text: Disclosure of the Board's Responsibility While management is primarily responsible for assessing and managing cybersecurity risks on a day-to-day basis, the Company's Board of Directors oversees management's efforts to assess and manage risk. The Board of Directors (through the Audit Committee) monitors the cybersecurity risk assessment and response process. The Audit Committee is briefed by our Chief Financial Officer on our cybersecurity ISMS program and the overall cybersecurity risk environment. The briefing may include discussions on topics such as: information security and technology risks, cybersecurity risk assessment process and updates, information risk management strategies, and progress on cybersecurity and data protection training initiatives for employees, among others.


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material cybersecurity risks to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers and vendors based on their criticality and risk profile.

companyName: Four Corners Property Trust, Inc.

ticker: FCPT

secItem: Item 1C


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face certain ongoing risks from cybersecurity risks that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors - We may be vulnerable to security breaches or cyber-attacks which could disrupt our operations and have a material adverse effect on our financial performance and operating results."


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Risk Committee (the "Committee") oversight of cybersecurity and other information technology risks. The Committee oversees management's implementation of our cybersecurity risk management program.


text: The Committee reports to the full Board regarding its activities, including those related to cybersecurity. The full Board also receives briefings from management on our cyber risk management program. Board members receive presentations on cybersecurity topics from our Chief Accounting Officer.


text: Our management team, including our Chief Accounting Officer, is responsible for assessing and managing our material risks from cybersecurity threats. The team has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes over ten years of overseeing IT risk management and compliance, day-to-day IT operations, and coordinating with external IT security experts. Our Chief Accounting Officer also works in tandem with an external cybersecurity consultant that has experience in cybersecurity assessment, response, and mitigation.


text: Our management team stays informed about and monitors efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us, and alerts and reports produced by security tools deployed in the IT environment.


text: The Audit and Compliance Committee periodically reviews our data security programs, including cybersecurity processes and procedures regarding cybersecurity threats, AI, disaster recovery and critical business continuity, and reviews our programs and plans that management has established to monitor compliance with data security compliance programs and test emergency operations preparedness. The Audit and Compliance Committee also receives reports regarding risks associated with our data security programs and management's plans for monitoring and testing compliance with data security regulations.

companyName: HCA Healthcare, Inc.

ticker: HCA


text: The Audit and Compliance Committee meetings take place on a quarterly basis and include a report from our Chief Security Officer ("CSO") regarding our security programs, including (i) the status on activities under way to support our security strategy, (ii) an overview of the current threat landscape, including emerging threats and trends that may affect us, (iii) key performance measures of security operations and (iv) general security program needs. The security program includes cybersecurity and information security risk management. Our senior security leadership team has an average of 20 years of data security experience, and each member has served in multiple roles within our security programs.


text: We seek to leverage a comprehensive risk management program aligned with the National Institute of Technology Cybersecurity Framework 2.0 that encompasses a structured approach to assess, identify, and manage cyber and information security risks. The internal processes for these activities are evaluated for alignment with our objectives and overall risk tolerance. This approach is consistent with our overall risk management efforts. The CSO participates with other senior officers, including the Chief Executive Officer, Chief Information Officer, Chief Financial Officer, Chief Legal and Administrative Officer, Chief Ethics and Compliance Officer and others on our risk management committee, which develops and coordinates enterprise cybersecurity and information security policy and strategy, and provides guidance to senior management.


text: We utilize cross-functional teams and risk assessment tools and technologies to identify potential cybersecurity and information security threats and risks. These teams include representatives from various departments within our Company to promote a holistic view of the organization's cybersecurity and information security risk landscape and to facilitate communication. We have implemented multiple layers of security measures designed to protect the confidentiality, integrity and availability of our data and the systems and devices that store and transmit such data. We also seek to embed security measures into software and system development processes and to use current security technologies. In addition, we engage third parties to actively monitor potential threats as well as our security defenses. The risk landscape is assessed to determine the likelihood and potential impact of identified risks. This assessment involves a combination of qualitative and quantitative analyses to help prioritize identified risks and determine the appropriate risk treatment. The effectiveness of the cybersecurity and information security program is tested through a combination of internal and external assessments. Updates are provided to senior management and the Audit and Compliance Committee for informed decision-making and are integrated into our broader enterprise risk management processes.


text: We also seek to oversee and identify potential cybersecurity and information security threats and risks relating to suppliers and third-party service providers. These efforts may include due diligence to assess the party's cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We also collaborate with select third-party suppliers to develop and align incident response plans.


text: No risks from cybersecurity threats or previous cybersecurity incidents have materially affected our business strategy, results of operations, or financial condition. However, there can be no assurance that our controls and procedures in place to monitor and mitigate the risks of cybersecurity threats, including the remediation of critical information security and software vulnerabilities, will be sufficient and/or timely and that we will not suffer material losses or consequences in the future. Additionally, while we have in place insurance coverage designed to address certain aspects of cybersecurity risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: The Company's Board of Directors (the Board) is responsible for overseeing the Company's risk management program and cybersecurity is a critical element of this program. Management is responsible for the day-to-day administration of the Company's risk management program and its cybersecurity policies, processes, and practices. The Company's cybersecurity policies, standards, processes, and practices are based on recognized frameworks established by the National Institute of Standards and Technology (NIST) and are included in the Company's overall risk management system and processes. In general, the Company seeks to address material cybersecurity threats through a company-wide approach that addresses the confidentiality, integrity, and availability of the Company's information systems or the information that the Company collects and stores, by assessing, identifying and managing cybersecurity issues as they occur.

companyName: Aptevo Therapeutics Inc.

ticker: APVO


text: The Audit Committee exercises its risk oversight function by carefully evaluating information and cybersecurity reports they receive from management; assessing the priorities and roadmap of the cybersecurity program; and making inquiries of management with respect to areas of particular interest to the Board. Senior leadership, including our chief digital officer ("CDO") and our chief information security officer, periodically briefs the Audit Committee on our cybersecurity and information security programs and reviews relevant cybersecurity incidents.

companyName: GOODYEAR TIRE & RUBBER CO /OH/

ticker: GT


text: Our global information technology organization, led by our CDO, is responsible for our overall information security strategy, policies, operations and threat detection and response. Our current CDO has more than two decades of experience in the automotive industry. The global information technology organization manages and maintains the cybersecurity program with the goal of preventing, detecting and remediating incidents, and works to increase our system resilience to minimize the business impact should an incident occur. Our cybersecurity program is informed by multiple, overlapping cybersecurity frameworks. These include the National Institute of Standards and Technology Cyber Security Framework (NIST-CSF); Cybersecurity Maturity Model Certification (CMMC); Control Objectives for Information and Related Technology (COBIT); International Organization for Standardization (ISO, specifically 27001); and Trusted Information Security Assessment Exchange (TISAX). Our cybersecurity program has achieved TISAX certification, or "labeling" for its demonstrated ability to identify, protect, detect, respond and recover from cyber risks. The "labeling" process requires independent, third-party auditors to test and confirm the controls we have implemented.


text: The program includes escalation and notification of potentially significant incidents to the Cybersecurity Disclosure Committee and the Audit Committee of the Board, as appropriate. Our Cybersecurity Disclosure Committee is comprised of senior leadership across multiple functional areas and is responsible for reviewing and evaluating potentially significant cybersecurity incidents and for determining whether any notification or disclosure is required under applicable laws, including the federal securities laws. In 2024, We have developed an AI Governance Council to address the cybersecurity, data privacy and data management of emerging technologies. The Council is a multidisciplinary group with representatives from the human resources, information technology, law, compliance and ethics, privacy, and research and development functions.


text: Third-party specialists are also incorporated into our approach to cybersecurity. We engage third-party services to conduct evaluations of our security controls, whether through penetration testing, independent audits, cybersecurity maturity assessments or consulting on best practices to address current and new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: We recognize a cybersecurity incident experienced by a supplier or joint venture partner could materially impact us. We assess third-party cybersecurity controls as part of our third-party IT risk due diligence and engage in cybersecurity consultant-led solution design reviews when integrating new tools or third parties. We contractually require third parties to report cybersecurity incidents to us so we can assess the impact of the incident and any necessary regulatory reporting obligations that may be required.


text: Refer to Part I, Item 1A. "Risk Factors" of this 2024 Annual Report on Form 10-K for further information about the Company's overall ERM process.

companyName: BADGER METER INC

ticker: BMI


text: The Board oversees the Company's ERM process, including the management of risks arising from cybersecurity threats. The Board receives annual cybersecurity updates from senior management, and the Audit and Compliance Committee provides a deeper level of oversight through an annual review of management's approach to cybersecurity risk with the Director – Information Systems. The Board and the Audit and Compliance Committee also receive prompt and timely information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: The Director – Information Systems, as head of cybersecurity and in coordination with management, works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response plans. Management is actively involved in the incident response and risk management process (mitigation, transference, and acceptance). Additionally, Company management meets monthly as part of the cybersecurity steering committee to direct proper activities to mitigate any risks identified.


text: The SVP-CFO, VP-Controller and VP-General Counsel are explicitly informed by the Director of Information Systems, internal security team and Managed Security Service Provider (MSSP) of incidents and periodically updated on the investigation progress and impact of the incident. Management also receives explicit monthly summaries on all incidents. Material incidents are summarized at an annual management review meeting.


text: Internal IS Management has the following certifications: Certified Information Systems Security Professional (CISSP), Certified Information Systems Auditor (CISA), GIAC/SANS Certified Forensic Examiner, Cloud Forensics and Incident Responder (GCFR), Certified Advanced Smartphone Forensics (GASF), Certified Cloud Security Professional (CCSP), Magnet Certified Forensic Examiner, BBA Information Technology Emphasis Security, and CompTIA Security+.


text: Cybersecurity Risk Management and Strategy As an externally managed closed-end management investment company that has elected to be regulated as a BDC under the 1940 Act, our day-to-day operations are managed by the Adviser, Administrator and our officers under the oversight of our Board of Trustees. Our officers are senior professionals of the Adviser and Sixth Street and each of the Adviser and Administrator is a subsidiary of Sixth Street. As such, we are reliant on Sixth Street for assessing, identifying and managing material risks to our business from cybersecurity threats. Below are details Sixth Street has provided to us regarding its cybersecurity program that are relevant to us.

companyName: Sixth Street Lending Partners


text: Sixth Street has a comprehensive Security Incident Response Plan (the "IRP") designed to inform the proper escalation (including, as appropriate, to our officers and other representatives of the Adviser or its affiliates) of non-routine suspected or confirmed information security or cybersecurity events based on the expected risk an event presents. As appropriate, a team composed of individuals from several internal technical and managerial functions may be formed to investigate and remediate the event and determine the extent of external advisor support required, including from external counsel, forensic investigators, and/or law enforcement. The IRP sets out ongoing monitoring or remediating actions to be taken after resolution of an incident. The IRP is reviewed at least annually.


text: The Head of Technology Risk has extensive experience in cybersecurity and technology and is responsible for all aspects of cybersecurity across Sixth Street. He has a B.S in Computer Science from University of Washington and has over 18 years of experience contributing to cybersecurity related workflows, processes, policies, system designs, program management, and vulnerability discovery, exploitation, mitigation, and remediation.


text: Cybersecurity is an integral part of the Board's risk analysis and discussions with management. At least annually, the full Board is updated on the Company's cybersecurity risks and risk mitigation strategy by our Vice President of Information Technology, who is responsible for management of our IT program. The Board also receives ad hoc updates, as needed, about material changes to the Company's cybersecurity program and/or the cybersecurity landscape, including briefings on major legislative and regulatory developments, from our Vice President of Information Technology and representatives from Legal and/or Risk Management, as applicable.

companyName: ACADIA REALTY TRUST

ticker: AKR


text: Our Vice President of Information Technology regularly evaluate the Company's cybersecurity risk profile and leads the development of strategies to mitigate risks and address cybersecurity issues that may arise, in consultation with members of our senior management and Risk Management teams. Our Vice President of Information Technology and Director of Risk Management each have approximately 25 years of experience, and holds certifications in cybersecurity from accredited information technology certification providers.


text: We have formal policies and procedures that address cybersecurity incident response and disaster recovery from interference with our critical applications. Our Cybersecurity Incident Response Plan provides a documented framework for responding to cybersecurity incidents in coordination across multiple departments. In the event of such an incident, our Cybersecurity Incident Response Team ("CIRT"), which is comprised of our Vice President of Information Technology and representatives from Risk Management, Legal and Financial Reporting, would respond to such incident in accordance with our Cybersecurity Incident Response Plan. Any cybersecurity incident that meets certain criteria will be communicated by the CIRT to senior management and the Board in a timely manner, and will be evaluated by our Executive Management Team, comprised of certain executives, to assess the impact of the incident on the Company, considering qualitative and quantitative factors. In conducting this assessment and responding to an incident, the CIRT and Executive Management Team may utilize the services of third-party consultants.


text: Cybersecurity user awareness training is mandatory for all new hires and for existing employees on an annual basis to help protect our employees and the Company against cybersecurity threats. This annual training is customized to address specific cybersecurity challenges and scenarios that we may face within the real estate investment industry. Novel cybersecurity threats to the Company that are identified by our IT team are communicated to all employees by email, as needed, in an effort to promote awareness and protect the Company from cyber attacks.


text: Risk Management and Strategy We maintain an Enterprise Risk Management ("ERM") program to identify and respond to the most critical risks to our business, including cybersecurity risks. Risks and vulnerabilities from our increased reliance on information technology systems are assessed at least annually as part of our ERM program. In response to such assessments, controls are embedded into our processes and technology by our Vice President of Information Technology to seek to mitigate risks to our systems and processes from cybersecurity incidents. We continuously evaluate if we have adequate controls in place utilizing a risk-based approach that aligns with the National Institute of Standards and Technology Cybersecurity Framework.


text: Our daily operations are monitored by a dedicated IT team. We conduct monitoring of our computer networks, and have implemented systems and processes intended to secure our information technology systems and prevent unauthorized access to or loss of sensitive data, including through the use of encryption and authentication technologies. We assess the adequacy of our cybersecurity measures through annual penetration testing of our computer networks by external consultants, and we have performed tabletop simulations and drills at both a technical and management level around scenarios involving the loss of critical information and technology systems.


text: Although risks from cybersecurity threats have to date not materially affected, and we do not believe they are reasonably likely to materially affect, us, our business strategy, results of operations or financial condition, like other companies in our industry, we could, from time to time, experience threats and security incidents related to our and our third-party vendors' information systems. For more information, please see Item 1A. Risk Factors - Increased IT security threats and more sophisticated computer crime could pose a risk to our systems, networks, and services.


text: To help mitigate this risk, Radian has designed and maintains an Information Security Program that is intended to protect our corporate data as well as data entrusted to us by our customers and partners. The Information Security Program is built on a risk-based approach that identifies and prioritizes cyber threats based on their potential impact on our strategy, operations, and assets. This program is aligned with our enterprise risk management program, extends across business lines and encompasses written policies on cybersecurity.

companyName: RADIAN GROUP INC

ticker: RDN


text: As a Company, we have developed key security services, including data governance, encryption, vulnerability management, systems and network monitoring, access controls, application security, threat detection, incident response, employee awareness training and assessment of our third-party service providers. We regularly test our incident response readiness and reporting through tabletop exercises, external and internal penetration testing and internal security testing so that identified risks and incidents are escalated and communicated for appropriate remediation activities that are intended to reduce risks to an acceptable level.


text: Our board of directors has ultimate oversight of cybersecurity risk, which it manages in coordination with the Risk Committee of our board of directors as part of our enterprise risk management program. The Risk Committee regularly reviews the Company's enterprise risk management program and Information Security Program with management and reports to the board of directors. The Chief Information Security Officer reports directly to our Chief Digital Officer and presents at least annually to the Company's full board of directors about the overall effectiveness of the Information Security Program, as well as quarterly to the Risk Committee. Radian's board of directors approves the written Information Security Policy and Information Security Program documents annually. Collectively, these documents describe the structure, scope, organization and requirements of the Information Security Program, as well as the responsibility and authority of the Chief Information Security Officer.


text: To further maintain governance and oversight over the Information Security Program, we have established an Information Security Council and Executive Information Security Committee composed of our Chief Information Security Officer and colleagues with experience, education and ongoing training in information security, cybersecurity risk and information governance. In addition, our Chief Executive Officer receives regular updates from the Chief Information Security Officer, reviews reports of key developments involving our Information Security Program and meets with our Information Security team at least quarterly to review the readiness and effectiveness of our program. We also utilize both internal and external auditors to provide independent assessments of our Information Security Program. Cybersecurity incidents are reviewed at least quarterly by management, the appropriate executive committees and the board of directors or its committees.


text: Due to our reliance on digital technology and electronic communications to run our business, cybersecurity threats and incidents pose an ongoing and escalating risk to our internal and third-party provided information systems and data, reputation and shareholder value, results of operations and financial condition. Our Chief Technology Officer, who reports directly to our Chief Executive Officer, holds over 25 years of experience in information technology, specifically infrastructure, information security and fraud, and identity solutions at large global companies, and our Vice President of Information Technology ("IT") Governance, who reports to our Chief Technology Officer, holds over 20 years of experience in various information security roles. Together, our Chief Technology Officer and Vice President of IT Governance ("IT leadership") oversee and lead our information security program and our business strategy, financial planning and capital allocation around our cybersecurity risk management and governance practices. We also have an established Incident Response Team ("IRT") to respond to and manage cybersecurity events. This team includes our IT leadership as well as senior leadership from our accounting, legal, corporate communications and risk management departments with subject-matter expertise and established tenure at Prologis in their respective areas. The IRT is tasked with taking appropriate action to safeguard the integrity of our information systems, data and network resources, investigate whether a breach occurred, define disclosures, communicate effectively with key audiences, including the Board as necessary, mitigate cybersecurity incident risks and provide a resolution through our cybersecurity incident communication protocols. Additionally, on an annual basis the IRT is involved and engaged in security initiatives, including tabletop exercises facilitated both internally and externally, to stay relevant on current practices in the areas of cybersecurity.

companyName: Prologis, Inc.

ticker: PLD


text: The processes implemented by our IT leadership and IRT to oversee and identify cybersecurity risks are based on the Prologis Information Security Policy governed by the United States National Institute of Standards and Technology Cybersecurity Framework. The framework focuses on five key categories of cybersecurity risk management and governance: (i) identify: develop an organizational understanding to manage cybersecurity risk to systems, people, assets, data and capabilities; (ii) protect: develop and implement appropriate safeguards to ensure delivery of critical services; (iii) detect: develop and implement appropriate activities to identify the occurrence of a cybersecurity event; (iv) respond: develop and implement appropriate activities to take actions regarding a detected cybersecurity incident; and (v) recover: develop and implement appropriate activities to maintain plans for resilience and to restore any capabilities or service that were impaired due to a cybersecurity incident. This framework is utilized within our organization as part of an integrated risk management program that involves participation from employees, to our Board and third-party service providers, with whom we have protocols in place to mitigate cybersecurity incident risks within our supply chain through the products and services we provide and use. Additionally, all employees and contractors are required to attend mandatory cybersecurity training on an annual basis.


text: Risk Management and Strategy We have developed an information security program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our information security program is managed by our SVP, Chief Security Officer ("CSO"), whose team (the "CSO Office") is responsible for leading enterprise-wide cybersecurity strategy, policy, standards, architecture, technologies, and processes. Our CSO's primary responsibility includes assessing, monitoring, and managing our cybersecurity risks. Her background includes extensive experience as an enterprise CSO, with over 24 years of experience in the field of cybersecurity. In partnership with our Chief Information Officer ("CIO") who leads our Governance Risk and Compliance ("GRC") function, the CSO Office oversees our governance programs, tests our compliance with standards, remediates known risks, and leads our employee security training program.

companyName: JFrog Ltd

ticker: FROG


text: The CSO Office implements and oversees processes for the regular monitoring of our information systems. This includes the deployment of advanced security measures and advanced compliance systems to identify and mitigate potential vulnerabilities. The CSO Office collaborates closely with key departments within the Company, including the office of our Chief Technology Officer ("CTO"), Engineering, IT, DevOps, Support, and Production, to implement our Vulnerability Management Remediation Plan. This collaboration is aligned with industry standards of the Software Development Life Cycle, underscoring our commitment to maintaining robust security protocols across all phases of our operations.


text: We have developed and maintain a robust cybersecurity incident response plan. JFrog's cybersecurity incident response team has a comprehensive strategy and policies in place for managing security incidents. Along with swift threat classification, containment, and eradication, the strategy includes notification procedures to promptly inform and support stakeholders in accordance with applicable data breach notification laws. Incident analysis is carried out to understand root causes and drive continuous improvement.


text: Our information security controls and practices are certified against globally recognized standards: ISO 27001, ISO 27701, ISO 27017, SOC 2 Type II, CSA start level 1, TISAX and KY3P by S&P Global. We are also aligned to cybersecurity practices and controls recommended by the National Institute of Standards and Technology ("NIST"), part of the U.S. Department of Commerce.


text: Our third-party vendor risk management program addresses third party vendors with access to our systems or data, or who process data on our behalf, and includes a risk-based approach and security assessments throughout the third-party life-cycle, from onboarding to termination, as well as through contractual controls and technological controls to monitor the vendors' posture. This program is designed to oversee and identify risks from cybersecurity threats associated with its use of third-party service providers.


text: Training and Awareness Our employees undertake cybersecurity and data privacy training during onboarding. The majority of our employees complete annual refresher modules. JFrog also maintains a secure-code training program for developers and quarterly phishing simulation to improve our employees' awareness. Any employee who does not meet our performance expectations in such simulations is required to undergo additional training.


text: Engagement with Third-Parties on Risk Management Given the complexity and evolving nature of cybersecurity threats, we engage with a range of external experts, including cybersecurity assessors, consultants, and auditors in evaluating and testing our risk management systems. These partnerships enable us to leverage specialized knowledge and insights, helping our cybersecurity strategies and processes remain consistent with applicable generally adopted industry best practices. Our collaborations with these third parties include: • regular audits, threat assessments and penetration testing; • consultation on security enhancements; • bug bounty program for identifying security weaknesses in our products and services; • designing partnership with third party vendors; • using our in-house security tools as customers; and • global incident response experts for potential critical cybersecurity events.


text: As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For more detailed information about the cybersecurity risks we face, please see Item 1A, "Risk Factors," in this Annual Report on Form 10-K, including Risks Related to Privacy, Data Protection and Cybersecurity: "A breach of our security measures or unauthorized access to proprietary and confidential data, or a perception that any security breach or other incident has occurred, may result in our platform or products being perceived as not secure, lower customer use or stoppage of use of our products, and significant liabilities."


text: Our Board of Directors considers cybersecurity as part of its overall risk oversight function and believes it has established robust oversight mechanisms to support effective governance in managing risks associated with cybersecurity threats. All of our Board members have experience in the technology industry and our CTO, Yoav Landman, is a member of our Board. Data protection under their guidance and oversight remains a strategic priority at the highest levels of our organization. The Board has delegated to the Audit Committee the responsibility to oversee the information security program (see below) and is also updated regularly regarding matters discussed with the Audit Committee.


text: The Audit Committee is responsible for oversight of our information security program and receives reports at least quarterly from executive management, including the CSO, CTO, and CIO, concerning cybersecurity matters. The Audit Committee's charter directs that the committee oversee and periodically review the Company's risks related to privacy, cybersecurity, and information and technology security, including: • discussing with management the Company's plans to mitigate cybersecurity risks and response to data breaches; • reviewing any reports from management on data breaches, and • overseeing the disclosure of any significant risks and incidents to the extent required by applicable law, including SEC rules and regulations.


text: Our CSO, who reports directly to our CTO, works closely with our CIO who reports directly to our Chief Executive Officer. Over the past two decades, our CIO has held various positions in information technology and information security, including as CIO in two public companies, managing and controlling cybersecurity long-term programs and risks. Both our CTO, who is a co-founder of JFrog and is also a member of our Board, and our CSO have extensive experience assessing and managing cybersecurity programs and cybersecurity risks, and they work closely to define the initiatives of our cybersecurity program, the CSO organization structure and cyber business continuity plan planning. Our CTO is updated regularly on the status of our cybersecurity program. This allows us to address emerging threats and make informed decisions in real-time and to protect our systems on a timely basis.


text: Finally, our VP of Internal Audit leads an annual internal audit plan which includes a cybersecurity, privacy, or information technology security component. Internal audit findings are reported to the Audit Committee on a quarterly basis.


text: Cybersecurity Risk Management and Strategy The Company employs a tiered structure of management and oversight for cybersecurity, characterized by distinct layers of responsibility and decision making, which includes operation staff, management, and senior management and board-level governance. As discussed in more detail below under "Cybersecurity Governance," this involves management responsibility through a specialized Cyber Risk Committee (the "CRC") and oversight of that committee by a group of the most senior leaders of the Company, which comprise the Company's Executive Committee. At the Company's Board of Directors (the "Board") level, the Audit Committee oversees our cybersecurity risk management program.

companyName: REGENCY CENTERS LP


text: Our strategy for managing cybersecurity risk is integrated into the Company's overall risk management program and structure, as depicted in the Corporate Governance section of our Proxy under "Risk Oversight."


text: The Company, through its Chief Information Security Officer ("CISO"), other Company employees experienced in information network security, and the use of third-party expertise, references various recognized cybersecurity frameworks, such as the National Institute of Standards and Technology Cybersecurity Framework. These frameworks are used to benchmark and tailor the Company's cybersecurity strategies and program to our risk profile and specific operational needs and goals. Our core cybersecurity strategy focuses on five key pillars: identification, protection, detection, response, and recovery, each tailored to meet the specific challenges and needs of our business. The primary goal of this strategy is to proactively safeguard the confidentiality, security, and availability of the information we collect and store. This proactive approach includes attempts to identify, prevent, and mitigate cybersecurity threats, as well as preparing to quickly respond to cybersecurity incidents to minimize their impact. Under the leadership of our CISO and CRC, we regularly evaluate and enhance our cybersecurity practices to facilitate adaptation to the constantly evolving landscape of cybersecurity threats.


text: Since at least January 1, 2022, we are not aware of any cybersecurity incidents that have materially affected the Company. Based on our current understanding of the cyber risk environment and our preparedness level, we do not believe it to be reasonably likely in the near term that a cybersecurity threat will materially impact our business strategy, results of operations or financial condition. Nonetheless, we face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. See "Risk Factors – The unauthorized access, use, theft or destruction of tenant or employee personal, financial or other data, or of Regency's proprietary or confidential information stored in our information systems or by third parties on our behalf, could impact operations, and expose us to potential liabilities and material adverse financial impact."


text: Cybersecurity Governance The Audit Committee of the Board is charged with overseeing our cybersecurity risk management program. The CRC Chair and the CISO provide the Audit Committee with regular updates. These updates cover the overall status of the Company's cybersecurity program, as well as developments and potential new risks and trends. In the event of a significant cybersecurity threat or incident, the CRC would escalate communication frequency and intensity with the Audit Committee, Board, and the Company's Executive Committee (discussed below).


text: Cybersecurity risk oversight continues to remain a top priority for the Board of Directors. The Board of Directors is responsible for oversight of the Company's information security program, including risks of cybersecurity threats. The Risk Oversight Committee and Audit Committee, which support the Board of Directors in the oversight of the Company's information security program are focused on risks from cybersecurity threats, including incident response planning, timely identification and assessment of incidents, incident recovery, and business continuity considerations. The Risk Oversight Committee members have varied expertise and experience including risk management, technology, and finance, equipping them to oversee cybersecurity risks effectively. The Risk Oversight Committee has delegated day-to-day oversight of our information security program to our executive officers, including the Vice President of Information Technology ("VP of IT") along with our Global Cybersecurity Director ("Director"). The Director reports to the VP of IT and is a 31-year veteran of the information technology industry having served in the military and with a Fortune 500 company with over 20 years of cybersecurity experience including leading incident responses, policy development, and building security architectures. The VP of IT and the Director regularly meet with our President and Chief Financial Officer to inform them of matters related to cybersecurity risks and incidents. These meetings are designed to ensure that the highest levels of management are kept abreast of the cybersecurity posture and potential risks facing the Company. Furthermore, significant known cybersecurity matters, and strategic risk management decisions are escalated to the Board of Directors, ensuring that the Board of Directors has oversight and can provide guidance on critical cybersecurity issues. We believe our information security team is well positioned to identify risks from cybersecurity threats based on numerous job qualifications and on-going training.

companyName: DIODES INC /DEL/

ticker: DIOD


text: Our incident response team, headed by the Director and VP of IT, reports material cybersecurity incidents to our executive officers and to our Board of Directors. The Company has an information security advisory board comprised of senior leaders within the Company. These senior leaders include representation from functions including product line, sales and marketing, manufacturing, legal, finance, human resources, supply chain, information technology, and regional representation. Responsibilities of the advisory board include: • advise on creation and implementation of information security policy; • advise on information security strategic roadmap and investments; • review, advise, and promote security education, training, and awareness; • review and advise on ongoing legal, regulatory, compliance, threat landscape, risks, industry news, and trends concerning cyber security; and • review and advise on the mitigation of cybersecurity risks and potential incidents.


text: The Company has internal disclosure committees made up of members of management to assist in fulfilling its obligations to maintain disclosure controls and procedures and to coordinate and oversee the process of preparing our periodic securities filings with the SEC. The disclosure committees are composed of members of management and is chaired by our Vice President and Corporate Controller. The disclosure committees meet on a quarterly basis and more often if necessary. The Company has policies and procedures in place to ensure that our disclosure committees are appropriately informed of any matters that should be considered in advance of applicable public filings, including cybersecurity and data privacy matters, and to address the proper handling and escalation of information to management and the Board of Directors, the Risk Oversight Committee, and/or the Audit Committee.


text: Management provides cybersecurity-related legal, regulatory, compliance, risk, and relevant industry and internal threat updates to the Board of Directors on a quarterly basis, or more frequently as needed. The reports provide information regarding the state of the Company's information security program, the nature, timing, and extent of cybersecurity incidents, if any, and the Company's resolution to such matters.


text: We have defined policies and procedures for cybersecurity incident detection, containment, response, and remediation and have adopted physical, technological, and administrative cybersecurity and data privacy controls. In particular, the Company has established a cybersecurity incident response plan includes classification of cybersecurity incidents, to whom to escalate an incident, and when to escalate a cybersecurity incident, including direct communication to the VP of IT, Director, and President. The Company regularly conducts vulnerability assessments and tracks remediation to completion. Critical systems are periodically audited against industry standards.


text: To minimize our risk and exposure to material cybersecurity incidents, we also conduct company-wide annual and ongoing cybersecurity awareness training and education of our employees. This includes but not limited to topics such password hygiene, phishing, and other cybersecurity-related information. In addition to performing an annual risk assessment and developing a detection and mitigation plan, along with a comprehensive review and update of our cybersecurity and data privacy policies and procedures, we continuously evaluate new and emerging risks and ever-changing legal and compliance requirements. Our comprehensive information security program includes agreements with third-party cybersecurity partners for continuous monitoring, alerting, and response. To supplement our cybersecurity and data privacy risk assessment, identification, management, and mitigation efforts, we regularly consult with third-party experts, which include the following services: • conduct annual cybersecurity and data privacy risk assessments; • conduct external and internal penetration tests; • monitor critical infrastructure for abnormal behavior; and • provide validation of the Company's cybersecurity and operations processes against the National Institute of Standards and Technology cybersecurity framework.


text: Impact of cybersecurity risks on business strategy, results of operations or financial condition Cybersecurity threats, such as threats of attacks from computer hackers, cyber criminals, nation-State actors, and other malicious internet-based activity, continue to increase. Cybersecurity threats may also include threats of attacks involving social engineering and cyber extortion to induce customers, contractors, business partners, third-party service providers, employees, and other third parties to disclose information, transfer funds, or unwittingly provide access to systems or data.


text: We believe that our current preventative actions and response activities provide adequate measures of protection against security breaches and generally reduce our cybersecurity risks. However, cybersecurity threats are constantly evolving, are becoming more frequent and more sophisticated, and are being made by groups of individuals with a wide range of expertise and motives, which increases the difficulty of detecting and successfully defending against them. While we have implemented measures to safeguard our operational and technology systems and have established a culture of continuous learning, monitoring, and improvement, the evolving nature of cybersecurity attacks and vulnerabilities means that these protections may not always be effective. However, to date, management has determined that none of the cybersecurity attacks the Company experienced have resulted in a material impact to its financial condition, results of operations, or business strategy. In the ordinary course of our business, we have experienced and expect to continue to experience cyber-based attacks and other attempts to compromise our information systems, although none, to our knowledge, has had a material adverse effect on our business, financial condition, or results of operations. While we do not believe cybersecurity threats are reasonably likely to affect us, our business strategy, our results of operations, or our financial conditions, like all technology companies, we face a risks of such threats, the consequences of which could be material. See Item 1A – Risk Factors – "System security risks, data protection breaches, cyber-attacks and other related cybersecurity issues could disrupt our internal operations, and any such disruption could reduce our expected net sales, increase our expenses, damage our reputation, and adversely affect our stock price," above. In addition, given the constant and evolving threat of cyber-based attacks, we incur significant costs in an effort to detect and prevent security breaches and incidents, and these costs may increase in the future.


text: Risk management and strategy We implement and maintain various information security processes designed to identify, assess and manage material risks from cybersecurity threats to our critical computer networks, third party hosted services, communications systems, hardware and software, and our critical data, including intellectual property and confidential information that is proprietary, strategic or competitive in nature ("Information Systems and Data").

companyName: NETGEAR, INC.

ticker: NTGR


text: Our cybersecurity functions include representatives from information technology, engineering, information security, legal, impacted business units or products and other departments as applicable (together, the "Cybersecurity Team") helps identify, assess and manage the Company's cybersecurity threats and risks. The Cybersecurity Team is responsible for identifying, assessing and managing cybersecurity risks by monitoring and evaluating our threat environment using various methods including, for example manual and automated tools such as vulnerability scans, penetration tests and a public bug bounty program; subscribing to reports and services that identify cybersecurity threats; conducting risk assessments and internal and external audits; using external intelligence feeds; and conducting tabletop incident response exercises.


text: Depending on the environment, we implement and maintain various technical, physical, and organizational measures, processes, standards and policies designed to manage and mitigate material risks from cybersecurity threats to our Information Systems and Data, including, for example: (1) having an information security incident response plan for incident detection and response; (2) maintaining a disaster recovery plan, business continuity program, vulnerability management process and vendor risk management process; (3) conducting periodic risk assessments and employee training on cybersecurity; (4) maintaining security controls intended to address certain recognized industry cyber frameworks; (5) encrypting and segregating data, having network security controls, access controls and physical security, monitoring systems, managing assets (tracking and disposal) and conducting penetration testing; and (6) maintaining cybersecurity insurance.


text: Our assessment and management of material risks from cybersecurity threats are integrated into the Company's overall risk management processes. For example, (1) cybersecurity risk is addressed as a component of the Company's enterprise risk management program; (2) our Cybersecurity Team works with our management team in an effort to prioritize our risk management processes and mitigate cybersecurity threats that are more likely to lead to a material impact to our business; (3) our Cybersecurity Team and management team evaluates material risks from cybersecurity threats against our overall business objectives and reports to the cybersecurity committee chairperson of the board of directors who may then notify the cybersecurity committee and board of directors (as appropriate), to further evaluate our overall enterprise risk.


text: We use third-party service providers to assist us from time to time in an effort to identify, assess, and manage material risks from cybersecurity threats. For example, these service providers include professional services firms, threat intelligence service providers, managed cybersecurity service providers, penetration testing firms and forensic investigators. We also have a public bug bounty program.


text: We use third-party service providers to perform a variety of functions throughout our business, such as using application providers for core applications (including finance, HR, CRM, email services, collaboration tools etc.), hosting companies for our websites, contract manufacturing organizations, distributors and supply chain resources for software, hardware, manufacturing and distribution of our products. We have a vendor management process designed to manage cybersecurity risks associated with our use of these providers. This process includes risk assessments, security questionnaires, review of vendor security programs, review of available security assessments, reports, and audits. Depending on the nature of the services provided, the sensitivity of the Information Systems and Data at issue, and the type of provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with a provider and impose contractual obligations related to cybersecurity on the provider.


text: For a description of the risks from cybersecurity threats that may materially affect the Company and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this Annual Report on Form 10-K, including "Product security vulnerabilities, system security risks, data protection breaches, cyber-attacks, improper use of artificial intelligence ("AI") tools, and other threats and risks, could disrupt or otherwise compromise our products, services, internal operations or information technology systems, or those of third parties with whom we work. Actual or perceived non-compliance with our privacy and security obligations could lead to regulatory investigations or actions, litigation, fines and penalties, business operation disruption, reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse business consequences.".


text: The cybersecurity committee receives periodic notices (written and verbal) from the Cybersecurity Team concerning the Company's significant cybersecurity threats and risk and the processes the Company has implemented that are intended to address them. The cybersecurity committee also receives quarterly reports, summaries or presentations related to the Company's cybersecurity program as it relates to both our corporate systems and products.


text: We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats that could adversely and materially affect the confidentiality, integrity, and availability of our information and information systems. We maintain administrative, technical, and physical safeguards designed to protect the security and privacy of confidential, personal and proprietary information. Our cybersecurity program is aligned with notable control frameworks such as the NIST CSF (National Institute of Standards and Technology Cybersecurity Framework) and ISO (International Organization for Standardization) 27001.

companyName: Arthur J. Gallagher & Co.

ticker: AJG


text: Our cybersecurity program leverages people, processes, and technology to identify and respond to cybersecurity threats. We have a global incident response capability supported by our Security Operations Center (which we refer to as SOC) team, a managed security service provider (MSSP) and our global Cybersecurity Incident Response Team (which we refer to as CSIRT), which provides threat detection and incident response.


text: We maintain a global cybersecurity incident response plan and related playbooks, for execution by the SOC team and CSIRT, in coordination with internal and external stakeholders, as applicable. Significant incidents are escalated to a cross-departmental team to assess materiality based on qualitative and quantitative factors. This team consists of executives representing core business functions, including, among others, information technology, legal, finance, accounting, data protection and business divisions, in consultation with third-party advisors, as applicable. We undertake periodic leadership tabletop exercises and periodic adversarial ("red team") exercises simulating incident response under common risk scenarios. As an acquisitive organization, we have also established a program to increase our visibility into the cybersecurity environment of acquisition targets prior to closing.


text: We have established a dedicated vendor assessment team, which employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or that otherwise implicates the third-party technology and systems we use. We also require cybersecurity insurance coverage for vendors whose services or products may present a cybersecurity risk.


text: We continuously test and assess our cybersecurity posture, including through annual third-party risk assessments performed by reputable assessors, consultants and auditors. A global FAIR (Factor Analysis of Information Risk) assessment is conducted at least annually to update our cybersecurity risks and corresponding mitigations.


text: Our employees complete training on data security and our policies when they join us and annually thereafter. We review the content of our mandatory training annually, and provide access to a comprehensive set of supplemental training.


text: Our Chief Information Security Officer (CISO), working together with our Chief Information Officer (CIO), oversees a team of employees dedicated to cybersecurity. Our CISO receives ongoing updates from the cybersecurity team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents and regularly reports to the CIO. Our CISO is an active member of our management-level enterprise risk management committee, which has broad oversight of the company's enterprise risks, including cybersecurity risks. In addition, our CIO and CISO both attend regular meetings of the executive officer team, including our Chief Executive Officer, Chief Financial Officer, General Counsel and other senior executive officers, dedicated to compliance and risk, and report on cybersecurity matters as appropriate. Our Board of Directors has delegated primary responsibility for the oversight of cybersecurity matters to its Risk and Compliance Committee; however, the full board reviews significant cybersecurity matters as appropriate. Our CIO and CISO report on cybersecurity and information security at each quarterly meeting of the Risk and Compliance Committee.


text: Our CIO has more than 30 years of experience, including from his prior business and technology leadership roles at Aegon N.V., Citigroup, Inc. and JP Morgan Chase & Company. Our CISO has more than 20 years of cybersecurity experience. Prior to joining us, he was Senior Vice President, Chief Information Security Officer at Brighthouse Financial. Before then, he served as Technology Vice President & Chief Information Security Officer for GE Healthcare. He started his career at Allstate Insurance Company. He also holds security, privacy and risk certifications, including Certified Information Systems Auditor, Certified Information Security Manager and Certified Information Systems Security Professional.


text: We, including our third-party vendors, have experienced cybersecurity incidents and threats and may continue to experience them in the future. Based on the information available as of the date of this Annual Report on Form 10-K, we believe that during the last three fiscal years risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition, and as of the date of this Annual Report on Form 10-K, the Company is not aware of any material risks from cybersecurity threats that are reasonably likely to do so. However, we cannot eliminate all risks from cybersecurity threats or provide assurances that the Company will not be materially affected by such risks in the future. Due to evolving cybersecurity threats, we may not be able to protect all information systems and, as an acquisitive organization, integrating information systems as we acquire new businesses may expose us to unexpected liabilities or increase our vulnerability. There can be no guarantee that our policies, programs and controls, and those of our third-party vendors, including those described in this section, will be sufficient to protect our information, information systems or other property. Additional information on cybersecurity risks we face is discussed in Item 1A of Part I, "Risk Factors," which should be read in conjunction with the foregoing information.


text: Cyber Risk Management and Strategy The Company recognizes the increasing significance of cybersecurity threats in today's digital landscape and has implemented a cyber risk management program to identify, assess, manage, mitigate and respond to cybersecurity threats. This program is integrated within the Company's enterprise risk management program. Our approach is designed to safeguard sensitive information, protect critical assets and maintain the integrity of our operations.

companyName: DNOW Inc.

ticker: DNOW


text: • Regular assessments of cyber risks, taking into account the evolving threat landscape, technological advancements and changes in our business operations. • Proactive identification and mitigation of vulnerabilities in our information systems through regular scanning, testing and patch management. • Implementing and continuously monitoring security controls, including firewalls, intrusion detection systems, encryption and access controls, to safeguard against unauthorized access and data breaches. Our controls are based on the latest Center of Internet Security (CIS) Critical Security Controls best practices for cybersecurity and the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). • Regular testing of our Cyber Incident Response Plan through tabletop exercises to ensure a swift, coordinated and effective response in the event of cyber incidents to minimize impact on operations. As part of our cyber incident response process, we also engage third-party experts as needed, such as external legal advisors and cybersecurity forensic firms.


text: Our governance structure is designed to ensure effective oversight and management of cybersecurity risks: • The Board of Directors is actively engaged in overseeing cybersecurity matters, receiving regular briefings and ensuring alignment between cybersecurity strategy and overall business strategy. • A dedicated committee oversees cybersecurity governance, assessing policies, practices and risk mitigation strategies and ensuring alignment with industry best practices. • Our executive leadership team actively participates in the development and execution of cybersecurity strategy, reinforcing the importance of cybersecurity at the highest levels of the organization. • IT and Cybersecurity reports to the Chief Administrative and Information Officer (CAIO) who provides updates to the dedicated committee.


text: Chemours recognizes the critical importance of maintaining a cybersecurity program to provide a secure and reliable computing environment protecting our information, systems and assets and to enable our digital transformation goals. Our cyber and information security program (the "Program") is based upon standards published by the National Institute of Standards and Technology ("NIST") in their Cybersecurity Framework. The goals of our Program are: • identifying, preventing, and mitigating cybersecurity threats to the Company; • preserving the confidentiality, security, and availability of the information that we collect and store to use in our business; • protecting our intellectual property; • maintaining the confidence of our customers, business partners and other stakeholders; and • providing appropriate public disclosure of cybersecurity risks and incidents, when required.

companyName: Chemours Co

ticker: CC


text: The Chief Information Security Officer ("CISO") is the Chemours executive principally responsible for managing and maintaining the Program, is accountable for managing risk, ensuring that the organization's security posture is aligned with its business objectives, and providing timely updates to senior management on such efforts. The CISO reports to the Chief Information Officer. The current CISO has more than seven years with Chemours and over 25 years of total cyber and information security experience with multiple companies across both the private and public sector in CISO and other information security roles.


text: We educate our employees and contractors annually on cyber risks and prevention, monthly using online situational awareness training, active employee engagement, and ongoing phishing simulations.


text: A key part of our strategy for managing risks from cybersecurity threats is the ongoing assessment and testing of our processes and practices through auditing, assessments, tabletop exercises, threat modeling, and other exercises focused on evaluating the effectiveness of the Program.


text: The Chemours Company The board of directors is responsible for oversight of our Enterprise Risk Management process ("ERM") and is informed of the risks associated with cybersecurity through periodic ERM updates. The Board has also delegated oversight of the cybersecurity and information security programs and processes for assessing, identifying and managing material risks from cybersecurity threats to the Audit Committee. The Audit Committee regularly meets with the CISO to review and discuss cybersecurity risks, the status of ongoing cyber initiatives and strategies, incident reports and learnings, as well as key performance indicators. The results of any cyber risk assessments, audits, and reviews are reported to the Audit Committee and, ultimately, the board of directors, and we adjust our cybersecurity policies, standards, processes and practices as necessary based on the information provided by the assessments, audits and reviews.


text: Our IRPs, which are tailored to address potential cybersecurity threats in both our product and corporate infrastructure technology environments, are designed to provide a comprehensive, structured response to cybersecurity incidents, and apply to all Strategy personnel, including employees, directors, temporary staff, and contractors. In accordance with our IRPs, we train our personnel to report any cybersecurity incidents to our Information Security Team (IST). Upon identification of a cybersecurity incident, the IRPs mandate that the IST conduct an immediate evaluation and assign a severity rating to the incident and, depending on the severity, report the incident to our Chief Information Security Officer (CISO). Based on the severity of the incident, a Security Incident Response Team (SIRT), the members of which include our Chief Technology Officer (CTO), the CISO, and personnel from various departments, including legal, is convened. The SIRT, with assistance from the IST, is tasked with executing a timely and effective response to the incident, and SIRT members are assigned specific roles and responsibilities, including assessment of the incident's materiality for disclosure purposes.

companyName: Strategy Inc

ticker: MSTR


text: Our CTO and CISO oversee our cybersecurity preparedness. Our CTO has over 25 years of experience in the technology sector, including specifically in the cybersecurity industry, and held various leadership positions prior to joining Strategy in 2018. Our CISO, who joined Strategy as CISO in 2021, has over 20 years of experience with cybersecurity and privacy, and has experience with IT infrastructure technologies, including cloud, network, server, endpoint, and mobile technologies. Our CISO holds a master's degree in computer science and multiple industry-recognized cybersecurity certifications. The IST operates under our CISO's leadership, who in turn reports to our CTO.


text: We administer our cybersecurity risk management framework separately from our other risk management systems and processes, under the oversight of the audit committee of our board of directors and senior management. Strategy's management, including our CTO and CISO, provides the audit committee with regular updates on cybersecurity incidents and emerging threats. The audit committee actively engages with management on the development and implementation of cybersecurity policies and practices, offering insights and guidance. Additionally, board members with significant experience in software technology, such as Michael J. Saylor and Leslie J. Rechan, each with over 30 years of software industry experience, and Phong Le, our Chief Executive Officer, contribute their expertise to our cybersecurity risk management.


text: Unauthorized parties have attempted, and we expect that they will continue to attempt, to gain access to our systems and facilities, as well as those of our third-party vendors, through various means, such as hacking, social engineering, phishing, and fraud. However, the Company does not believe that there are currently any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. See "Item 1A. Risk Factors – Risks Related to Our Bitcoin Strategy and Holdings – If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected" and "Item 1A. Risk Factors – Risks Related to Our Operations – If we or our third-party service providers experience a disruption due to a cybersecurity attack or security breach and unauthorized parties obtain access to our customers', prospects', vendors', or channel partners' data, our data, our networks or other systems, or the cloud environments we manage, our offerings may be perceived as not being secure, our reputation may be harmed, demand for our offerings may be reduced, our operations may be disrupted, we may incur significant legal and financial liabilities, and our business could be materially adversely affected."


text: Key elements of our cybersecurity risk management program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls, and (3) our response to cybersecurity incidents; • a documented set of cybersecurity policies and procedures that specifies the manner in which security controls are implemented; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel, and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for key service providers based on our assessment of their criticality to our operations and respective risk profile,, suppliers, and vendors who have access to our critical systems and information.

companyName: IDEAYA Biosciences, Inc.

ticker: IDYA


text: We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us. For more information, see the section titled "Risk Factor— Our information technology systems, or those of our collaborators, CROs or other contractors or consultants, may fail or suffer security breaches, which could adversely affect our business. Security breaches, loss of data or financial assets, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee, or the Committee, oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program. The Committee is composed of members of our board of directors with diverse expertise, including risk management, public accounting, biotechnology, chief executive officer roles, and multiple public company directorships, which has prepared them to oversee our cybersecurity risks.


text: The Committee receives quarterly reports from management on our cybersecurity risks. In addition, management updates the Committee where it deems appropriate, regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to our full board of directors regarding its activities, including those related to cybersecurity. The full board of directors also receives briefings from management on our cybersecurity risk management program. Board members receive presentations on cybersecurity topics from our Senior Vice President, or SVP, Head of Finance and Investor Relations, Senior Vice President, General Counsel, internal security staff and external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Andres Briseno, our SVP, Head of Finance and Investor Relations and, Douglas Snyder, our Senior Vice President, General Counsel, are primarily responsible for assessing and managing our material risks from cybersecurity threats. Mr. Briseno and Mr. Snyder have primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Mr. Briseno has served in a number of significant leadership roles at our company since 2016, including oversight of investor relations, business operations and corporate developments, and was appointed as SVP, Head of Finance and Investor Relations in 2023. Mr. Snyder has served in a number of significant leadership roles in various companies in the healthcare industry, and provided an oversight to legal and compliance teams with his broad legal background. Prior to joining our company, Mr. Snyder served in senior leadership and operations roles across healthcare field, including biotechnology, pharmaceuticals and the FDA. Further, our management team's experience includes monitoring the cybersecurity landscape for new risks and best practices, developing and executing cybersecurity strategies, overseeing related governance policies, testing compliance with applicable technical standards, remediating known risks and leading employee training programs.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel; threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us; and alerts and reports produced by security tools deployed in the information technology environment.


text: The Company has a long-standing management-led Risk Committee (the "Risk Committee") which is currently comprised of the President and Chief Executive Officer (who serves as the chair), Chief Financial Officer, General Counsel, Chief Compliance Officer, Chief Internal Auditor, Risk & Insurance Program Manager, Senior Vice President - American InterContinental University System, Senior Vice President - Colorado Technical University, Chief Information Officer and Vice President - Human Resources. The Risk Committee reviews enterprise-wide, business-unit specific and other discrete topic risk surveys and assessments, including cybersecurity risk. The Risk Committee reports identified cybersecurity risks, risk assessment and mitigation processes, effectiveness of risk management and related matters to the Committee.

companyName: PERDOCEO EDUCATION Corp

ticker: PRDO


text: We have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks by comparing our processes to standards set by the Center for Internet Security ("CIS"). As part of these efforts to assess and mitigate the risks posed by cybersecurity incidents and cyber-attacks, we employ a range of tools and services, including regular network and endpoint monitoring, vulnerability assessments, penetration testing, and tabletop exercises to help inform our cybersecurity risk identification and assessment. We also maintain an information security policy, which addresses privacy of student records under the Family Education Rights and Privacy Act of 1974 ("FERPA"), and require annual information technology security awareness training by employees. We also maintain a cybersecurity risk insurance policy as an additional element of our risk mitigation strategy.


text: We describe whether and how risks from identified cybersecurity threats have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the headings "If we, our third-party vendors, our regulators or any other quasi-governmental organization we are required to report information to are subject to cyberattacks, data breaches or other security incidents, or if there is a disruption or failure of our information technology systems or software, such events could expose us to liability and could adversely affect our financial condition and operating results," "The personal information that we collect may be vulnerable to breach, theft or loss, any of which could adversely affect our reputation, operations and ability to attract and retain students," and "Our primarily remote work environment may exacerbate the risks related to our business technology infrastructure," included as part of our risk factor disclosures within Item 1A of this Annual Report on Form 10-K. We have not encountered risks from cybersecurity threats, including as a result of any previous cybersecurity incidents in the last three fiscal years, which have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition, and the expense we have incurred from cybersecurity incidents were immaterial.


text: DFIN engages assessors, consultants, auditors and specialized third parties to enhance the Company's cybersecurity posture. These collaborations provide evaluations, audits and insights to fortify DFIN's resilience against evolving cyber threats. The DFIN Cybersecurity Program is based upon industry leading frameworks, which include International Standardization Organization ("ISO") 27001, the National Institute of Technology Cybersecurity Framework ("NIST CSF") and Control Objectives for Information Technology (COBIT). The Company's technologies and software must also comply with domestic and international regulatory and legal requirements. Ensuring that these technologies and software comply with those regulations is a key focus of the Company's efforts. DFIN has cyber incident response partners that conduct penetration testing and other exercises throughout the year whereby cybersecurity controls effectiveness is evaluated and reported to management. DFIN engages a third-party auditor to ascertain its cybersecurity risk management effectiveness as a part of its enterprise ISO 27001 certification process. The ISO 27001 certification process is highly prescriptive and covers cyber risk management methodology, risk assessment and risk treatment. DFIN has adopted the NIST CSF and engages a consultant to periodically assess the Company's NIST CSF profile and maturity. DFIN also obtains System and Organization Control ("SOC") Type 2 certification demonstrating control effectiveness across multiple American Institute of Certified Public Accountants (AICPA) Trust Service Principle domains.

companyName: Donnelley Financial Solutions, Inc.

ticker: DFIN


text: The Company leverages cybersecurity technologies designed to provide for the security of client, employee and business confidential data. The Company's cybersecurity portfolio is inclusive of, but not limited to, data encryption, data masking, leading secure software development methodologies, application and network penetration testing, incident response, digital forensics, least-privileged access controls, anti-malware, end-point detection and response, virtual private networks and cyber threat intelligence. In addition, the Company manages a 24x7 Security Operations capability that monitors and responds to cyber threats.


text: DFIN maintains a comprehensive third-party risk management program, referred to as "Supply Chain Security." The program evaluates critical suppliers for inherent risk and classifies suppliers according to the overall risk they present to the Company. The program also includes evaluations of existing suppliers and third parties for ongoing risk. A supplier's classification rating determines the frequency with which it is evaluated. For example, those identified as critical suppliers are monitored on a quarterly basis, or more frequently if an event occurs that could elevate the risk, and assessed at a higher frequency than other suppliers. Generally, these reviews include an evaluation of the effectiveness of a supplier or third party's cybersecurity along with the risks associated with adding and/or integrating this third party into the DFIN ecosystem. New and existing suppliers that are determined to pose a material risk may be rejected or have their contracts terminated. Supply chain and third-party risk continues to be a top cybersecurity threat vector, and DFIN's robust processes continue to oversee and identify cybersecurity risks associated with the Company's use of third-party service providers. The Company believes that its regular assessments and due diligence help mitigate potential vulnerabilities relating to these relationships.


text: DFIN's initiatives and internal goals incorporate cybersecurity, including cyber risk requirements and cyber risk analysis. To deliver upon regulatory, client and Company cybersecurity objectives, the Company made investments to support processes, architectures and system operations models which specifically address cyber risk, including but not limited to threat detection and response capabilities, end point detection, incident response partnerships and other services provided by managed security service providers. The Company leverages cybersecurity technologies designed to ensure security of client, employee and business confidential data. Mitigating cybersecurity risk is also a part of DFIN's overall business strategy and is further evidenced by programmatic endeavors such as adopting a Zero Trust Architecture wherein all users, systems, applications and networks are deemed untrusted and must be verified. Separately, part of DFIN's corporate strategy includes maintaining adequate cybersecurity insurance. During the renewal process underwriters evaluate all aspects of DFIN's cybersecurity posture, providing another annual evaluation of the Company's cyber risk management.


text: Risks from cybersecurity threats, including those described in Part I, Item 1A. Risk Factors, factor into many facets of DFIN's operations and have a direct influence on business strategy. For example, cybersecurity risk considerations may be factored into how DFIN's products are designed and technology is selected. Cybersecurity risk also informs how the Company educates and trains its employees. In 2024, the Company conducted monthly simulations to train employees to detect and respond to various cyber attack vectors like phishing, vishing and smishing attempts and provides enhanced training to employees who fail a simulated cyber attack. DFIN also conducted quarterly IT training on topics such as risk detection and reporting, data handling and provided targeted cybersecurity threat awareness and training to executives during 2024. The Company reviews its Incident Response plans and conducts tabletop exercises throughout the year at different levels of the organization, including the executive team. These incident response and training initiatives are regularly evaluated to adapt to evolving cyber threats and awareness. The Company's goal is to create an ethos of "security first" and "security by design" and to have a culture (and accountability) that security is the responsibility of every DFIN employee.


text: DFIN's Board and senior management are engaged in managing and overseeing the Company's cyber risks. Internal Audit periodically reviews enterprise risk management topics as well as the effectiveness of information security controls and other procedures and reports significant findings to executive management, the Board or the Audit Committee, as appropriate. The Company's Chief Information Security Officer ("CISO") has approximately 30 years of cybersecurity experience overseeing enterprise cybersecurity risk management and compliance programs and has responsibility for assessing and managing cybersecurity risks. The CISO reports to the Chief Information Officer and leads multiple cybersecurity functions that consist of Cyber Defense and Threat Intelligence, Application Security, Network Security Engineering, Security Architecture, Identity Services and IT Governance as well as Risk and Compliance functions. As the front line of defense against cybersecurity risks, these functions employ numerous tools, processes and procedures to detect attempted cyber attacks, prevent cyber threats and monitor cyber risks. The functions are also engaged in incident response should incidents occur and are accountable for remediating cyber threats, if manifested.


text: We maintain insurance covering certain costs that may be incurred in connection with cybersecurity incidents, should they occur. However, there is no guarantee that such coverage will be sufficient to address costs, liabilities and damages we may incur in connection with a cybersecurity incident or that such coverage will continue to be available on commercially reasonable terms or at all.

companyName: FLOWERS FOODS INC

ticker: FLO


text: The company engages consultants and other third parties to identify and manage cybersecurity risks, including risks from third-party service providers that may impact the company.


text: No risks from cybersecurity threats, including as the result of previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect Flowers' business strategy, results of operations, or financial condition. However, we may incur significant costs in protecting or remediating cyber-attacks or other cyber incidents. If we are unable to prevent physical and electronic break-ins, cyber-attacks and other information security breaches, we may suffer financial and reputational damage, operational disruptions, be subject to litigation, civil or criminal investigations, regulatory intervention or incur costs related to remediation, payment of ransom or penalties, including as a result of unauthorized disclosure of confidential information belonging to us or to our partners, customers, suppliers or employees.


text: Governance. The company's board of directors (the "Board" or "Board of Directors") oversees the company's Information Security program, which is approved annually. The audit committee is tasked with oversight of certain risk issues, including cybersecurity, and regularly reports its activities to the Board of Directors. As described in its charter, the audit committee of the Board of Directors oversees risks related to information technology security and regularly reviews and discusses with the VP of Information Security and other members of management the company's information technology security risk exposures, including (a) the potential impact of those exposures on the company's business, financial results, operations and reputation, (b) the steps that management has taken to monitor and mitigate such exposures, (c) the company's information governance policies and programs, and (d) legislative and regulatory developments that could materially impact the company's privacy and data risk exposure.


text: At the management-level, the company's IT systems are overseen by our CIO, who has responsibility for information technology strategy and operations. The company's Information Security program is led by the company's VP of Information Security, who reports directly to the company's chief financial officer. The VP of Information Security has responsibility for information security strategy and operation. The VP of Information Security is responsible for managing and assessing material risks from cybersecurity threats. This individual has a variety of IT security skills, experiences and professional expertise, obtained through work experience and information security certifications and education.


text: Our Board of Directors recognizes the critical importance of maintaining the trust and confidence of our customers, clients, business partners and employees. The Audit Committee of the Board in conjunction with the Board is actively involved in the oversight of risk, and cybersecurity represents an important component of our overall approach to risk management. Our cybersecurity policies, standards, processes and practices, which are based on recognized frameworks established by the National Institute of Standards and Technology and other applicable industry standards, are fully integrated into our overall risk management. In general, we seek to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that we collect and store by seeking to identify, prevent and mitigate cybersecurity threats and effectively respond to cybersecurity incidents that may occur.

companyName: Enova International, Inc.

ticker: ENVA


text: Risk Management and Strategy Our cybersecurity risk management program is focused on the following key areas: • Governance. As discussed in more detail under the heading "Governance," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board, which regularly reviews the Company's cybersecurity risk management approach and interacts with various members of management. • Collaborative Approach. We use a comprehensive, cross-functional approach to identify, prevent and mitigate cybersecurity threats and incidents, and have implemented procedures designed to promptly escalate certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by senior management in a timely manner. • Technical Safeguards. We deploy technical safeguards that are designed to protect our information systems from cybersecurity threats, including next-generation firewalls, intrusion prevention and detection systems, antimalware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning. We have established and maintain incident response and recovery plans that address our response to a cybersecurity incident, and such plans are evaluated on a regular basis. • Third-Party Risk Management. We maintain a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of our systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. • Education and Awareness. We provide regular, mandatory training for personnel regarding cybersecurity threats as a means to equip our personnel with effective tools to address cybersecurity threats and to support this, we highlight best practices with a dedicated Cybersecurity month. We communicate the evolving information security policies, standards, processes and practices with personnel throughout the year.


text: Although we devote significant resources to implementing, maintaining, testing and upgrading our cybersecurity systems and processes, these security measures do not provide absolute security. Despite our efforts to maintain an effective cybersecurity risk management program, it is possible that our cybersecurity risk mitigation and prevention efforts may not be able to adequately mitigate or prevent all possible security breaches, whether because of the use of new techniques that may not be known or recognized, because cyber-attacks can originate from a wide variety of sources, or for other reasons. As of the date of this Annual Report on Form 10-K, we are not aware of any cybersecurity incident that has materially affected or is reasonably likely to materially affect our business, strategy, results of operations or financial condition; however, there can be no assurance that a cybersecurity incident that could have an adverse material impact on us will not occur in the future. See "Risk Factors—We are subject to cybersecurity risks and security breaches and may incur increasing costs in an effort to minimize those risks and to respond to cyber incidents."


text: Board and Audit Committee Oversight The Board, in coordination with the Audit Committee, oversees our risk management process, including the management of risks arising from cybersecurity threats. The Audit Committee receives regular presentations and reports on cybersecurity risks, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to our peers and third parties. The Board also receives scheduled periodic reports both directly from management and through the Audit Committee. Our procedures require that the Board and the Audit Committee also receive prompt and timely information regarding any significant cybersecurity incident that meets established reporting thresholds, as well as ongoing updates, until it has been addressed, which allows the Board and Audit Committee to provide comprehensive oversight and guidance on critical cybersecurity issues. On a periodic basis, the Board and the Audit Committee discuss our approach to cybersecurity risk management with our Chief Analytics and Technology Officer ("CTO"), IT Risk Management team leader ("Head of IT Risk") or other members of the IT Risk Management function.


text: Management's Role Our Head of IT Risk, with the CTO's oversight, is primarily responsible for assessing, monitoring and managing material risks from cybersecurity threats and manages our IT Risk Management team. The Head of IT Risk is currently a Certified Information Systems Security Professional (CISSP), with a Master of Science in Digital Forensic Science and has 18 years of cybersecurity work experience. The members of our IT Risk Management team have an average of five years of cybersecurity work experience with degrees in information technology and computer engineering. The Head of IT Risk works closely with the CTO, including holding bi-weekly meetings, to discuss cybersecurity risks and any changes in our cybersecurity policies and practices. The CTO, Head of IT Risk and IT Risk Management function work collaboratively across our company to implement a program designed to protect our information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents, if any, in accordance with our incident response and recovery plans.