text: We regularly assess and test our cybersecurity policies, standards, processes and practices. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, threat modeling, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. We regularly engage recognized third-party experts to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. We adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Our Board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks from cybersecurity threats. The Board and the Audit Committee receive regular presentations and reports on cybersecurity risks from our CISO, which address a wide range of topics including recent developments, evolving standards, security effectiveness, vulnerability assessments, third-party and independent reviews, the threat environment, incident response planning, remediation efforts, employee training and awareness (including the results of our annual cybersecurity training), technological trends and information security considerations arising with respect to our peers and third parties. On a quarterly basis, our Audit Committee discusses our approach to cybersecurity risk management with our CISO and other members of management, including planned initiatives to help the Board evaluate the effectiveness of our cybersecurity program. One of our independent directors, Ms. Hammoud, a seasoned software executive, participates in Audit Committee meetings during cybersecurity sessions and provides direct guidance to our CISO outside of regularly scheduled Board meetings on cybersecurity matters.

companyName: PROS Holdings, Inc.

secItem: Item 1C


text: Our CISO, in coordination with our Executive Steering Committee, including our CEO, our Chief Financial Officer ("CFO"), our Executive Vice President, Engineering, our Director of IT and our General Counsel, works collaboratively across the Company to implement a program intended to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with our incident response and recovery plans. To facilitate the success of our cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to provide governance over cybersecurity issues, address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, our CISO and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time and report such threats and incidents to the Audit Committee, and in certain incidents to the Board, when appropriate.


text: Our CISO has served in various roles in risk management and enterprise and cybersecurity for over 20 years, including serving as Deputy CISO at a global cybersecurity software company. Our CISO has attained numerous professional certifications, including Certified Information Systems Security Professional, Certified in Risk and Information Systems Control, Certified Information Security Manager, Certified Information Systems Auditor, and GIAC Security Operations Manager. Our CEO, who has decades of software engineering experience, has served as our CEO and as a member of our Board for thirteen years, during which time he has overseen our ERM program, including risks arising from cybersecurity threats. Our CFO and General Counsel each have more than 20 years of experience managing risks, including both at the Company and with other public companies. The other members of our Executive Steering Committee are all experienced leaders in their respective areas of management with extensive SaaS operational experience.


text: In 2023, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, cash flows, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: Our Board recognizes the critical importance of maintaining the trust and confidence of our customers, business partners and employees. Our Board is actively involved in oversight of our risk management program, and cybersecurity represents an important component of our overall approach to enterprise risk management ("ERM"). Our cybersecurity policies, standards, processes and practices are integrated into our ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology, the International Organization for Standardization and other applicable industry standards. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and responding to Cybersecurity Events when they occur.


text: Risk Management and Strategy As a critical element of our overall ERM approach, our cybersecurity program is focused on the following key areas:


text: Governance. As discussed in more detail under the heading "Governance" below, our Board and management devote significant time to cybersecurity risk oversight. The Board annually reviews our overall cybersecurity risk profile to help ensure that sensitive data remains secure in an ever-changing threat landscape, including risk preparedness and mitigation strategies. This assessment considers a range of factors, including our business objectives, the threat landscape, industry trends and regulatory requirements. The Audit Committee of the Board ("Audit Committee") oversees our cybersecurity risk management and regularly meets, not less than quarterly, with our Chief Information Security Officer ("CISO") and other members of management, including those with significant roles in our cybersecurity efforts. Our Executive Steering Committee, described below, provides senior management oversight to our cybersecurity program.


text: Collaboration. We take a cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents, and implement controls and procedures designed to promptly escalate certain Cybersecurity Events to help ensure timely review, disclosure and reporting of such incidents.


text: Technical Safeguards. We deploy technical safeguards designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which we evaluate and improve through vulnerability assessments and cybersecurity threat intelligence.


text: Incident Response and Recovery Planning. We established and maintain incident response and recovery plans that address our response to a Cybersecurity Event, and test and evaluate such plans on a regular basis.


text: Third-Party Risk Management. We maintain a risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as third-party systems that could adversely impact our business in the event of a Cybersecurity Event affecting those systems.


text: Education and Awareness. We provide regular, mandatory training for our employees regarding cybersecurity threats and our security policies to equip our employees with tools to address cybersecurity threats, and to communicate our evolving information security policies, standards, processes and practices.


text: Our Board, in coordination with the Audit Committee, oversees our ERM process, including the management of risks from cybersecurity threats. The Board and the Audit Committee receive regular presentations and reports on cybersecurity risks from our CISO, which can include a wide range of topics such as recent developments, evolving standards, security effectiveness, vulnerability assessments, third-party and independent reviews, the current and evolving threat environment, incident response planning, remediation efforts, employee training and awareness (such as the results of our annual cybersecurity training), technological trends and information security considerations arising with respect to our peers and third parties. On a quarterly basis, our Audit Committee discusses our approach to cybersecurity risk management with our CISO and other members of management, including planned initiatives to help the Board evaluate the effectiveness of our cybersecurity program. One of our independent directors, Ms. Hammoud, a seasoned software executive, is a member of the Audit Committee and also provides direct guidance on cybersecurity matters to our CISO outside of regularly scheduled Audit Committee and Board meetings.


text: Our CISO, in coordination with our Executive Steering Committee, which includes our CEO, our Chief Financial Officer ("CFO"), our Executive Vice President, Engineering, our Senior Director, IT and our General Counsel, works collaboratively across the Company to implement a cybersecurity risk management program intended to protect our information systems from cybersecurity threats and to promptly respond to any Cybersecurity Events in accordance with our incident response and recovery plans. As part of that program, multidisciplinary teams across the Company (both standing, regular teams and special teams as needed) are deployed to provide governance over cybersecurity issues, address cybersecurity threats and to respond to Cybersecurity Events. Through ongoing communications with these teams, our CISO and management monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents and report such threats and incidents to the Audit Committee, and in certain incidents to the Board, when appropriate.


text: Our CISO has served in various roles in risk management and enterprise and cybersecurity for over 20 years, including serving as Deputy CISO at a global cybersecurity software company. Our CISO has attained numerous professional certifications, including Certified Information Systems Security Professional, Certified in Risk and Information Systems Control, Certified Information Security Manager, Certified Information Systems Auditor, and GIAC Security Operations Manager. Our CEO, who has decades of software engineering experience, has served as our CEO and as a member of our Board for fourteen years, during which time he has overseen our ERM program, including risks arising from cybersecurity threats. Our CFO and General Counsel each have more than 20 years of experience managing risks, including both at the Company and with other public companies. The other members of our Executive Steering Committee are all experienced leaders in their respective areas of management with extensive SaaS operational experience.


text: In 2024, we did not identify any cybersecurity threats that materially affected or are reasonably likely to materially affect our business strategy, results of operations, cash flows or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, nor provide assurances that we have not experienced undetected Cybersecurity Events. For additional information about these risks, see Part I, Item 1A, "Risk Factors" in this Annual Report on Form 10-K.


text: We recognize the critical importance of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data.

companyName: VEEVA SYSTEMS INC

ticker: VEEV


text: Our Board of Directors formed a Cybersecurity Committee to exercise oversight over our cybersecurity and privacy programs and controls for our products and our internal-use information technology. The Cybersecurity Committee is chaired by a director with cybersecurity expertise and board and executive experience at large technology companies. The Cybersecurity Committee receives reports from management on a regular basis on a range of topics, including the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives, incident reports from cybersecurity events, and compliance with regulatory requirements and industry standards.


text: Our day-to-day cybersecurity and technology risk management efforts, including oversight of our information security management system, are led by our EVP of Internal Operations, a member of our executive leadership team with over three decades of experience in the field, whose cybersecurity experience includes serving as our Chief Information Officer and in executive roles at other companies leading security, operations, audit, and compliance teams. Our Chief Information Security Officer (CISO), who has over two decades of experience in cybersecurity, reports to the EVP of Internal Operations and oversees our security team. Our CISO's cybersecurity experience includes serving as an enterprise architect and network security architect at a Fortune 25 public retail company.


text: Cybersecurity risk management is integrated into our broader risk management framework. We have a security points of contact program, which embeds security experts into product development teams. In addition, a security council, chaired by our CISO, meets monthly to discuss the security program, security incidents, and ongoing program objectives. The council is comprised of senior leaders in product development, operations, security, quality, and services, and helps ensure that security remains a top priority across the enterprise.


text: Information Security Management System We maintain a comprehensive Information Security Management System (ISMS) that is designed to ensure the confidentiality, integrity, and availability of customer data, corporate data (such as intellectual property or source code), employee data, and our systems. Our ISMS is founded on the following industry-leading and regulatory standards: • ISO 9001:2015 – Quality Management Systems • ISO/IEC 27001:2013 – Information Security Management • SOC2 Type II – System and Organization Controls • SEI Capability Maturity Model Integration (v1.3) • IT Infrastructure Library (ITIL) version 3 • ICH Q9 – Quality Risk Management We have achieved ISO 27001 certification for our ISMS, which is managed by our CISO. As a data processor, we are the custodian of customer information that can be both confidential and sensitive. We are also certified to ISO 27018 for privacy controls.


text: Critical elements of our ISMS include: • Operational measures to monitor and respond to data breaches and cyber attacks. We have application, database, network, and resource monitoring in place that are designated to identify vulnerabilities and protect our applications. Our personnel are trained to promptly report any security incident and any such incident is addressed by our Security Incident Management Policy, which includes a formal incident response process. We also provide a trust site that displays upcoming maintenance downtimes, data center incidents, and relevant security communications. • Vulnerability and penetration testing. Our solutions undergo internal vulnerability testing prior to release. We have built our own internal penetration testing systems and we conduct vulnerability assessments on our software using automated and manual methods, at least annually. In addition, we commission annual vulnerability and penetration testing of our systems by industry-recognized, third-party security specialists. • Training. We require role-based security and security awareness training. All employees receive annual training on our Code of Conduct and our Acceptable Use Policy, which establishes our commitment to protecting the confidential and proprietary information of our customers and partners. In addition, all new hires and contractors must undergo information security awareness training. Subsequent security awareness training is required annually for all active employees and contractors. Employees in certain roles (e.g., customer support representatives, developers, and hiring managers) receive more extensive data security training annually. • Disaster recovery and business continuity. Our solutions are designed to help avoid single points of failure to reduce the chance of business disruption from security breaches, incidents, and other disruptions of systems. We maintain formally documented recovery processes that may be activated in the event of a significant business disruption of our corporate IT infrastructure or the production infrastructure that processes our customer data. We conduct testing, at least annually, to verify the validity of the recovery processes and provide reports on the test results for production infrastructure that processes our customer data to customers via access to a customer portal.


text: Process for Identifying Material Cybersecurity Incidents Potentially material cybersecurity incidents are escalated according to our Security Incident Management Policy to a management response team comprising our EVP of Internal Operations, Chief Financial Officer, Chief Accounting Officer, General Counsel, Chief Privacy Officer, and Associate General Counsel (Corporate). Our Security Incident Management Policy is designed to inform the management response team about, and monitor, the prevention, detection, mitigation, and remediation of cybersecurity incidents. The management response team is responsible for timely determining materiality and overseeing the appropriate reporting of certain cybersecurity incidents.


text: Cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats that we face, and regarding our likelihood of being materially affected by risks from cybersecurity threats, please see item 1A, "Risk Factors."


text: Supplier Management Program Through our Supplier Management Program, we maintain procedures that specify requirements for the assessment of suppliers and contractors who provide services that may impact our product and process quality. These procedures allow us to identify risks from potential cybersecurity incidents associated with our use of products and services from these suppliers and ensure that there is an appropriate level of oversight of our vendors' quality systems. We perform initial audits and then periodic, risk-based audits on our suppliers to ensure their products and services conform to our established quality standards.


text: Our board of directors formed a Cybersecurity Committee to exercise oversight over our cybersecurity and privacy programs and controls for our products and our internal-use information technology. The Cybersecurity Committee is chaired by a director with cybersecurity expertise and board and executive experience at large technology companies. The Cybersecurity Committee receives reports from management on a regular basis on a range of topics, including the current cybersecurity landscape and emerging threats, the status of ongoing cybersecurity initiatives, incident reports from cybersecurity and privacy events, data privacy policies and procedures, and compliance with regulatory requirements and industry standards.


text: Our day-to-day cybersecurity and technology risk management efforts, including oversight of our information security management system, are led by our EVP of Internal Operations, a member of our executive leadership team with over three decades of experience in the field, whose cybersecurity experience includes serving as our Chief Information Officer and in executive roles at other companies leading security, operations, audit, and compliance teams. Our Chief Information Security Officer (CISO), who has over two decades of experience in cybersecurity, including over five years at Veeva, reports to the EVP of Internal Operations and oversees our security team. Our CISO's cybersecurity experience includes serving as a security architect and Director of Security Engineering at Veeva, and overseeing security, automation, and performance testing for other technology companies.


text: Cybersecurity risk management is integrated into our broader risk management framework. We have a security points of contact program, which embeds security experts into product development, services, and IT teams. In addition, a security council, chaired by our CISO, meets monthly to discuss the security program, security incidents, and ongoing program objectives. The council is comprised of senior leaders in product development, operations, security, quality, and services, and helps ensure that security remains a top priority across the enterprise.


text: Critical elements of our ISMS include: • Operational measures to monitor and respond to data breaches and cyberattacks. We have application, database, network, and resource monitoring in place that are designated to identify vulnerabilities, protect our applications, and alert incident response personnel. Security incidents are addressed by our Security Incident Management Policy, which includes a formal incident response process. We also provide a trust site that displays upcoming maintenance downtimes, data center incidents, and relevant security communications. • Preventative measures to hinder or limit cyberattacks. We procure, develop, deploy, and maintain preventative solutions and follow preventative practices for our corporate IT and product engineering infrastructures, as well as the production infrastructure that processes our customer data. These solutions and practices include identity and access management, separation of duties, secure software development, network and data security, and system hardening. • Vulnerability and penetration testing. We commission annual vulnerability and penetration testing of certain systems by industry-recognized, third-party security specialists. In addition, our software products undergo internal vulnerability testing using automated and manual methods prior to general availability. • Training. We require role-based security and security awareness training. All employees receive annual training on our Code of Conduct and our Acceptable Use Policy, which establishes our commitment to protecting the confidential and proprietary information of our customers and partners. In addition, all new hires and contractors must undergo information security awareness training. Subsequent security awareness training is required annually for all active employees and contractors. Employees are trained to promptly report security incidents. Employees in certain roles (e.g., customer support representatives, developers, and hiring managers) receive more extensive data and application security training annually. • Disaster recovery and business continuity. Our solutions are designed to help avoid single points of failure to reduce the chance of business disruption from security breaches, incidents, and other disruptions of systems. We maintain formally documented recovery processes that may be activated in the event of a significant business disruption of our corporate IT infrastructure or the production infrastructure that processes our customer data. We conduct testing, at least annually, to verify the validity of the recovery processes and provide reports on the test results for production infrastructure that processes our customer data to customers via access to a customer portal.


text: Cybersecurity risks, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect our business strategy, results of operations, or financial condition. For additional information regarding risks from cybersecurity threats that we face, and regarding our likelihood of being materially affected by risks from cybersecurity threats, please see Item 1A, "Risk Factors".


text: Public Storage devotes significant resources to protecting and continuing to improve the security of its computer systems, software, networks, and other technology assets. Our security efforts are designed to preserve the confidentiality, integrity, and continued availability of information owned by, or in the care of, the Company and protect against, among other things, cybersecurity attacks by unauthorized parties attempting to obtain access to confidential information, destroy data, disrupt or degrade service, sabotage systems, or cause other damage.

companyName: Public Storage

ticker: PSA


text: Management and Board Oversight Our risk management processes include a comprehensive enterprise risk management framework focused on (i) evaluating the risks facing the Company and aligning the Company's efforts to mitigate those risks with its strategy and risk appetite; (ii) communicating and improving the Company's understanding of its key risks and responsive actions; and (iii) providing the Board with a defined, rated risk inventory and framework against which the Board can direct its responsibilities to oversee the Company's risk assessment and risk management efforts. Our cybersecurity program is a key component of our overall enterprise risk management framework.


text: A dedicated team of technology professionals monitors and manages cybersecurity risks. They are led by our Chief Technology Officer (CTO), who has served in senior leadership positions with responsibility for cybersecurity and IT risk management for over 10 years, and our Vice President, Management Information Systems (VPMIS), who has been a Certified Information Systems Security Professional (CISSP) since 2016. Their teams are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. Our CTO and VPMIS regularly engage with our Chief Administrative Officer. They also report monthly on cybersecurity matters to our entire executive management team.


text: In the event of an incident that jeopardizes the confidentiality, integrity, or availability of the information technology systems we use, we utilize a regularly updated information security incident response plan (IRP). The IRP is overseen by our executive Incident Response Committee (IRC), which consists of our Chief Financial and Investment Officer, Chief Administrative Officer, Chief Legal Officer, and CTO. The IRP guides our internal response to cybersecurity incidents. Pursuant to our IRP and its escalation protocols, designated personnel are responsible for assessing the severity of the incident and associated threat, containing the threat, remediating the threat, including recovery of data and access to systems, analyzing the reporting obligations associated with the incident, and performing post-incident analysis and program improvements. While the particular personnel assigned to an incident response team will depend on the particular facts and circumstances, the response team is generally led by the IRC with support from internal personnel and external counsel or other experts.


text: Our Board considers cybersecurity risk one of the most significant risks to our business. The Board has delegated to the Audit Committee oversight of cybersecurity, data privacy, and other information technology risks affecting the Company. The Audit Committee periodically evaluates our cybersecurity strategy to ensure its effectiveness. Our CTO and VPMIS provide quarterly reports to the Audit Committee, which also provides quarterly reports on its activities to the Board. Annually, the Board receives a comprehensive update regarding the Company's cybersecurity efforts, which may include a cybersecurity tabletop exercise, presentation by third party cybersecurity experts, or similar events. Several members of our Board and Audit Committee have cybersecurity, data privacy, or related experience from their principal occupation or other professional experience.


text: Processes for Assessing, Identifying and Managing Material Risks from Cybersecurity Threats Our cybersecurity program focuses on (i) preventing and preparing for cybersecurity incidents, (ii) detecting and analyzing cybersecurity incidents, and (iii) containing, eradicating, recovering from, and reporting cybersecurity events.


text: Prevention and Preparation We identify and address information security risks by employing a defense-in-depth methodology, consisting of both proactive and reactive elements, which provides multiple, redundant defensive measures and prescribes actions to take in case a security control fails or a vulnerability is exploited. We leverage internal resources, along with strategic external partnerships, to mitigate cybersecurity threats to the Company. We have partnerships for security operations center (SOC) services, penetration testing, incident response, and various third-party assessments. We deploy both commercially available solutions and proprietary systems to actively manage threats to our information technology environment.


text: We assess our cybersecurity program against various frameworks. Our information security program is certified for compliance with the Payment Card Industry Data Security Standard for the safe handling and protection of credit card data. Annually, we are assessed, either internally or by an independent third party, against the National Institute of Standards and Technology (NIST) Cybersecurity Framework. We also utilize reports prepared by our external partners to assess our cyber proficiency on a standalone basis and comparatively against peers and other companies, and we regularly engage external resources regarding emerging threats. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including contractual mechanisms, as well as the regular review of SOC reports, relevant cyber attestations, and other independent cyber ratings.


text: We employ a robust information security and training program for our employees, including mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to imitate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.


text: As discussed above, we maintain an IRP that guides our response to a cybersecurity incident. Annually, we test the IRP's response procedures, including through disaster response and business continuity plan exercises. These exercises are intended to challenge and validate our information security response and resources through simulated cybersecurity incidents, including engagement of outside cybersecurity legal counsel, other third-party partners, key internal personnel, executive management, and our Board.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, notification from external parties (e.g., our third-party information technology provider), and proactive threat hunting in conjunction with our external partners. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the IRP follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event (e.g. ransomware or personal data breach) and assessing the severity of the event and sensitivity of any compromised data.


text: Containment, Eradication, Recovery, and Reporting In the event of a cybersecurity incident, our first priority is to contain the cybersecurity incident as quickly as possible consistent with the procedures in our IRP.


text: Once a cybersecurity incident is contained, our focus shifts to remediation and recovery. These activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions, validation of files or data that may have been affected, increased network monitoring or logging to identify recurring attacks, monitoring dark or deep web forums, reconfiguring administrative account access, hardening network security such as firewall configurations, and employee re-training. We also maintain cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Our IRP provides clear communication protocols, including with respect to members of executive management, internal and external counsel, the Audit Committee and our Board. These protocols include a framework for assessing our SEC and other regulatory reporting obligations related to a cybersecurity incident.


text: Following the conclusion of an incident, the incident response team will generally assess the effectiveness of the cybersecurity program and IRP and make adjustments as appropriate.


text: Cybersecurity Risks As of December 31, 2023, we are not aware of any material cybersecurity incidents in the last three years. However, we routinely face risks of potential incidents, whether through cyber-attacks or cyber intrusions over the Internet, ransomware and other forms of malware, computer viruses, attachment to emails, phishing attempts, extortion or other scams that we have been able to prevent or sufficiently mitigate harm from. Although we make efforts to maintain the security and integrity of the third-party networks and systems we use, these systems and the proprietary, confidential and personal information that resides on or is transmitted through them, are subject to the risk of a security incident or disruption, and there can be no assurance that our security efforts and measures, and those of our third-party providers. See "Item 1A–Risk Factors–If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our reputation and business relationships could be damaged, which could adversely affect our financial condition and operating results."


text: A dedicated team of technology professionals monitors and manages cybersecurity risks. They are led by our Chief Technology Officer (CTO), who has significant experience in senior leadership positions with responsibility for cybersecurity and IT risk management, and our Chief Information Security Officer (CISO), who is a Certified Information Systems Security Professional (CISSP). Their teams are responsible for leading enterprise-wide cyber resilience strategy, policy, standards, architecture, and processes. Our CTO and CISO regularly engage with our Chief Administrative Officer. They also report monthly on cybersecurity matters to our entire executive management team.


text: Our Board considers cybersecurity risk one of the most significant risks to our business. The Board has delegated to the Audit Committee oversight of cybersecurity, data privacy, and other information technology risks affecting the Company. Our CTO and CISO typically provide quarterly reports to the Audit Committee, which also provides quarterly reports on its activities to the Board. Annually, the Board receives a comprehensive update regarding the Company's cybersecurity efforts, which may include a cybersecurity tabletop exercise, presentation by third party cybersecurity experts, or similar events. Several members of our Board and Audit Committee have cybersecurity, data privacy, or related experience from their principal occupation or other professional experience.


text: We assess our cybersecurity program against various frameworks. Our information security program is certified for compliance with the Payment Card Industry Data Security Standard for the safe handling and protection of credit card data. Annually, we are assessed, either internally or by an independent third party, against the National Institute of Standards and Technology (NIST) 800-53 Moderate Baseline. We also utilize reports prepared by our external partners to assess our cyber proficiency on a standalone basis and comparatively against peers and other companies, and we regularly engage external resources regarding emerging threats. We have policies and procedures to oversee and identify the cybersecurity risks associated with our use of third-party service providers, including contractual mechanisms, as well as the regular review of SOC reports, relevant cyber attestations, and other independent cyber ratings.


text: We employ an information security and training program for our employees, including annual mandatory computer-based training, regular internal communications, and ongoing end-user testing to measure the effectiveness of our information security program. As part of this commitment, we require our employees to complete a Cybersecurity Awareness eCourse and acknowledge our Information Security policy each year. In addition, we have an established schedule and process for regular phishing awareness campaigns that are designed to imitate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.


text: As discussed above, we maintain an IRP that guides our response to a cybersecurity incident. Annually, we test the IRP's response procedures, including thorough disaster response and business continuity plan exercises. These exercises are intended to challenge and validate our information security response and resources through simulated cybersecurity incidents, including engagement of outside cybersecurity legal counsel, other third-party partners, key internal personnel, executive management, and our Board.


text: Detection and Analysis Cybersecurity incidents may be detected through a variety of means, which may include, but are not limited to, automated event-detection notifications, employee notifications, notification from external parties (e.g., our third-party information technology provider), and proactive threat hunting in conjunction with our external partners. Once a potential cybersecurity incident is identified, including a third-party cybersecurity event, the incident response team designated pursuant to the IRP follows the procedures set forth in the plan to investigate the potential incident, including determining the nature of the event.


text: Containment, Eradication, Recovery, and Reporting Our IRP sets forth the procedures we follow in responding to a cybersecurity incidents. Once a cybersecurity incident is contained, our focus shifts to remediation and recovery. These activities depend on the nature of the cybersecurity incident and may include rebuilding systems and/or hosts, replacing compromised files with clean versions and validation of files or data that may have been affected. We also maintain cybersecurity insurance providing coverage for certain costs related to security failures and specified cybersecurity-related incidents that interrupt our network or networks of our vendors, in all cases up to specified limits and subject to certain exclusions.


text: Cybersecurity Risks As of December 31, 2024, we have not had any known instances of material cybersecurity incidents, including known third-party provider incidents. However, there can be no assurance that our security efforts and measures, and those of our third-party providers, will be effective or that attempted security incidents or disruptions would not be successful or damaging. See "Item 1A–Risk Factors–If our confidential information is compromised or corrupted, including as a result of a cybersecurity incident, our reputation and business relationships could be damaged, which could adversely affect our financial condition and operating results."


text: Risk Assessment and Management Our Information Security Program is led by our CISO and overseen by our TIRC. The program is designed to safeguard the confidentiality, integrity and availability of information assets by monitoring the cyber threat landscape, internal threats and technological changes and through the development of controls to mitigate risk to the organization and our customers.

companyName: Discover Financial Services


text: Our Enterprise Risk Management governance structure is based on the principle that each line of business is responsible for managing risks, including information security risk, inherent in its business.


text: Our Information Risk Management ("IRM") department provides second line defense oversight of the Information Security Program in support of senior management and the Board of Directors' responsibility to provide appropriate risk oversight. Owned by the VP, Information Security and Technology Risk ("VP-ISTR") in IRM, the Information Security Policy provides a framework for the security of information assets and computer resources and is consistent with our five principles that guide the Company's approach to risk management: Comprehensiveness, Accountability, Independence, Defined Risk Appetite and Transparency. The Information Security Policy is designed to comply with applicable laws and regulations, such as the GLBA and the Sarbanes-Oxley Act.


text: Our enterprise-wide incident management framework addresses risk mitigation activities that stem from incidents including governance structure and organization; risk, incident management and escalation principles; requirements for testing and assessing our processes; and external reporting guidance. We conduct internal assessments and engage external assessors, consultants and auditors to help provide assurance and validation of our security controls, as well as alignment to industry norms.


text: We are also committed to strong third party risk management. Our Third Party Program provides regulatory guidance for managing third party risk and is designed to assist us with the identification, measurement, management, monitoring and reporting of third party risk.


text: Our Information Security Program requires that employees adhere to our Third Party Information Security Policy, as well as the Third Party Risk Management Policy, which requires review of third-party controls to determine whether such controls meet the objectives of our Third Party Information Security Policy. The IRM team is responsible for seeing that appropriate information security risks are identified and monitored. We rely on many third-party service providers and network participants, including merchants, and, as such, a security breach or cyber attack affecting one of these third parties could impact us.


text: Incident Management While we continue to invest in our information security defenses, including cybersecurity defenses, if our security systems or those of third parties are penetrated or circumvented such that the confidentiality, integrity or availability of information about us, our customers, transactions processed on our networks or on third-party networks on our behalf, or third parties with which we do business is compromised, we could be subject to significant liability that may not be covered by insurance, including significant legal and financial exposure, actions by our regulators, damage to our reputation or loss of confidence in the security of our systems, products and services that could materially adversely affect our business. For more information about the risks posed by cybersecurity threats, see "Risk Factors — Operational and Other Risk — If the security of our systems, or the systems of third parties we rely upon, is compromised, our business could be disrupted and we may be subject to significant financial exposure, liability and damage to our reputation."


text: Board of Directors Oversight Our Risk Oversight Committee and Audit Committee are responsible for reviewing and approving our Information Security Program, as well as reviewing the quality and effectiveness of our technology security. These committees are also responsible for reviewing the guidelines and policies for assessing and managing our exposure to risks, including cybersecurity risk, and the steps management takes to monitor and control such exposures. The Risk Oversight Committee and Audit Committee periodically meet to facilitate oversight of risk management matters, including cybersecurity risk. For example, at least five times per year, the committees receive updates from the CISO and VP-ISTR on our Information Security Program.


text: The Board of Directors regularly devotes time during its meetings to review and discuss the most significant risks facing us over the short-, medium- and long-term, and our responses to those risks, including cybersecurity risks. Within these discussions, the Board of Directors receives updates from senior executives including the CRO and, on an annual basis, the CISO on the risks posed by cybersecurity threats and our information security program. Additionally, the CISO provides annual Information Security training to the Board of Directors. The training covers the regulatory landscape, risk management practices, cyber landscape and threats to us and the roles and responsibilities of management and board members.


text: Management Oversight Our Information Security Program is led by our CISO, who reports to our CIO, and overseen by the TIRC, which serves as a sub-committee to the Management Risk Committee. The TIRC provides oversight, leadership and direction for data risks, technology risks and information security. Our CISO leads the Information Security organization and has the overall responsibility of implementing its strategy and objectives to build a strong cyber engineering function. Reporting to the CISO is the Security Intelligence Incident Response Team, which is responsible for managing cybersecurity incidents by leading, designing and implementing threat intelligence, continuous monitoring and rapid response services.


text: Our CISO has over 20 years of information technology experience with specialization in information security and risk management. Our CISO is a Certified Information Systems Security Professional, Certified Ethical Hacker, a graduate of the Department of Defense Executive Leadership Development Program, a fellow with the American Council of Technology and an adjunct professor at Carnegie Mellon University. He was formerly the CISO at other large financial institutions and a federal agency prior to joining Discover.


text: Risk Assessment and Management Our Information Security Program is led by our CISO and overseen by our TIRC and Management Risk Committee. The program is designed to safeguard the confidentiality, integrity and availability of information assets of the Company, customers and users from harm, and against unauthorized access to, or use of, computer resources that process, store or transmit these assets. This is accomplished by monitoring the cyber threat landscape, internal threats and technological changes and through the implementation of controls to mitigate risk to the organization and our customers.


text: Our Operational Risk Oversight ("ORO") department provides second line defense oversight of the Information Security Program in support of senior management and the Board of Directors' responsibility to provide appropriate risk oversight. Owned by the VP, Information Security and Technology Risk ("VP-ISTR") in ORO, the Information Security Policy provides a framework for the security of information assets and computer resources and is consistent with our ERM framework, which incorporates certain components that guide the Company's approach to risk management: Governance and Oversight, Business Strategy, Risk Infrastructure and Risk Culture. The Information Security Policy is designed to comply with applicable laws and regulations, such as the GLBA and the Sarbanes-Oxley Act.


text: We are also committed to strong third party risk management. Our Third Party Program provides guidance for managing third party risk and is designed to assist us with the identification, measurement, management, monitoring and reporting of third party risk.


text: Our Information Security Program requires that employees adhere to our Third Party Information Security Policy, as well as the Third Party Risk Management Policy, which requires review of third-party controls to determine whether such controls meet the objectives of our Third Party Information Security Policy. The ORO team is responsible for overseeing that appropriate information security risks are identified and monitored. We rely on many third-party service providers and network participants, including merchants, and, as such, a security breach or cyber attack affecting one of these third parties could impact us.


text: Incident Management While we continue to invest in our information security defenses, including cybersecurity defenses, if our security systems or those of third parties are penetrated or circumvented such that the confidentiality, integrity or availability of information about us, our customers, transactions processed on our networks or on third-party networks on our behalf, or third parties with which we do business is compromised, we could be subject to significant liability that may not be covered by insurance, including significant legal and financial exposure, actions by our regulators, damage to our reputation or loss of confidence in the security of our systems, products and services that could materially adversely affect our business. For more information about the risks posed by cybersecurity threats, see "Item 1A. Risk Factors — Operational and Other Risk — If the security of our systems, or the systems of third parties we rely upon, is compromised, our business could be disrupted and we may be subject to significant financial exposure, liability and damage to our reputation. "


text: Our CISO has over 20 years of information technology experience with specialization in information security and technology risk management. Our CISO is a Certified Information Systems Auditor and Certified Data Privacy Security Engineer. He serves as a Board member at the National Cybersecurity Alliance and is a member of Finance Services Information Sharing and Analysis Center (FS-ISAC) along with multiple other customer advisory boards. He was formerly a director at a large financial services organization and been in various information security roles at a Big 4 consulting firm prior to joining Discover.


text: Cybersecurity is at the foundation of the Company's values and the way it approaches its users, professionals, and customers. We face a number of external threats common to companies in the industries we serve, such as ransomware, denial-of-service, phishing, and social engineering. Our customers, suppliers, and professionals face similar threats, and a cybersecurity incident impacting the Company or any of these entities could materially adversely affect the performance of our businesses, our results of operations, and our cash flows.

companyName: DHI GROUP, INC.

ticker: DHX


text: We maintain cyber event related insurance but we have also instituted an information security structure and process to assess, identify, manage, and, if necessary, report cybersecurity risks. We maintain a cybersecurity incident response process and a tracking system for any incidents in an effort to ensure appropriate actions are taken. Any member of the Company can report a suspected incident and it will be investigated.


text: We have implemented data security standards in our architecture and system design techniques. Reviews and testing of our systems and subsystems are performed at regular intervals and are designed to ensure our capability to respond to cybersecurity incidents or threats. Our cybersecurity framework is based on the National Institute of Standards and Technology Cybersecurity Framework. In accordance with this framework, risks are analyzed for impact and probability to determine severity level, with classifications of critical, high, medium, or low risk. These processes have been integrated into our overall risk management system and processes and are part of our operating procedures, internal controls and information systems. In addition, we engage in an ongoing improvement process to enhance our cybersecurity posture.


text: Third parties also play a role in our cybersecurity. We engage third-party services to assist in the scanning and testing of our web properties and cloud infrastructure. We have a retainer with a cybersecurity response organization to immediately respond and provide professional expertise and assistance if necessary. Our process is designed to provide any required notifications in case of a cyber event, including those to federal, state, and local authorities, as well as to our insurance providers and auditors.


text: We also utilize a supply chain risk management process to assess cybersecurity risks associated with third-party software providers. We perform third-party risk assessments to both identify and mitigate risks from third parties such as vendors, suppliers, and others associated with our use of third-party service providers. Cybersecurity risks are evaluated when determining the selection and oversight of applicable third-party service providers and potential fourth-party risks when handling and/or processing our employee, business or customer data. In addition to new vendor onboarding, we perform risk management during third-party cybersecurity compromise incidents to identify and mitigate risks to us from third-party incidents.


text: The Company maintains a Security Council that regularly meets to review current or potential threats. The Security Council's membership consists of the following: the Company's Chief Executive Officer, Chief Financial Officer, Chief Technology Officer, General Counsel, Vice President of Technology, Manager of Security, and Head of Internal Audit. We also employ a Security Department responsible for cybersecurity across the organizations. The individuals in this department are vetted for their experience and expertise before joining the team and maintain continued education and training each year using our enhanced learning program. This department's responsibilities include cyber security risk management, security operations, awareness training, incident response, industry awareness and reporting. The team assesses and maintains awareness of global cyber security threats by using several services and notifications from our vendors. The team then considers each of these threats as applied to our environment, process, operations, vendors and clients. The Security Council is led by the Chief Technology Officer, Vice President of Technology, and Manager of Security, each of whom have a depth of knowledge and experience in the cyber security space.


text: Our Board of Directors has ultimate oversight of cybersecurity risk, which it manages as part of our enterprise risk management program, while the Audit Committee is directly responsible for oversight of the Company's cybersecurity and is briefed by the Security Council on a quarterly basis. Members of the Audit Committee receive updates on a quarterly basis from senior management, including leaders from our Information Security, Product Security, Compliance and Legal teams regarding matters of cybersecurity. This includes existing and new cybersecurity risks, status on how management is addressing and/or mitigating those risks, cybersecurity and data privacy incidents (if any) and status on key information security initiatives. Our Board members also engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations, or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication.


text: See Item 1A. Risk Factors "Capacity constraints, systems failures or breaches of our network security could materially and adversely affect our business. If we fail to manage our technical operations infrastructure, our existing customers may experience services outages, and our new customers may experience delays in the deployment of our solution."


text: The Company maintains a Security Council that regularly meets to review current or potential threats. The Security Council's membership consists of the following: the Company's Chief Executive Officer, Chief Financial Officer, General Counsel, Vice President of Technology Operations, Director of Systems Engineering, and Head of Internal Audit. We also employ a Security Department responsible for cybersecurity across the organizations. The individuals in this department are vetted for their experience and expertise before joining the team and maintain continued education and training each year using our enhanced learning program. This department's responsibilities include cyber security risk management, security operations, awareness training, incident response, industry awareness and reporting. The team assesses and maintains awareness of global cyber security threats by using several services and notifications from our vendors. The team then considers each of these threats as applied to our environment, process, operations, vendors and clients. The Security Council is led by the Vice President of Technology Operations, and Director of Systems Engineering, each of whom have a depth of knowledge and experience in the cyber security space.


text: Our board of directors and senior management recognize the critical importance of maintaining the trust and confidence of our clients, business partners and employees. Our management, led by our Chief Executive Officer, is actively involved in oversight of our risk management efforts, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). Our cybersecurity processes and practices are fully integrated into the Company's ERM efforts. In general, we seek to address cybersecurity risks through a cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that we collect and store by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: iWallet Corp

ticker: IWAL


text: Risk Management and Strategy As one of the critical elements of our overall ERM approach, our cybersecurity efforts are focused on the following key areas: Governance: Management oversees cybersecurity risk mitigation and reports to the board of directors any cybersecurity incidents.


text: Collaborative Approach: We have implemented a cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner.


text: Technical Safeguards: We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-virus and anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence.


text: We have not engaged third-party service providers to conduct evaluations of our security controls, independent audits or consulting on best practices to address new challenges.


text: While we have not experienced any cybersecurity threats in the past in the normal course of business, in the future, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us.


text: Risk management and strategy The Company's enterprise risk management ("ERM") program includes assessing, identifying and managing material risks from various sources, including those related to cybersecurity. The Company uses information from incident history, threat intelligence, formal and informal security networks, government information sharing and recognized information security frameworks to inform its cybersecurity risk management approach.

companyName: OPENLANE, Inc.

ticker: OPLN


text: The Company's cybersecurity risk management processes incorporate multiple layers of security to help identify and protect against cybersecurity threats including a dedicated cybersecurity team, technical security controls, policy enforcement, monitoring systems, employee training, contractual arrangements and management oversight. Given the dynamic nature of the cyber-threat environment, the Company engages third-party assessors, consultants and others from time to time to assist in various cyber-related matters, including assessing, enhancing, implementing and monitoring the Company's cybersecurity risk management process.


text: The Company maintains a vendor risk management program designed to identify and manage risks associated with third-party service providers, with management retaining responsibility for oversight of cybersecurity threats. The Company also maintains an incident response plan that includes escalation criteria and preliminary materiality assessments to guide disclosure objectives.


text: The Company describes risks related to cybersecurity threats that could materially impact its business strategy, results of operations or financial condition under the heading "Risk Factors." Material impacts could include loss of access to systems and data, financial costs and reputational harm, among others.


text: Management is responsible for assessing and managing risk at the Company, including communicating the most material risks to the Board of Directors and its committees. The Board of Directors has primary responsibility for risk oversight, with a focus on the most significant risks facing the Company. With respect to cybersecurity risks, the Risk Committee of the Board of Directors ("Risk Committee") provides oversight for matters specifically relating to cybersecurity and other risks related to information technology systems and procedures, including but not limited to data security and privacy.


text: Management leverages the collective expertise of the Company's information security function which reports to the Chief Financial Officer through the Company's Chief Information Security Officer ("CISO"). The CISO has served in this position for the Company since 2017, holds various relevant credentials including CISSP (Certified Information Systems Security Professional), and has extensive cybersecurity experience having served in information technology roles for over 35 years and cybersecurity leadership roles for 15 years. The CISO reports to the Risk Committee quarterly on information security matters, including, among other things, the Company's cyber risks and threats, the status of projects to further strengthen the Company's information security systems, assessments of the Company's security program and the emerging regulatory and threat landscape. The CISO also briefs the full Board of Directors on cybersecurity matters at least annually. As described above, management informs the Risk Committee about prevention, detection, mitigation and remediation of cybersecurity incidents quarterly and monitors such matters continuously. The Risk Committee reviews and discusses with management the quality and effectiveness of the Company's efforts to mitigate such risks and reports such findings to the Board of Directors.


text: The Company's cybersecurity risk management processes incorporate multiple layers of security to help identify and protect against cybersecurity threats including a dedicated cybersecurity team, technical security controls, policy enforcement, monitoring systems, employee training, contractual arrangements and management oversight. Given the dynamic nature of the cyber-threat environment, the Company engages with third-party assessors, consultants and others from time to time on various cyber-related matters, including assessing, enhancing, advising and monitoring the Company's cybersecurity risk management process.


text: The Company maintains a vendor risk management program designed to help identify and manage risks associated with third-party service providers, including a risk-based approach to identifying and monitoring cybersecurity threats presented by certain third-party service providers, with management retaining responsibility for oversight of cybersecurity threats. The Company maintains an incident response plan that includes escalation criteria and preliminary materiality assessments to guide reporting and disclosure objectives.


text: The Company describes risks related to cybersecurity threats that could materially impact its business strategy, results of operations or financial condition in Item 1A. "Risk Factors" of this Annual Report on Form 10-K.


text: Management is responsible for assessing and managing risk at the Company, including communicating key risks to the Board of Directors and its committees. The Board of Directors has primary responsibility for risk oversight, with a focus on the most significant risks facing the Company. With respect to cybersecurity risks, the Audit Committee of the Board of Directors ("Audit Committee") provides oversight for matters specifically relating to cybersecurity and other risks related to information technology systems and procedures, including but not limited to data security and privacy.


text: Management leverages the collective expertise of the Company's information security function which reports to the Chief Financial Officer through the Company's Chief Information Security Officer ("CISO"). The CISO has served in this position for the Company since 2017, holds various relevant credentials including CISSP (Certified Information Systems Security Professional), and has extensive cybersecurity and privacy experience having served in information technology roles for over 35 years and cybersecurity leadership roles for 15 years. The CISO reports to the Audit Committee quarterly on information security matters, including, among other things, the Company's cyber risks and threats, any incidents or events, the status of projects to further strengthen the Company's information security systems, assessments of the Company's security program and the emerging regulatory and threat landscape. The CISO also briefs the full Board of Directors on cybersecurity matters at least annually. As described above, management informs the Audit Committee about prevention, detection, mitigation, resolution, and remediation of cybersecurity incidents quarterly and monitors such matters continuously. The Audit Committee reviews and discusses with management the quality and effectiveness of the Company's efforts to mitigate such risks and reports such findings to the Board of Directors.


text: The Company maintains, and routinely reviews and evaluates its information technology ("IT") and cybersecurity policies, practices and procedures (our "Cybersecurity Program"). The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of the Company's Crisis Management Plan. Our Cybersecurity Program is administered by our IT Manager, who is managed on a day to day basis by our General Counsel and Chief Compliance Officer and overseen by our IT Steering Committee consisting of our Chief Executive Officer, our Chief Financial Officer and Chief Operating Officer and our General Counsel and Chief Compliance Officer. Our General Counsel and Chief Compliance Officer also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan. We also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of our IT and cybersecurity systems, to recommend improvements to our Cybersecurity Program and in connection with any cybersecurity incident. We believe that the individuals involved in our Cybersecurity Program possess the necessary skills, experience and backgrounds that, when combined with the resources of our external IT and cybersecurity advisers, consultants and experts, are sufficient to manage our Cybersecurity Program.

companyName: Main Street Capital CORP

ticker: MAIN


text: As part of our overall risk management process, our management engages at least annually in an enterprise risk management review and evaluation, during which management reviews the principal risks relating to our business and operations. Included in this process is a review and evaluation of our risks relating to our Cybersecurity Program. Additionally, as part of our Rule 38a-1 compliance program, we review at least annually the compliance policies and procedures of our key service providers, including documentation discussing each service providers' information security and privacy controls. Any failure in our or our key service providers' cybersecurity systems could have a material impact on our operating results. See Item 1A. Risk Factors — General Risk Factors — The failure in cybersecurity systems, as well as the occurrence of events unanticipated in our disaster recovery systems and management continuity planning could impair our ability to conduct business effectively.


text: Our Board as a whole has responsibility for the Company's risk oversight, with reviews of certain areas being conducted by the relevant Board committees that report on their deliberations to the full Board. The oversight responsibility of the Board and its committees is enabled by management reporting processes that are designed to provide visibility to the Board about the identification, assessment and management of critical risks and management's risk mitigation strategies. Areas of focus include competitive, economic, operational, financial (accounting, credit, liquidity and tax), legal, regulatory, compliance and other risks.


text: Oversight of risks relating to IT and cybersecurity has been delegated by our Board to its Audit Committee. The Audit Committee includes members of the Board who, in addition to each being designated as an "audit committee financial expert," possess backgrounds and experience which we believe enable them to provide effective oversight of our IT and cybersecurity risks. Our management routinely reports to the Audit Committee on the status of the Company's Cybersecurity Program at the Audit Committee's quarterly meetings. Routine reports generally detail any testing, observations or developments concerning the Cybersecurity Program that occurred during the prior quarter. The results of periodic testing related to the Cybersecurity Program are also described in the Chief Compliance Officer's annual report to the Board, provided pursuant to Rule 38a-1 under the 1940 Act. The crisis response team leader also collaborates with the Audit Committee chair to ensure that the Board is apprised of any material cybersecurity incident and consults with the Audit Committee chair in connection with any material decisions or actions related thereto.


text: The Company maintains, and routinely reviews and evaluates its information technology ("IT") and cybersecurity policies, practices and procedures (our "Cybersecurity Program"), which includes processes for assessing, identifying and managing material risks from cybersecurity threats. The Cybersecurity Program has various policies and procedures including a Cyber Incident Response Plan as part of the Company's Crisis Management Plan. Our Cybersecurity Program is administered by our IT Manager, who is managed on a day-to-day basis by our General Counsel and overseen by our IT Steering Committee consisting of our Chief Executive Officer, our Chief Operating Officer and our General Counsel. Our General Counsel also serves as the crisis response team leader in connection with any material cybersecurity incident under the Cyber Incident Response Plan, with our Chief Operating Officer and our IT Manager also included on the crisis response team. We also utilize the services of IT and cybersecurity advisers, consultants and experts in the evaluation and periodic testing of our IT and cybersecurity systems, to recommend improvements to our Cybersecurity Program and in connection with any cybersecurity incident. Our IT Manager has over 10 years of experience advising on and managing risks from cybersecurity threats as well as developing and implementing cybersecurity systems, policies and procedures. Our General Counsel has served in his oversight function as General Counsel for over 16 years and previously as our Chief Compliance Officer for over 12 years, during which time he has gained expertise in assessing and managing risk applicable to the Company. Similarly, each of our Chief Executive Officer and our Chief Operating Officer have served in various executive management roles at the Company and, in the case of our Chief Operating Officer, other publicly traded organizations, involving extensive oversight and management of risks, including cybersecurity related risks, for over 20 years.


text: Our Board as a whole has responsibility for the Company's risk oversight, with reviews of certain areas being conducted by the relevant Board committees that report on their deliberations to the full Board. The oversight responsibility of the Board and its committees is enabled by management reporting processes that are designed to provide visibility to the Board about the identification, assessment and management of critical risks and management's risk mitigation strategies.


text: Oversight of risks relating to IT and cybersecurity has been delegated by our Board to its Audit Committee. The Audit Committee includes members of the Board who, in addition to each being designated as an "audit committee financial expert," possess backgrounds and experience which we believe enable them to provide effective oversight of our IT and cybersecurity risks. Our management routinely reports to the Audit Committee on the status of the Company's Cybersecurity Program and material risks from cybersecurity threats at the Audit Committee's quarterly meetings. Such reports generally detail any testing, observations or developments concerning the Cybersecurity Program that occurred during the prior quarter. The results of periodic testing related to the Cybersecurity Program are also described in the Chief Compliance Officer's annual report to the Board, provided pursuant to Rule 38a-1 under the 1940 Act. The crisis response team leader also collaborates with the Audit Committee chair to ensure that the Board is apprised of any material cybersecurity incident.


text: During the reporting period, the Company has not identified any impacts from cybersecurity threats, including as a result of previous cybersecurity incidents, that the Company believes have materially affected, or are reasonably likely to materially affect, the Company, including its business strategy, operational results and financial condition.


text: We are subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition and cash flows, as well as our operations—including our manufacturing and marketing capabilities. We operate a risk-based cybersecurity program which is designed to: (i) ensure the security, confidentiality, integrity and availability of our information and systems; (ii) protect against anticipated or actual cyber threats to our information and systems; and (iii) protect against unauthorized access and/or use of our information and systems. Overall cybersecurity risk reporting is integrated with our enterprise risk management program, is included in discussions with the Audit Committee of our board of directors and disclosed where appropriate. Our information technology and cybersecurity function is headed by our Chief Administrative Officer, or CAO, and Vice President of Information Technology, who are responsible for managerial oversight of our cybersecurity program. Our CAO reports directly to our Chief Executive Officer and our Vice President of Information Technology reports directly to our CAO.

companyName: Pacira BioSciences, Inc.

ticker: PCRX


text: We utilize a layered approach in assessing, identifying, evaluating and managing material risks from cybersecurity threats, and leverage outside partners to gain intelligence on threats. We take input from industry activities, third party assessments and internal simulations and continuously adjust our protection mechanisms to be effective. We also assess operational and data security risks associated with our use of third-party service providers, understanding where failure points may exist within our supply chain operations and data protections. If we learn of a cybersecurity incident at a third-party service provider, our information technology department will maintain communication with that third-party service provider and communicate any cybersecurity incidents to the Vice President of Information Technology and CAO. All Pacira employees receive information security training (including data protection and fraud awareness) on an annual basis, and we use state-of-the-art technology to monitor systems for anomalous behavior. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. In the event an incident were to occur, a Security Incident Response Team would be convened that consists of members from many functions, including legal counsel, the Vice President of Information Technology and the CAO.


text: Our board of directors has the ultimate oversight of the Company's risks—including cybersecurity risks—with our Audit Committee assisting the board in their oversight of cyber and information security risks. Members of management that possess information security certifications and many years of experience work with our legal, finance and corporate governance functions to identify, define and report cybersecurity risks, policies and procedures and incident response plans. The Audit Committee receives updates on our cybersecurity program from management on a quarterly basis and more frequently as determined to be necessary or advisable. Updates to the Audit Committee include policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of cybersecurity risks, as well as effectiveness and changes in our ability to monitor, protect, detect and respond to incidents, risk reviews and industry news briefings. The Audit Committee also ensures that management provides a cyber and information security update to the board at least annually. Finally, in the event a material cybersecurity incident were to occur, the CAO and Vice President of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident and making the determination of materiality and any related disclosure.


text: We face a number of cybersecurity risks in connection with our business. Although we have numerous controls to protect against common attacks, some attacks may still be effective. Our controls are designed to detect, triage and eradicate these attacks. While we carry a cyber insurance policy to help cover investigation and mitigation expenses, it may be subject to limitations and be insufficient to cover all expenses that may result from a cybersecurity incident. Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. For more information about the cybersecurity risks and other information technology and data privacy risks we face, see Item 1A. Risk Factors and the subsection titled Risks Related to Information Technology, Cybersecurity and Data Privacy.


text: We are subject to cybersecurity threats that could have a material adverse impact on our results of operations, financial condition and cash flows, as well as our operations—including our manufacturing and marketing capabilities. We operate a risk-based cybersecurity program which is designed to: (i) ensure the security, confidentiality, integrity and availability of our information and systems; (ii) protect against anticipated or actual cyber threats to our information and systems; and (iii) protect against unauthorized access and/or use of our information and systems. Overall cybersecurity risk reporting is integrated with our enterprise risk management program, is included in discussions with the Audit Committee of our board of directors and disclosed where appropriate. Our information technology and cybersecurity function is headed by our Chief Administrative Officer, or CAO, and Vice President of Information Technology, who are responsible for managerial oversight of our cybersecurity program. Our CAO reports directly to our Chief Executive Officer and our Vice President of Information Technology reports directly to our CAO and has over 15 years of experience in cybersecurity.


text: We utilize a layered approach in assessing, identifying, evaluating and managing material risks from cybersecurity threats, and leverage outside partners to gain intelligence on threats. Highlighted risks are integrated into our Enterprise Risk Management process. We take input from industry activities, third party assessments and internal simulations and continuously adjust our protection mechanisms to be effective. We also assess operational and data security risks associated with our use of third-party service providers, understanding where failure points may exist within our supply chain operations and data protections. If we learn of a cybersecurity incident at a third-party service provider, our information technology department will maintain communication with that third-party service provider and communicate any cybersecurity incidents to the Vice President of Information Technology and CAO. All Pacira employees receive information security training (including data protection and fraud awareness) on an annual basis, and we use state-of-the-art technology to monitor systems for anomalous behavior. We also require employees in certain roles to complete additional role-based, specialized cybersecurity trainings. In the event an incident were to occur, a Security Incident Response Team would be convened that consists of members from many functions, including legal counsel, the Vice President of Information Technology and the CAO.


text: Our board of directors has the ultimate oversight of the Company's risks—including cybersecurity risks—with our Audit Committee assisting the board in their oversight of cyber and information security risks. Members of management that possess information security certifications and many years of experience work with our legal, finance and corporate governance functions to identify, define and report cybersecurity risks, policies and procedures and incident response plans. The Audit Committee receives updates on our cybersecurity program from management on a quarterly basis and more frequently as determined to be necessary or advisable, and the full board receives a cybersecurity program update at least annually. Updates to the Audit Committee include policies, processes, procedures and any significant developments related to the identification, mitigation and remediation of cybersecurity risks, as well as effectiveness and changes in our ability to monitor, protect, detect and respond to incidents, risk reviews and industry news briefings. The Audit Committee also ensures that management provides a cyber and information security update to the board at least annually. Finally, in the event a material cybersecurity incident were to occur, the CAO and Vice President of Information Technology would brief the Audit Committee which would then be responsible for assessing the materiality of the incident and making the determination of materiality and any related disclosure.


text: We face a number of cybersecurity risks and threats in connection with our business. Although we have numerous controls to protect against common attacks, some attacks may still be effective. Our controls are designed to detect, triage and eradicate these attacks. While we carry a cyber insurance policy to help cover investigation and mitigation expenses, it may be subject to limitations and be insufficient to cover all expenses that may result from a cybersecurity incident. Although the risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition, such incidents could have a material adverse effect in the future as cyberattacks continue to increase in frequency and sophistication. For more information about the cybersecurity risks and other information technology and data privacy risks we face, see Item 1A. Risk Factors and the subsection titled Risks Related to Information Technology, Cybersecurity and Data Privacy.


text: Risk Management and Strategy Our business operations and relationships with customers and suppliers are heavily reliant on technology. We operate a cybersecurity program designed to assess our security risks and threats, to manage those risks and protect our technology systems and data, and to detect and respond to cybersecurity incidents.

companyName: lululemon athletica inc.

ticker: LULU


text: We manage strategic risks, including cybersecurity risk, through our Enterprise Risk Management program which has direct involvement from the board of directors, the audit committee, and senior management. Through this process, we have identified cybersecurity as a risk management priority.


text: Our board of directors provides oversight of cybersecurity risks and has delegated primary responsibility to the audit committee, which is responsible for overseeing our enterprise risk assessments and management policies, procedures, and practices (including regarding those risks related to information security, cybersecurity, and data protection).


text: The audit committee maintains a cybersecurity sub-committee that is comprised of our Chief Information Officer ("CIO"), our Chief Information Security Officer ("CISO"), and representatives from the audit committee and board of directors that have knowledge and experience in cybersecurity matters. The cybersecurity sub-committee reviews our cybersecurity risk assessments and the steps being taken to monitor, control, and report on those risks as well as discusses regulatory and market developments. They also review our process for identifying and responding to cybersecurity incidents in a timely manner, and details of cybersecurity attacks or incidents which have occurred.


text: Management generally meets with, and provides reports to, the cybersecurity sub-committee on a quarterly basis. Our CIO and CISO also meet with and provide reports to the audit committee at least quarterly. The board of directors receives periodic reports regarding the activities of the cybersecurity sub-committee. These reports and meetings are designed to inform the board of directors and committees about the current state of our information security program including cybersecurity risks, the nature, timing, and extent of cybersecurity incidents, if any, and the resolution of such matters.


text: Cybersecurity Program and Incident Response Our CISO is responsible for our cybersecurity program, including risk assessments, information security activities, and controls. The CISO is responsible for establishing and maintaining corporate information security policies and overseeing our risk management activities, which prioritize vulnerability management, risk reduction, and prevention. Our CISO also leads our Cyber Defense and Incident Response ("CDIR") team which identifies, assesses, escalates, and remediates cybersecurity incidents. Our current CISO has over 25 years of experience in information security across different industries in the US, Europe, and South and Central America. Our current CISO is a member of the Information Systems Audit and Control Association and brings extensive experience and knowledge of cybersecurity risk management.


text: The CDIR team identifies, tracks, reviews, assesses, and takes actions over key cybersecurity risks including but not limited to: (i) third parties/vendors, (ii) cloud security, (iii) malicious code, (iv) our digital e-commerce channels and systems, and (v) our store technology. The CDIR team also undertakes enterprise architecture reviews, considers cyber defense and incident response findings, performs vulnerability scans, and assesses threats and performs landscape intelligence analysis.


text: As part of our cybersecurity program, we conduct cybersecurity awareness training including phishing simulations and supplemental campaigns as well as mandatory e-learning for all our employees. Our employees have multiple mechanisms for reporting cybersecurity and data privacy concerns. We work with third-party cybersecurity advisors to undertake assessments of our critical systems and to remediate any high-risk vulnerabilities identified. We also engage third parties to perform penetration testing on our key systems to identify potential weaknesses.


text: As part of our cyber incident response plan, we utilize an established framework to assess the severity of cybersecurity incidents. Under the plan, incidents are escalated to relevant senior management, and the board of directors, as appropriate, based on their severity. Our disclosure committee assesses the materiality of severe incidents including both quantitative and qualitative factors.


text: We utilize third-party service providers as a normal part of our business operations. To address cybersecurity risks arising from our relationships with third-party service providers, we employ a vendor risk program. We monitor risks relating to potential compromises of sensitive information at our third-party service providers and re-evaluate the risks associated with our partners periodically. Prior to exchanging our data with third-party service providers, they are required to go through a vendor risk assessment. We also conduct third-party security reviews and evaluate their network, processes, and systems. In addition, we obtain annual attestation reports related to data security and privacy from certain third-party service providers to further support compliance with industry-standard cybersecurity protocols.


text: Impact of Cybersecurity Risks on Strategy and Results Based on the information available as of the date of this Annual Report, we have not been materially affected by any previous cybersecurity incidents. However, we continue to experience cyber-attacks, including phishing, and other attempts to break or gain unauthorized access to our systems that could materially affect us in the future. For further information, see "Risks related to information security and technology" included in Item 1A. Risk Factors of this Annual Report.


text: Our board of directors is responsible for the oversight of cybersecurity risks and has delegated primary responsibility to the audit committee, which is responsible for overseeing our enterprise risk assessments and management policies, procedures, and practices (including regarding those risks related to information security, cybersecurity, and data protection).


text: The audit committee maintains a cybersecurity sub-committee that is comprised of our EVP, Chief Information Officer ("CIO"), our SVP, Chief Information Security Officer ("CISO"), and representatives from the audit committee and board of directors that have knowledge and experience in cybersecurity matters. The cybersecurity sub-committee reviews our cybersecurity risk assessments and the steps being taken to monitor, control, and report on those risks as well as discusses regulatory and market developments. They also review our process for identifying and responding to cybersecurity incidents in a timely manner, and details of cybersecurity attacks or incidents which have occurred.


text: Cybersecurity Program and Incident Response Our CISO is responsible for our cybersecurity program, including risk assessments, information security activities, and controls. The CISO is responsible for establishing and maintaining corporate information security policies and overseeing our risk management activities, which prioritize vulnerability management, risk reduction, and prevention. Our CISO also leads our Cyber Defense and Incident Response ("CDIR") team which identifies, assesses, escalates, and remediates cybersecurity incidents. Our CISO has over 30 years of experience in the field of cybersecurity, bringing an extensive understanding of cybersecurity threats, regulatory compliance, and industry best practices.


text: The CDIR team monitors and manages key cybersecurity risks, including threats related to third parties, cloud security, malicious code, e-commerce systems, and store technology. It also conducts security reviews, assesses vulnerabilities, and analyzes threat intelligence to strengthen our cyber defenses and incident response efforts.


text: Impact of Cybersecurity Risks on Strategy and Results As of the date of this annual report, we are not aware of any cybersecurity incidents that have had a material impact on our business. However, like many companies, we continue to face ongoing cyber threats, including phishing and other unauthorized access attempts, which if successful could have a material impact in the future. For more information, see "Risks related to information security and technology" included in Item 1A. Risk Factors of this annual report.


text: Cybersecurity, compliance, data privacy, and data protection are essential to our business. In the ordinary course of business, we collect and store certain confidential information, such as the specifications of our products, information about our employees, customers, contractors, vendors, and suppliers, and information about TCAR procedures, which in some instances may include identifiable patient information. To safeguard this information, we have implemented a cybersecurity defense-in-depth approach leveraging the Center for Internet Security, Inc. (CIS) Critical Security Controls (CSC) framework designed to identify, meet, and defeat dangerous cyber attacks in order to protect confidential information, mitigate data compromise and breaches, and provide IT resiliency. The CIS CSC framework defines five critical areas to build robust cybersecurity defense posture. We have developed and maintain a collection of policies and procedures to implement and support this cybersecurity framework.

companyName: Silk Road Medical Inc


text: Role of Management and Board Oversight Our cybersecurity team is comprised of individuals with experience in cybersecurity who hold cybersecurity-specific credentials and certifications. The team members belong to relevant professional organizations and receive continuing education and certification to stay abreast of emerging trends and cybersecurity best practices.


text: We have established a Technology Steering Committee, or TSC, containing members of our senior management team to provide governance and strategic direction for managing cyber risks, maintaining IT regulatory compliance, and optimizing technology initiatives for alignment with our company goals and objectives. The TSC convenes quarterly, and meetings include updates on cybersecurity matters provided by the cybersecurity leader.


text: Our board of directors has delegated to the audit committee, which is comprised of entirely independent directors, the responsibility to oversee our cybersecurity programs and cyber-related risks. Specifically, audit committee delegation under its formal written charter includes the responsibility to oversee the integrity of our IT systems, processes and data, and review and assessment with management (i) the adequacy of controls and security for our IT systems, processes and data, and (ii) our contingency plans in the event of a breakdown or security breach affecting our IT systems.


text: The cybersecurity team reports to our Chief Accounting Officer, which in turn reports to our Chief Financial Officer. Both officers regularly attend audit committee meetings where cybersecurity is discussed and the audit committee is updated on security risks and key initiatives at least twice per year by the senior management team. The TSC is responsible for providing cybersecurity risk management oversight and approving the budget to fund our IT and cybersecurity programs. An important purpose of these management updates is to inform the audit committee of any potential risks and remediation tactics related to our cybersecurity posture, IT systems, and data privacy.