary for our customers' operations. Guidewire develops, implements, and maintains cybersecurity measures designed to safeguard our products and protect the confidentiality, integrity, and availability of our customer data and our confidential information.

companyName: Guidewire Software, Inc.

ticker: GWRE


text: Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems, information, and products. Our cybersecurity risk management program includes a cybersecurity incident response plan.


text: We maintain various internationally recognized security certifications and aim to adopt best practices from industry-leading frameworks and standards for cybersecurity and cloud computing, including, without limitation, ISO 27001 certification, SOC 2, U.S. NIST Cybersecurity Framework (CSF), and the CIS Critical Security Controls. This does not imply that we have met any particular technical standards, specifications, or requirements, only that we use these frameworks, industry best practices, and standards as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: Our cybersecurity risk management program includes: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, products, and our broader enterprise IT environment; • an enterprise-wide security team principally responsible for managing our cybersecurity risk assessment processes, implementing and maintaining our security controls, and responding to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training of our employees, including incident response personnel, product development personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers, and vendors, including, among others, vetting, periodic monitoring, and the implementation of contractual safeguards to ensure adherence to our cybersecurity standards.


text: We have not identified risks from known cybersecurity threats to date, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time, and we cannot anticipate when or the extent to which cybersecurity breaches will materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Our Board, by way of our Risk Committee, oversees management of cybersecurity and other information technology risks. The Risk Committee receives periodic reports from management on our cybersecurity risks and control structure. In addition, management updates the Risk Committee, as necessary, regarding cybersecurity incidents.


text: The Risk Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cybersecurity risk management program. Board members receive reports on cybersecurity risks from our Chief Information Security Officer ("CISO"), internal security staff and/or external experts as part of the Board's continuing education on topics that impact public companies.


text: Our management team, including our CISO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO has over 20 years of experience in the technology sector, including 18 years dedicated to information security. He has held multiple executive security roles in a large Fortune 500 company, overseeing product security, mergers and acquisitions security, marketplace security, and enterprise security. He holds a Bachelor of Science in Information Systems Management and a Masters of Business Administration.


text: Our management team will periodically receive information on our cybersecurity program designed to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include periodic briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in our information technology environment.


text: We have not identified risks from known cybersecurity threats to date, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. However, we face ongoing cybersecurity risks, including threats that might become more sophisticated and effective over time, and we cannot anticipate when or the extent to which cybersecurity incidents or breaches will materially affect the Company. Additional information on the cybersecurity risks we face is discussed in Part I, Item 1A, "Risk Factors."


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is based on principles set forth in the Secure Controls Framework (SCF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the SCF as a guide to help us identify, assess, and manage cybersecurity risks relevant to our business.

companyName: ALKAMI TECHNOLOGY, INC.

ticker: ALKT


text: Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our security controls and our response to cybersecurity incidents; • a compliance team principally responsible for managing our risk assessments, which are designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security controls; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for partners and vendors.


text: Our cybersecurity risk management program is a key component of our overall process concerning assessment and management of enterprise risk. Risks relating to cybersecurity, data privacy and other information technology risks are overseen by the Information Systems Audit Committee of the Board (the "IS Audit Committee"), and the assessment and management of other enterprise-level risks are overseen by the Audit Committee of the Board.


text: We face certain continuing and ongoing material risks from cybersecurity threats, which the SEC defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—Risks Relating to Cybersecurity or Data Privacy—A breach or other compromise of our security measures or those of third parties we rely on could result in unauthorized access to personal information about our clients' customers and other individuals and other data, or disruptions to our systems or operations, which could materially and adversely impact our reputation, business, financial condition and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the IS Audit Committee oversight of cybersecurity, data privacy and other information technology risks. The IS Audit Committee oversees management's implementation of our cybersecurity risk management program.


text: The IS Audit Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the IS Audit Committee, as necessary, regarding significant cybersecurity incidents.


text: The IS Audit Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. Our board of directors also receives briefings from our Chief Information Security Officer ("CISO") and Chief Compliance Officer ("CCO") on our cybersecurity risk management program. Directors receive presentations on cybersecurity topics from our CISO as part of the board of directors' continuing education.


text: Our management team, including our CISO and CCO, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our CISO's experience includes over 25 years of helping to build global cybersecurity programs in companies ranging from Fortune 50 to early stage entities. Our CCO, who is responsible for our technology risk management program, has over 25 years of experience building and leading risk management and compliance programs in large institutions across multiple geographies.


text: Our management team, led by our CISO and CCO, stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and external consultants engaged by us, and alerts and reports produced by security tools deployed in the information technology environment.


text: Key elements of our cybersecurity risk management program include: • a security team principally responsible for managing our security controls and our response to cybersecurity incidents; • a compliance team principally responsible for managing our risk assessments, which are designed to help identify material cybersecurity risks to our critical systems and information; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training for our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for partners and vendors.


text: We face certain continuing and ongoing material risks from cybersecurity threats, which the SEC defines as any potential unauthorized occurrence on or conducted through our information systems that may result in adverse effects on the confidentiality, integrity, or availability of our information systems or any information residing therein. See "Risk Factors—Risks Relating to Cybersecurity or Data Privacy—A breach or other compromise of our security measures or those of third parties we rely on could materially and adversely impact our reputation, business, financial condition and results of operations." Otherwise, however, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition.


text: Although our CISO resigned in January of 2025, we have elevated an internal candidate to the role of interim CISO while we search for a replacement. As designed, our CISO and CCO are members of the management team and are primarily responsible for assessing and managing our material risks from cybersecurity threats, as well as our overall cybersecurity risk management program. As designed, our CISO is responsible for supervising both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our interim CISO's experience includes over 20 years of helping to build global cybersecurity programs in various industries. Our CCO, who is responsible for our technology risk management program, has over 25 years of experience building and leading risk management and compliance programs in large institutions across multiple geographies.


text: We maintain a cyber risk management program designed to identify, assess, manage, mitigate, and respond to cybersecurity threats. Our information technology ("IT") personnel, together with third party firms, continuously work to identify, assess, and manage cybersecurity risks in alignment with cybersecurity standards, [including the National Institute of Standards and Technology (NIST) Cyber Security Framework, NIST 800-53, NIST 800-82, and International Electrotechnical Commission 62443]. Our executive management team and Board of Directors are periodically updated regarding the status of, and adjustments to, our cybersecurity program.

companyName: Smart Sand, Inc.

ticker: SND


text: To protect our technology systems from cybersecurity threats, we use various security tools that help prevent,identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors.


text: We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. In the event there is a cyber security incident, the VP of Technology and the Incident Response Team will assess the cybersecurity incident's impact as the basis for assigning a preliminary severity level. The VP of Technology is also responsible for communicating incidents to other members of management as appropriate. Were a cybersecurity incident to occur that was determined to be material by our Incident Response Team, including executive management, then our Board of Directors would be notified. Should any incidents occur that have a preliminary severity rating of high or critical, our Incident Response Team would confer with our Board of Directors to determine whether to report the cybersecurity incident in our public filings.


text: Aside from more immediate reporting of material incidents to our Board of Directors as described above, our VP of Technology provides our Board of Directors an update on cybersecurity during each of its quarterly meetings regarding the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.


text: Our VP of Technology leads all components of our IT functions. Our VP of Technology has over 29 years of experience in the IT profession, including 7 years with Smart Sand.


text: No unauthorized access to customer, vendor, supplier, joint venture, employee or our data occurred as a result of cybersecurity incidents against us that has had a material adverse effect on our business, operations, or consolidated financial condition. If our systems, or our customers' or suppliers' systems, for protecting against cybersecurity incidents prove to be insufficient, a cybersecurity incident could have a material adverse effect on our business, operations, or consolidated financial condition. See additional information about our cybersecurity risks under General Risk factors in Item1(a) Risk Factors.


text: To protect our technology systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve, and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, monitoring, and detection tools to assist us in identifying vulnerabilities in our products before they are exploited by malicious threat actors.


text: We have an Incident Response Plan that defines and documents procedures for assessing, identifying, and managing a cybersecurity incident. In the event there is a cyber security incident, the designated IT personnel and the Incident Response Team will assess the cybersecurity incident's impact as the basis for assigning a preliminary severity level. Designated IT personnel are also responsible for communicating incidents to other members of management as appropriate. Were a cybersecurity incident to occur that was determined to be material by our Incident Response Team, including executive management, then our Board of Directors would be notified. Should any incidents occur that have a preliminary severity rating of high or critical, our Incident Response Team would confer with our Board of Directors to determine whether to report the cybersecurity incident in our public filings.


text: Aside from more immediate reporting of material incidents to our Board of Directors as described above, our IT personnel regularly provide our Board of Directors an update on cybersecurity during each of its quarterly meetings regarding the effectiveness of technical and human security controls, cybersecurity training program compliance, internal and third-party cybersecurity incidents, and cybersecurity risks.


text: Our CFO leads the IT department and together with IT management they have more than 30 years of combined experience in the IT profession.


text: Risk Management and Strategy We are a global company built on the trust of our customers, employees and business partners, and one of the primary ways we maintain that trust is by respecting privacy rights and safeguarding their information. We believe security is at the center of any strong data privacy program and maintaining cyber-readiness and managing cybersecurity risk continue to be areas of critical focus for us. We have in place an enterprise risk management (ERM) program designed to identify and assess the greatest existing and emerging risks that could impact our business, including cybersecurity and data privacy risks. As a part of our ERM process, we have developed a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. We follow widely-accepted security standards to help guide our decisions and minimize cybersecurity risks. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined policies and procedures for responding to such security incidents, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement.

companyName: Capri Holdings Ltd

ticker: CPRI


text: We understand the importance of collecting, storing, using, sharing and disposing of personal information in a manner that complies with all applicable laws. We communicate our brands' data collection, use and processing practices through clear and comprehensive privacy notices. We empower our data subjects to exercise their privacy rights by contacting us through various channels, and we maintain procedures to honor their requests made pursuant to applicable laws. We continually evaluate our privacy notices, policies and procedures surrounding our handling of personal data and the measures and systems we have in place to help identify, assess, mitigate, respond to and remediate cybersecurity issues or personal data breaches.


text: The key steps we have taken to detect, identify, classify and mitigate cybersecurity and privacy risks, include: • Adopting and periodically reviewing and updating information security and privacy policies and procedures and undergoing cyber-incident table top exercises; • Using network and system security tools aimed at detecting and mitigating unauthorized system and data access and cyber threats; • Conducting targeted audits and penetration tests throughout the year, using both internal and external resources; • Utilizing threat intelligence to assess potential impacts to company systems and mitigating risks, when applicable, through preventive measures including updates and patching; • Conducting cyber-maturity evaluations, including engaging an industry-leading, nationally-known third party to independently evaluate our information security maturity on a periodic basis; • Assessing cybersecurity risk profiles of our third-party service providers, including by partnering with key providers to ensure they have appropriate security measures to safeguard their information technology systems and including robust data security provisions in our contracts with third parties that handle our data; • Providing annual security and privacy training and awareness to our employees to educate our employees on cybersecurity risks; and • Conducting periodic phishing simulations to test our employees' responses to suspicious emails and to inform targeted cyber awareness training.


text: Despite our efforts and the efforts of our third-party service providers to secure our and their IT systems, cybersecurity attacks and incidents have occurred in the past, and may continue to occur in the future. For additional information regarding the risks we face from cybersecurity and privacy incidents, see Item 1A "Risk Factors—Risks Related to Information Technology and Data Security—Privacy breaches and other cyber security risks related to our business could negatively affect our reputation, credibility and business."


text: Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management's overall approach to risk management. On at least an annual basis, as part of our ERM process, the Board reviews the Company's major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks. The Board is informed of these risks through regular reports from our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer (CFO), General Counsel and Chief Sustainability Officer, and other key members of senior management. Although the Board as a whole is ultimately responsible for risk oversight, the Board uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary responsibility for operation of the ERM program and risk management, business continuity planning and information systems infrastructure and cybersecurity risk. As a result, the Chair of the Audit Committee also provides periodic updates to the full Board on these matters as part of its committee reports.


text: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from either our Chief Information Officer (CIO) or our head of Global Cybersecurity and Compliance (Head of Cybersecurity), who reports to our CIO, and who oversees a global team responsible for our cybersecurity infrastructure. These reports cover various cybersecurity and information technology matters, including material risks and threat trends, mitigation strategies, security incidents, the status of information technology and cybersecurity priorities and initiatives and other related matters of importance. The Audit Committee provides periodic updates on these topics to the full Board as necessary. In addition to the above, the Audit Committee, typically in the presence of the full Board, will review the results of the independent cyber-maturity evaluations described above, and from time to time participates in table top exercises or other cybersecurity training programs.


text: Our Head of Cybersecurity is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. As a result, in addition to the regular updates referenced above, the Audit Committee and the full Board of Directors would also be promptly informed by the CFO and General Counsel of cybersecurity incidents in accordance with our security incident response procedures, as well as provided ongoing updates from lead members of the incident response teams, including the Head of Cybersecurity, regarding any such incidents in accordance with our incident response plan.


text: Our Head of Cybersecurity has over 15 years of experience managing and leading information technology and cybersecurity teams. Subsequent to the end of our fiscal year, our CIO left the Company and, in the interim, our Head of Cybersecurity currently reports to our CFO who reports to our Chief Executive Officer.


text: Risk Management and Strategy We are a global company built on the trust of our customers, employees and business partners, and one of the primary ways we maintain that trust is by respecting privacy rights and safeguarding their information. We believe security is at the center of any strong data privacy program and maintaining cyber-readiness and managing cybersecurity risk continue to be areas of critical focus for us. We have in place a group-wide risk management process designed to identify and assess the greatest existing and emerging risks that could impact our business, including cybersecurity and data privacy risks. As a part of our risk assessment process, we have developed a cybersecurity program designed to detect, identify, classify and mitigate cybersecurity and other data security threats. We follow widely-accepted security standards to help guide our decisions and minimize cybersecurity risks. In the event we identify a potential cybersecurity, privacy or other data security issue, we have defined policies and procedures for responding to such security incidents, including procedures that address when and how to engage with Company management, our Board of Directors, other stakeholders and law enforcement.


text: Despite our efforts and the efforts of our third-party service providers to secure our and their IT systems, cybersecurity attacks and incidents have occurred in the past, and may continue to occur in the future. For additional information regarding the risks we face from cybersecurity and privacy incidents, see Item 1A Risk Factors - "Risks Related to Information Technology and Data Security."


text: Management is responsible for understanding and managing the risks that we face in our business, including relating to cybersecurity, and the Board of Directors is responsible for overseeing management's overall approach to risk management. On at least an annual basis, as part of our risk assessment process, the Board reviews the Company's major risks, including risks related to cybersecurity and global information systems, along with potential options for mitigating these risks. The Board is informed of these risks through regular reports from our Chief Executive Officer, Chief Financial Officer and Chief Operating Officer (CFO), General Counsel and Chief Sustainability Officer, and other key members of senior management. Although the Board as a whole is ultimately responsible for risk oversight, the Board uses its committees to assist in its risk oversight function. The Audit Committee of our Board of Directors has primary oversight of management's enterprise risk assessment and risk management policies and practices, business continuity planning and information systems infrastructure and cybersecurity risk. As a result, the Chair of the Audit Committee also provides periodic updates to the full Board on these matters as part of its committee reports.


text: The Audit Committee generally receives quarterly cybersecurity and information systems infrastructure reports from our head of Global Cybersecurity and Compliance (Head of Cybersecurity), who oversees a global team responsible for our cybersecurity infrastructure. These reports cover various cybersecurity and information technology matters, including material risks and threat trends, mitigation strategies, security incidents, the status of information technology and cybersecurity priorities and initiatives and other related matters of importance. The Audit Committee provides periodic updates on these topics to the full Board as necessary. In addition to the above, the Audit Committee, typically in the presence of the full Board, will review the results of the independent cyber-maturity evaluations described above, and from time to time participates in table top exercises or other cybersecurity training programs.


text: Our Head of Cybersecurity has over 15 years of experience managing and leading information technology and cybersecurity teams. Our Head of Cybersecurity reports to our CFO who reports to our Chief Executive Officer.


text: Risk Management and Strategy As part of our overall risk management system we maintain comprehensive policies and processes for assessing, identifying and managing material risks from cybersecurity threats, including risks relating to production, safety, reputation, intellectual property, procurement and business continuity. Cybersecurity risk management is included as part of our overall annual Enterprise Risk Management program. As part of this program, our enterprise risk professionals consult with internal cybersecurity subject matter experts to identify cyber risks and evaluate their severity and the efficacy of our mitigation efforts, with the results being reported to the executive leadership team and the Board of Directors.

companyName: Tronox Holdings plc

ticker: TROX