text: Third Party Risk Management We also monitor and manage cybersecurity risks associated with our third-party service providers, including our managed security service provider, suppliers, customers and vendors, through, among other things, the processes set forth in our policies and procedures, due diligence processes, regular oversight, monitoring and auditing of our relationships by internal staff, supplier codes of conduct and escalation practices for reporting issues. We require our third-party providers to meet appropriate security requirements and controls prior to providing access to our internal systems, and investigate and report any security incidents, as appropriate.


text: Based on the information available as of the date of this Annual Report on Form 10-K, we are not aware of any risks from cybersecurity threats, including as a result of any cybersecurity incidents, which have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. Despite our security measures, however, there can be no assurance that we, or the third parties with which we interact, will not experience a cybersecurity incident in the future that will materially affect us. For more information, see "Risk Factors—Risks Related to Our Information Technology and Intellectual Property" in Part I, Item IA of this Annual Report on Form 10-K.

companyName: Vita Coco Company, Inc.

ticker: COCO

secItem: Item 1C


text: Cybersecurity Governance Risk assessment and oversight are an integral part of our governance and management processes. Our Board of Directors (the "Board") has ultimate oversight of the Company's risk management. In accordance with its charter, the Audit Committee of the Board is responsible for overseeing our enterprise risk management program on behalf of the Board, including material risks related to cybersecurity threats, and reporting on these matters to the Board. The Audit Committee receives regular updates from management, including the information technology and legal teams, on cybersecurity risk resulting from risk assessments and reviews any information on relevant internal and industry cybersecurity incidents and is notified between such updates relative to any incidents which could materially affect the Company. Based on this information, our Audit Committee monitors the Company's cybersecurity program, including potential threats, weaknesses and vulnerabilities, and reviews the policies and procedures in place to prevent, detect and respond to cybersecurity threats and unauthorized access to our information security systems. Significant findings related to cybersecurity, data and technology risks or incidents are regularly reported to and discussed at the Board level. Three members of our Board, included two of our Audit Committee members, are currently pursuing or have received certifications in cyber-risk oversight through the National Association of Corporate Directors.


text: Management, in coordination with our information technology department, is responsible for assessing the risk of cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Specifically, these processes are overseen by our multidisciplinary Technology Risk and Information Security Committee, which consists of leaders from our Information Technology, Operations, Internal Audit and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles across multiple industries involving information technology, risk management, operations and legal matters.


text: Cybersecurity Risk Management and Strategy We face significant and persistent cybersecurity risks due to the global nature of our business, the use of information technology systems, infrastructure and data in our business operations and our reliance on third-party vendors, suppliers, customers and business partners. We defend our systems against cybersecurity attacks on a daily basis and rely heavily on the reliability, security and efficiency of our information technology systems and ongoing employee training to face these threats. In addition, t o protect our business, we have implemented a cybersecurity risk management program with a robust governance structure and strong mechanisms, controls, technologies, and processes designed to help us assess, identify, and manage these risks.


text: To further protect our business, we partner with a third party vendor to provide cybersecurity and risk management as a managed service offering. They provide cybersecurity risk assessment and threat intelligence to the Company, in addition to acting as a managed service provider for our information technology program. We decided to retain a third party for these services given the small size of our Company and internal information technology staff and the quality, comprehensiveness, and cost-effectiveness of the services offered. An internal team, led by our Vice President of Information Technology, oversees and works collaboratively with this third party vendor to evaluate the strength of our cybersecurity protocols and the results of testing to determine what additional actions, such as trainings or remedial actions, are necessary to lessen cybersecurity risks. We intend to continue to make investments to monitor and maintain the security of our data and cybersecurity infrastructure.


text: Cybersecurity Governance Risk assessment and oversight are an integral part of our governance and management processes. The Board has ultimate oversight of the Company's risk management. In accordance with its charter, the Audit Committee of the Board is responsible for overseeing our enterprise risk management program on behalf of the Board, including material risks related to cybersecurity threats, and reporting on these matters to the Board. The Audit Committee receives regular updates from management, including the information technology and legal teams, on cybersecurity risk resulting from risk assessments and reviews any information on relevant internal and industry cybersecurity incidents and is notified between such updates relative to any incidents which could materially affect the Company. Based on this information, our Audit Committee monitors the Company's cybersecurity program, including potential threats, weaknesses and vulnerabilities, and reviews the policies and procedures in place to prevent, detect and respond to cybersecurity threats and unauthorized access to our information security systems. Significant findings related to cybersecurity, data and technology risks or incidents are regularly reported to and discussed at the Board level. Three members of our Board, two of which are Audit Committee members, have received certifications in cyber-risk oversight through the National Association of Corporate Directors.


text: Management, in coordination with our information technology department, is responsible for assessing the risk of cybersecurity threats and hiring appropriate personnel and third-party consultants to oversee the cybersecurity program. Specifically, these processes are overseen by our multidisciplinary Technology Risk and Information Security Committee, which consists of leaders from our Information Technology, Operations, Finance, Internal Audit and Legal teams. Such individuals have an average of over 15 years of prior work experience in various roles across multiple industries involving information technology, risk management, operations and legal matters.


text: Except as otherwise specifically stated therein, the description of the Company's cybersecurity risk management program set forth is as of February 3, 2024 (the last day of the Company's 2023 fiscal year), which was prior to the completion of the Sale Transaction. Although our Board of Directors (the "Board") still oversees cybersecurity risks, due to limited resources and personnel following the Sale Transaction, we currently no longer have in place the cybersecurity risk management program and governance structure described below, which may make us susceptible to heightened cybersecurity risks.

companyName: EXP OldCo Winddown, Inc.


text: RISK MANAGEMENT AND STRATEGY Cybersecurity risk management is an integral part of our enterprise risk management strategy, which is overseen by the Board. Cybersecurity is critical to maintaining the trust of our customers and business partners, and we are committed to protecting our and their confidential and sensitive information and to mitigating cybersecurity risks that impact our systems and networks. In order to respond to the threat of security breaches and cyberattacks, we have developed a program, overseen by our Chief Technology Officer, that is designed to assess, identify, and manage material risks from cybersecurity threats. Our information security program is focused on protecting and preserving the confidentiality, integrity and continued availability of all information owned by, or in the care of, the Company.


text: This program includes an incident response plan that provides controls and procedures for timely and accurate reporting of any material cybersecurity incident. We periodically conduct cross-functional tabletop training exercises to rehearse our response to cyber-related breach incidents or other major security events. We also mandate information security awareness training for all employees, along with testing employee readiness through phishing simulations and providing periodic security information updates.


text: We regularly perform evaluations of our information security program and continue to invest in our capabilities to keep our customers, partners, suppliers and information assets in our possession safe. Although we employ service provider due diligence and onboarding procedures to identify potential cybersecurity risk, our ability to monitor the cybersecurity practices of our service providers is limited and there can be no assurance that we can prevent or mitigate the risk of any compromise or failure in the information system, software, networks and other assets owned or controlled by our vendors.


text: The Board oversees our information security program. The Audit Committee of the Board (the "Audit Committee"), which is tasked with oversight of certain risk issues, including cybersecurity, receives reports from the Chief Technology Officer throughout the year. The Board and the Audit Committee also receive updates about the results of readiness assessments led by outside advisors who provide a third-party independent assessment of our technical program and our internal response preparedness. The Audit Committee regularly briefs the full Board on these matters, and the full Board also receives periodic briefings on cybersecurity threats to enhance our directors' literacy on security issues.


text: Our Chief Technology Officer is responsible for developing and executing our information security program. The Chief Technology Officer partners with key corporate functions for the purpose of identifying, considering and assessing material cybersecurity risks on an ongoing basis, establishing processes to ensure that such potential cybersecurity risks are monitored, implementing appropriate mitigation measures, reporting cybersecurity breaches and other information security incidents, and maintaining our information security program. The Chief Technology Officer has more than a decade of information technology leadership experience, including responsibility for cybersecurity matters. Our information security team, reporting to the Chief Technology Officer, have appropriate cybersecurity experience and education, including CISSP and CompTIA certifications. Our management team receives regular updates on our cybersecurity posture and reviews detailed information about our cybersecurity preparedness. At least quarterly, management provides the Board and the Audit Committee with updates about our cybersecurity and related risk exposures, our policies and procedures to mitigate such exposures and the status of projects to strengthen our information security infrastructure and program maturity and defend against and respond to cybersecurity threats.


text: Thred Up uses, stores and processes data for and about our customers, employees, partners and suppliers. We have implemented a cybersecurity risk management program that is designed to identify, assess, and mitigate risks from cybersecurity threats to this data, our systems and business operations.

companyName: ThredUp Inc.

ticker: TDUP


text: Cyber Risk Management and Strategy Under the oversight of the Board of Directors and Audit Committee, we have implemented and maintain a risk management program that includes processes for the systematic identification, assessment, management, and treatment of cybersecurity risks. Our cybersecurity oversight and operational processes are integrated into our overall risk management processes, and cybersecurity is one of our designated risk categories. We use the National Institute of Standards and Technology Cybersecurity Framework to guide our approach, ensuring a structured and comprehensive strategy for managing cybersecurity risks. We implement a risk-based approach to the management of cyber threats, supported by cybersecurity technologies, including automated tools, designed to monitor, identify, and address cybersecurity risks. In support of this approach, our Information Security team implements processes to assess, identify, and manage security risks to the company, including in the pillar areas of security and compliance, application security, infrastructure security, and data privacy. This process includes regular compliance and critical system access reviews. In addition, we conduct application security assessments, vulnerability management, penetration testing, security audits, and ongoing risk assessments as part of our risk management process. We also maintain an incident response plan to guide our processes in the event of an incident. We also have a process to require corporate employees to undertake cybersecurity training and compliance programs annually.


text: We utilize third parties and consultants to assist in the identification and assessment of risks, including to support tabletop exercises and to conduct security testing.


text: Further, we have processes in place to evaluate potential risks from cybersecurity threats associated with our use of third-party service providers that will have access to Company data, including a review process for such providers' cybersecurity practices, risk assessments, contractual requirements, and system monitoring.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and breaches of our and our third-party vendors' data and systems. For more information, please see Item 1A. Risk Factors the section titled "Risk Factors—Risks Relating to Information Technology, Intellectual Property, Data Security and Privacy—Compromises of our data security could cause us to incur unexpected expenses and may materially harm our reputation and results of operations."


text: Risk Management Oversight and Governance The Board of Directors has oversight of the Company's cybersecurity program and has delegated the quarterly assessments and management of cybersecurity risks to the Audit Committee.


text: Our Vice President of Engineering, Product and Platform oversees our information security program and leads our information security team. Our Vice President of Engineering, Product and Platform works closely with our Head of Internal Audit, in furtherance of the management of risks to the Company. The Vice President of Engineering, Product and Platform has primary responsibility for assessing and managing our cybersecurity threat management program, informed by over twenty years of experience leading cross-functional organizations in the development and operation of large-scale systems, primarily focused on e-commerce.


text: The Head of Internal Audit reports to the Chair of the Audit Committee and has twelve years of experience with internal audit oversight and risk management. The Head of Internal Audit and the Chief Operating Officer have overall responsibility for the Company-wide risk management program.


text: Our Vice President of Engineering, Product and Platform reports quarterly to the Audit Committee of the Board of Directors on the information security program and related cyber risks. The Head of Internal Audit and the Chief Operating Officer provide an annual update to the Board of Directors on the Company's overall risk management strategy, which includes addressing cybersecurity risks. We have also established a Cyber Incident Disclosure Committee, which is responsible for assessing the impact and materiality on the Company and its stakeholders of any significant cybersecurity incidents and any disclosure obligations arising from any such incidents, as applicable. The findings of any incidents by the Cyber Incident Disclosure Committee are reported to the Audit Committee by the Vice President of Engineering, Product and Platform.


text: Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats to and exploit attempts of our and our third-party vendors' data and systems. For more information, please see the section titled "Risk Factors—Risks Relating to Information Technology, Intellectual Property, Data Security and Privacy—Compromises of our data security could cause us to incur unexpected expenses and may materially harm our reputation and results of operations."


text: Our Chief Product and Technology Officer oversees our information security program and leads our information security team. Our Chief Product and Technology Officer works closely with our Head of Internal Audit, in furtherance of the management of risks to the Company. The Chief Product and Technology Officer has primary responsibility for assessing and managing our cybersecurity threat management program, informed by over fifteen years of experience leading cross-functional organizations in the development and operation of large-scale systems, primarily focused on e-commerce.


text: The Head of Internal Audit reports to the Chair of the Audit Committee and has thirteen years of experience with internal audit oversight and risk management. The Head of Internal Audit and the Chief Operating Officer have overall responsibility for the Company-wide risk management program.


text: Our Chief Product and Technology Officer reports quarterly to the Audit Committee of the Board of Directors on the information security program and related cyber risks. The Head of Internal Audit and the Chief Operating Officer provide an annual update to the Board of Directors on the Company's overall risk management strategy, which includes addressing cybersecurity risks. We have also established a Cyber Incident Disclosure Committee, which is responsible for assessing the impact and materiality on the Company and its stakeholders of any significant cybersecurity incidents and any disclosure obligations arising from any such incidents, as applicable. The findings of any incidents by the Cyber Incident Disclosure Committee are reported to the Audit Committee by the Chief Product and Technology Officer.


text: Cybersecurity Risk Management and Strategy We have established processes for assessing, identifying and managing cybersecurity risks, which are built into our overall risk management program and are designed to help protect our information assets and operations from internal and external cyber threats, protect employee and patient information from unauthorized access or attack, as well as secure our networks and systems. Such processes include physical, procedural and technical safeguards. We engage certain third parties to enhance and assist with our cybersecurity oversight, including a 24/7 Security Operation Center, or SOC, that monitors network devices and computer systems in real time. We include confidentiality and data protection provisions in certain contracts with third-party service providers to help protect us and our patients from any related vulnerabilities.

companyName: Carisma Therapeutics Inc.

ticker: CARM


text: We do not believe that there are currently any known risks from cybersecurity threats that have or are reasonably likely to materially affect us or our business strategy, results of operations or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced undetected cybersecurity incidents. For more information on the most pertinent risks we may experience from cybersecurity threats, please refer to Part I, Item 1A, "Risk Factors" – "Our internal computer systems, or those of our collaborators, vendors, suppliers, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our product development programs."


text: Cybersecurity Governance and Oversight The audit committee of our board of directors provides oversight over cybersecurity risk and updates the full board of directors periodically regarding such oversight. The audit committee reviews and discusses with management the Company's major risk exposures, including cybersecurity matters, and is notified between such updates regarding significant new cybersecurity threats or incidents, if any.


text: Our General Counsel leads the operational oversight of company-wide cybersecurity strategy, policy, standards and processes and works across relevant departments to assess and help prepare us and our employees to address cybersecurity risks. The consultant that operates our SOC updates the General Counsel regarding the detection of cybersecurity risk exposure and provides advice on the prevention, mitigation and remediation of such risks. The General Counsel keeps the senior executive leadership team apprised, including our Chief Executive Officer and Chief Financial Officer, on assessments of risk exposure to ensure that the highest levels of management are kept abreast of potential risks we are facing. The General Counsel has significant prior business experience in compliance and risk management and coordinates directly with the third party who operates our SOC on issues involving particular cybersecurity expertise.


text: In an effort to help deter and detect cyber threats, we regularly provide all employees, including part-time and temporary employees, with data protection cybersecurity and incident prevention training throughout the year, which covers timely and relevant topics, including social engineering, phishing, password protection, confidential data protection, asset use and mobile security, and educates employees on the importance of reporting all incidents immediately. We also use technology-based tools to mitigate cybersecurity risks and to bolster our employee-based cybersecurity programs.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity program overseen by the Managing Director, Information Technology that uses a risk-based methodology to support the security, confidentiality, integrity and availability of our information. The security of our field infrastructure and corporate network is a priority for our business. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. Our cybersecurity program utilizes a combination of automated tools, manual processes and third-party assessments with the goal of identifying and assessing potential cybersecurity risks. These risks may include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or business partners, violation of privacy or security laws and other litigation and legal risk and reputational risks.

companyName: Chord Energy Corp

ticker: CHRD


text: We have endeavored to implement policies, standards and technical controls based on the National Institute of Standards and Technology (NIST) framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: We have implemented a multi-layered system designed to protect and monitor data and cybersecurity risk. Regular assessments of our cybersecurity safeguards are conducted both internally and by independent third-party cybersecurity vendors. Additionally, our internal audit department conducts regular audits to identify, assess and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies and education programs in response to audit findings. • Incident Identification and Response: We have implemented a monitoring and detection system to help promptly identify cybersecurity incidents. While processes are in place to minimize the chance of a successful cyberattack, we have established incident response procedures to address a cybersecurity threat that may occur despite these safeguards. The response procedures are designed to identify, analyze, contain and remediate any such cybersecurity incidents that occur. In the event of any breach or cybersecurity incident, we have a cross-functional incident response plan, which includes the involvement of our executive management team, established incident levels, and associated notification procedures, including escalation procedures upon discovery of cybersecurity risks to our Board of Directors, outside counsel and law enforcement, if deemed material or appropriate. Further, we conduct periodic incident response tabletop exercises and planned incident response drills with various members of our management team to continuously refine and update our incident response processes. • Cybersecurity Training and Awareness: We maintain a formal information security training program for all employees and contractors that includes training on matters such as phishing and email security best practices. We have implemented a requirement that all employees and contractors participate in information security training at least quarterly and have deployed internal phishing campaigns to measure the effectiveness of the training program. • Access Controls: We provide users with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information. • Systems and Processes: We use a combination of tools to identify cybersecurity incidents. We use firewalls and protection software in addition to working with a third-party cybersecurity vendor to scan internal and external networks for threat and intrusion detection. Our cybersecurity team regularly tests our controls through penetration tests, vulnerability scans and attack simulations. • Encryption and Data Protection: We have encryption methods in place to protect certain sensitive data. This includes the encryption of customer data, financial information and other confidential data. We also have multiple programs in place to monitor our retained data and take actions to secure the data.


text: We engage third-party vendors and consultants throughout our business as needed. We recognize that third-party service providers introduce cybersecurity risks. In an effort to mitigate these risks, before engaging with any third-party service provider, we conduct due diligence to evaluate the third-party provider's cybersecurity capabilities. For new cloud-based third-party providers, we aim to review their cybersecurity practices to verify compliance with our cybersecurity standards. This process is documented through our Cloud Services Assessment. Additionally, we endeavor to include cybersecurity requirements in our contracts with third-party providers and endeavor to require them to adhere to our cybersecurity standards and protocols. Further, we require any third-party service providers with access to personally identifiable information to enter into data processing services agreements and adhere to our policies and standards.


text: We have integrated the above cybersecurity risk management processes into our overall ERM program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: As of the date of this report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology ("IT") systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: Cybersecurity Governance and Oversight The Board of Directors has primary oversight of risks from cybersecurity threats. The Board of Directors delegates oversight of risk, including reviews of cybersecurity and data protection and compliance with cybersecurity policies, to the Audit and Reserves Committee.


text: The Managing Director, Information Technology, provides updates to the Audit and Reserves Committee on data protection and cybersecurity matters on at least a semi-annual basis, or as requested or deemed necessary. The topics covered in such reports may include an overview of our current cybersecurity risk assessment, key risk areas, any significant cyber incidents that have occurred or are reasonably likely to occur, as well as recent updates on cybersecurity trends and emerging threats. Additionally, on an annual basis, the Managing Director, Information Technology, reviews with the Audit and Reserves Committee the results from tests of key cybersecurity risks and the subsequent steps taken to mitigate such risks.


text: Management is responsible for assessing and managing cybersecurity risk. Specifically, the Managing Director, Information Technology, is responsible for overseeing the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Managing Director, Information Technology, has over 16 years of experience, including prior industry experience consulting on various IT matters and developing and testing IT general controls and cybersecurity risk management programs. We maintain an internal staff of IT professionals who support our cybersecurity program and engage with third-party service providers to support specific areas of our cybersecurity risk mitigation and response.


text: The Managing Director, Information Technology, works closely with other management positions, including our Chief Financial Officer and our General Counsel, to help us maintain an effective incident response communication plan and understanding of our cybersecurity risk management processes. Our cybersecurity incident response plan provides processes for escalation if there is an emerging cybersecurity incident, including timely notice to our Board of Directors if the incident is deemed material or as otherwise appropriate.


text: We have developed a Cybersecurity Council that reports directly to our Chief Financial Officer. The Cybersecurity Council is led by the Managing Director, Information Technology, and is comprised of select members of the IT team. The Cybersecurity Council meets monthly to review current cybersecurity threats as well as our potential exposure. The Cybersecurity Council also engages periodically with external and internal auditors, as well as the Cybersecurity and Infrastructure Security Agency, the American Exploration and Production Council and the Federal Bureau of Investigation to stay informed on cybersecurity risk management.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity program overseen by the Vice President, Information Technology that uses a risk-based methodology to support the security, confidentiality, integrity and availability of our information. The security of our field infrastructure and corporate network is a priority for our business. We recognize the importance of assessing, identifying and managing material risks associated with cybersecurity threats. Our cybersecurity program utilizes a combination of automated tools, manual processes and third-party assessments with the goal of identifying and assessing potential cybersecurity risks.


text: These risks may include, among other things, operational risks, intellectual property theft, fraud, extortion, harm to employees, customers or business partners, violation of privacy or security laws and other litigation and legal risk and reputational risks.


text: We have endeavored to implement policies, standards and technical controls based on the National Institute of Standards and Technology framework with the aim of protecting our networks and applications. We seek to assess, identify and manage cybersecurity risks through the processes described below: • Risk Assessment: We have implemented a multi-layered system designed to protect and monitor data and cybersecurity risk. Regular assessments of our cybersecurity safeguards are conducted both internally and by independent third-party cybersecurity vendors. Additionally, our internal audit department conducts regular audits to identify, assess and manage material cybersecurity risks, and we endeavor to update cybersecurity infrastructure, procedures, policies and education programs in response to audit findings. • Incident Identification and Response: We have implemented a monitoring and detection system to help promptly identify cybersecurity incidents. While processes are in place to minimize the chance of a successful cyberattack, we have established incident response procedures to address a cybersecurity threat that may occur despite these safeguards. The response procedures are designed to identify, analyze, contain and remediate any such cybersecurity incidents that occur. In the event of any breach or cybersecurity incident, we have a cross-functional incident response plan, which includes the involvement of our executive management team, established incident levels, and associated notification procedures, including escalation procedures upon discovery of cybersecurity risks to our Board of Directors, outside counsel and law enforcement, if deemed material or appropriate. Further, we conduct periodic incident response tabletop exercises and planned incident response drills with various members of our management team to continuously refine and update our incident response processes. • Cybersecurity Training and Awareness: We maintain a formal information security training program for all employees and contractors that includes training on matters such as phishing and email security best practices. We have implemented a requirement that all employees and contractors participate in information security training at least quarterly and have deployed internal phishing campaigns to measure the effectiveness of the training program. • Access Controls: We provide users with access consistent with the principle of least privilege, which requires that users be given no more access than necessary to complete their job functions. We have also implemented a multi-factor authentication process for employees accessing company information. • Systems and Processes: We use a combination of tools to identify cybersecurity incidents. We use firewalls and protection software in addition to working with a third-party cybersecurity vendor to scan internal and external networks for threat and intrusion detection. Our cybersecurity team regularly tests our controls through penetration tests, vulnerability scans and attack simulations. • Encryption and Data Protection: We have encryption methods in place to protect certain sensitive data. This includes the encryption of customer data, financial information and other confidential data. We also have multiple programs in place to monitor our retained data and take actions to secure the data.


text: As of the date of this report, we are not aware of any previous cybersecurity threats that have materially affected or are reasonably likely to materially affect us. However, we acknowledge that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our IT systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. See "Item 1A. Risk Factors" for additional information about the risks to our business associated with a breach or compromise to our IT systems.


text: The Vice President, Information Technology, provides updates to the Audit and Reserves Committee on data protection and cybersecurity matters on at least a semi-annual basis, or as requested or deemed necessary. The topics covered in such reports may include an overview of our current cybersecurity risk assessment, key risk areas, any significant cyber incidents that have occurred or are reasonably likely to occur, as well as recent updates on cybersecurity trends and emerging threats. Additionally, on an annual basis, the Vice President, Information Technology, reviews with the Audit and Reserves Committee the results from tests of key cybersecurity risks and the subsequent steps taken to mitigate such risks.


text: Management is responsible for assessing and managing cybersecurity risk. Specifically, the Vice President, Information Technology, is responsible for overseeing the prevention, mitigation, detection and remediation of cybersecurity incidents. Our Vice President, Information Technology, has over 17 years of experience, including prior industry experience consulting on various IT matters and developing and testing IT general controls and cybersecurity risk management programs. We maintain an internal staff of IT professionals who support our cybersecurity program and engage with third-party service providers to support specific areas of our cybersecurity risk mitigation and response.


text: The Vice President, Information Technology, works closely with other management positions, including our Chief Financial Officer and our General Counsel, to help us maintain an effective incident response communication plan and understanding of our cybersecurity risk management processes. Our cybersecurity incident response plan provides processes for escalation if there is an emerging cybersecurity incident, including timely notice to our Board of Directors if the incident is deemed material or as otherwise appropriate.


text: We have developed a Cybersecurity Council that reports directly to our Chief Strategy Officer & Chief Commercial Officer. The Cybersecurity Council is led by the Vice President, Information Technology, and is comprised of select members of the IT team with an average of nearly 20 years of cybersecurity experience. The Cybersecurity Council meets monthly to review current cybersecurity threats as well as our potential exposure. The Cybersecurity Council also engages periodically with external and internal auditors, as well as the Cybersecurity and Infrastructure Security Agency, the American Exploration and Production Council and the Federal Bureau of Investigation to stay informed on cybersecurity risk management.


text: We seek to provide a secure working environment by establishing and maintaining effective security measures to protect the Company's employees, properties, technology, and our customers' assets from potential threats, including cybersecurity threats. Accordingly, we have implemented numerous controls, technologies and processes and have integrated operational measures into our overall risk management system to assess, identify, and manage material risks from internal and external cybersecurity threats.

companyName: BWX Technologies, Inc.

ticker: BWXT


text: The Governance Committee of our Board of Directors oversees the Company's guidelines, policies, and processes to assess and manage the Company's exposure to risks, which include cybersecurity risks. The Committee meets periodically with management to review and discuss major financial risk exposures, including from cybersecurity threats, and the steps management has taken to monitor and control those exposures. As necessary, our Cybersecurity Incident Management Team ("CIMT") (described below) reports significant cybersecurity threats and incidents to the Governance Committee. The Governance Committee is also periodically briefed by management, including our Chief Digital Officer ("CDO"), with respect to our cybersecurity posture to facilitate its role in overseeing the Company's overall cybersecurity program.


text: As a general matter, our CDO is responsible for defining our entire cybersecurity posture. The CDO has oversight in planning the strategy, programs, policies, and procedures to protect the organization's digital assets, information, and infrastructure. Our IT Director, Cyber Security serves as the CIMT's Incident Manager and is the member of management primarily responsible for assessing, identifying, mitigating, and managing cybersecurity risks; supervising IT security design, development, implementation, and testing; and running the day-to-day operations of our cybersecurity team. Our CDO holds a bachelor's degree in electronics and telecommunications engineering and has more than 35 years of information technology and cybersecurity experience in various leadership and executive roles. In addition, our IT Director, Cyber Security holds a bachelor's degree in computer information systems and the Certified Information Systems Security Professional (CISSP) and Information Systems Security Architecture Professional (ISSAP) certifications, as well as over 30 years of experience as an information technology professional with the most recent 15 years specializing in cybersecurity.


text: The CIMT is responsible for coordinating the containment, response, investigation, reporting, and recovery related to a cybersecurity incident, and is an internally led management team made up of leaders from our Communications, Human Resources, IT and Cybersecurity, Legal and Compliance, Risk Management and other departments, including our IT Director, Cyber Security. Team members possess a broad scope of expertise, including cybersecurity, information technology, legal, compliance, risk management, insurance and crisis communications. The CIMT operates under the co-leadership of the General Counsel and CDO, who are responsible for oversight and composition of the CIMT, determining whether an incident warrants activating external service providers, providing updates to the Chief Executive Officer and Senior Management Team, keeping our Governance Committee as well as our Board of Directors informed as appropriate, and ultimately establishing and executing our enterprise-wide incident response strategy.


text: Training and preparation are essential to the overall success of the CIMT to help ensure team members develop and maintain the operational, technical, and managerial skillsets necessary to support the effective function of the CIMT. Our CIMT members undergo training and preparation for cybersecurity incidents like participating in regular cybersecurity incident response tabletop exercises and reviewing lessons learned. Our general cybersecurity team receives extensive on-the-job training with respect to cybersecurity operations, maintenance, analysis, detection, investigation, mitigation, and protection. In addition, company-wide cybersecurity and insider threat training is mandated for our employees.


text: We have processes and controls that oversee, identify, and manage cybersecurity risks with respect to our external service providers, including cybersecurity service providers. For example, we review and seek to negotiate terms and conditions in our legal agreements to provide for the adequate protection of confidential information and the Company's networks and systems and compliance with any applicable cybersecurity requirements, including with respect to any information exchanged. We also review the security controls of hosted solutions in an effort to ensure protection is commensurate with our security requirements. We periodically revalidate those cybersecurity control reviews commensurate with the risk identified. Further, we utilize an external security assessment service to produce security ratings that include detailed descriptions of deficiencies affecting the rating. We seek to respond accordingly to those deficiencies to the extent practicable. Lastly, as appropriate and when feasible, we may visit our service providers' facilities to observe security practices and physical security controls.


text: Despite taking extensive precautions, cybersecurity incidents are still possible. In general, when our cybersecurity team detects a cybersecurity threat by way of an alert within our cyber defense systems, employee notice, or otherwise, our IT Director, Cyber Security, along with other relevant personnel, is promptly apprised of the situation, and actively takes steps to prevent, mitigate, or remediate that threat. If a cybersecurity threat appears to progress into a possible cybersecurity incident, our IT Director, Cyber Security serves as the CIMT's incident manager and the CDO or designee notifies the Chief Risk Officer of a need to activate the CIMT as appropriate, informs and updates the CIMT, and may consult other internal and external resources with the required technical, application, organizational, and business knowledge to provide effective advice to the CIMT.


text: The CIMT responds to potential cybersecurity incidents raised to its attention by making an assessment of the event to determine if a cybersecurity incident has, in fact, occurred, identifying any assets impacted by the incident, determining any information stored and processed by assets identified as compromised, assessing the nature and level of damage that has occurred (accessed, exfiltrated, released to the public, etc.), and revising the assessment throughout the incident response process when additional details are identified.


text: As a U.S. Government contractor, we may be prone to a greater number of those threats than companies in other industries. We believe we are well positioned to meet the requirements of the Cybersecurity Maturity Model Certification ("CMMC") program and are preparing for certification once the requirements are effective. As of the date of this Report, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations, or financial condition. However, there can be no guarantee that cybersecurity threats and incidents will not materially affect us in the future. See Item 1A of this Report for more information on our cybersecurity risks.


text: We seek to provide a secure working environment by establishing and maintaining effective security measures to protect the Company's employees, properties, technology and our customers' assets from potential threats, including cybersecurity threats. Accordingly, we have implemented numerous controls, technologies and processes and have integrated operational measures into our overall risk management system to assess, identify and manage material risks from internal and external cybersecurity threats.


text: The Governance Committee of our Board of Directors oversees the Company's guidelines, policies and processes to assess and manage the Company's exposure to risks, which include cybersecurity risks. The Committee meets periodically with management to review and discuss major financial risk exposures, including from cybersecurity threats, and the steps management has taken to monitor and control those exposures. As necessary, our Cybersecurity Incident Management Team ("CIMT") (described below) reports significant cybersecurity threats and incidents to the Governance Committee. The Governance Committee is also periodically briefed by management, including our Chief Digital Officer ("CDO"), with respect to our cybersecurity posture to facilitate its role in overseeing the Company's overall cybersecurity program.


text: As a general matter, our CDO is responsible for defining our entire cybersecurity posture. The CDO has oversight in planning the strategy, programs, policies and procedures to protect the organization's digital assets, information and infrastructure. Our IT Director, Cyber Security serves as the CIMT's Incident Manager and is the member of management primarily responsible for assessing, identifying, mitigating and managing cybersecurity risks; supervising IT security design, development, implementation and testing; and running the day-to-day operations of our cybersecurity team. Our CDO holds a bachelor's degree in electronics and telecommunications engineering and has more than 35 years of information technology and cybersecurity experience in various leadership and executive roles. In addition, our IT Director, Cyber Security holds a bachelor's degree in computer information systems and the Certified Information Systems Security Professional (CISSP) and Information Systems Security Architecture Professional (ISSAP) certifications, as well as over 30 years of experience as an information technology professional with the most recent 15 years specializing in cybersecurity.


text: The CIMT is responsible for coordinating the containment, response, investigation, reporting and recovery related to a cybersecurity incident, and is an internally led management team made up of leaders from our Communications, Human Resources, IT and Cybersecurity, Legal and Compliance, Risk Management and other departments, including our IT Director, Cyber Security. Team members possess a broad scope of expertise, including cybersecurity, information technology, legal, compliance, risk management, insurance and crisis communications. The CIMT operates under the co-leadership of the General Counsel and CDO, who are responsible for oversight and composition of the CIMT, determining whether an incident warrants activating external service providers, providing updates to the Chief Executive Officer and senior management team, keeping our Governance Committee as well as our Board of Directors informed as appropriate, and ultimately establishing and executing our enterprise-wide incident response strategy.


text: Training and preparation are essential to the overall success of the CIMT to help ensure team members develop and maintain the operational, technical and managerial skillsets necessary to support the effective function of the CIMT. Our CIMT members undergo training and preparation for cybersecurity incidents like participating in regular cybersecurity incident response tabletop exercises and reviewing lessons learned. Our general cybersecurity team receives extensive on-the-job training with respect to cybersecurity operations, maintenance, analysis, detection, investigation, mitigation and protection. In addition, company-wide cybersecurity and insider threat training is mandated for our employees.


text: We have processes and controls that oversee, identify and manage cybersecurity risks with respect to our external service providers, including cybersecurity service providers. For example, we review and seek to negotiate terms and conditions in our legal agreements to provide for the adequate protection of confidential information and the Company's networks and systems and compliance with any applicable cybersecurity requirements, including with respect to any information exchanged. We also review the security controls of hosted solutions in an effort to ensure protection is commensurate with our security requirements. We periodically revalidate those cybersecurity control reviews commensurate with the risk identified. Further, we utilize an external security assessment service to produce security ratings that include detailed descriptions of deficiencies affecting the rating. We seek to respond accordingly to those deficiencies to the extent practicable. Lastly, as appropriate and when feasible, we may visit our service providers' facilities to observe security practices and physical security controls.


text: Despite taking extensive precautions, cybersecurity incidents are still possible. In general, when our cybersecurity team detects a cybersecurity threat by way of an alert within our cyber defense systems, employee notice, or otherwise, our IT Director, Cyber Security, along with other relevant personnel, is promptly apprised of the situation, and actively takes steps to prevent, mitigate, or remediate that threat. If a cybersecurity threat appears to progress into a possible cybersecurity incident, our IT Director, Cyber Security serves as the CIMT's incident manager and the CDO or designee notifies the Chief Risk Officer of a need to activate the CIMT as appropriate, informs and updates the CIMT and may consult other internal and external resources with the required technical, application, organizational and business knowledge to provide effective advice to the CIMT.


text: The CIMT responds to potential cybersecurity incidents raised to its attention by making an assessment of the event to determine if a cybersecurity incident has, in fact, occurred, identifying any assets impacted by the incident, determining any information stored and processed by assets identified as compromised, assessing the nature and level of damage that has occurred (accessed, exfiltrated, released to the public, etc.) and revising the assessment throughout the incident response process when additional details are identified.


text: As a U.S. Government contractor, we may be prone to a greater number of cybersecurity threats than companies in other industries. We believe we are well positioned to meet the requirements of the Cybersecurity Maturity Model Certification ("CMMC") program and are preparing for certification once the requirements are effective. As of the date of this Report, risks from cybersecurity threats, including as a result of previous cybersecurity incidents, have not materially affected us, including our business strategy, results of operations or financial condition. However, there can be no guarantee that cybersecurity threats and incidents will not materially affect us in the future. See Item 1A of this Report for more information on our cybersecurity risks.


text: Our Cybersecurity Risk Management Approach OFS Advisor utilizes the IT department ("IT Department") of CIM Group, LLC ("CIM Group"), an affiliate, as its IT administrator. The IT Department is responsible for the design and implementation of OFS Advisor's IT environment and controls, including policies and procedures to identify, assess and manage material risks from cybersecurity threats, which are integrated into OFS Advisor's internal controls and IT systems.

companyName: OFS Capital Corp

ticker: OFS


text: In collaboration with the IT Department, OFS Advisor's cybersecurity strategy prioritizes detection, analysis and response to known, anticipated or unexpected threats, effective management of security risks and resiliency against incidents. The IT Department's cybersecurity risk management policies and procedures include, among other things: enterprise-wide hardware and software management and security controls; employee training; security assessments; penetration testing; security audits and ongoing risk assessments; due diligence on, and monitoring and oversight of, key third-party providers; vulnerability management; and management oversight to assess, identify and manage material risks from cybersecurity threats. The IT Department's controls leverage the National Institute of Standards and Technology Cyber Security Framework. The IT Department also utilizes industry and government associations, the results from regular internal and third-party audits and other similar resources to inform its cybersecurity processes and to allocate resources, including resources allocated to OFS Advisor.


text: In addition, OFS Advisor's employees receive mandatory training on cybersecurity matters at such employee's new hire and annually thereafter, periodic training and information updates that address new cybersecurity threats and trends, and quarterly "phishing" and social engineering testing to evaluate the effectiveness of the cybersecurity training program and raise employee awareness of cybersecurity threats.


text: While we do not believe that our business strategy, result of operations or financial condition have been materially adversely affected by any cybersecurity incidents, for further discussion of cybersecurity risks, see "Item 1A. Risk Factors—Risk Related to Our Securities and an Investment in our Common Stock—Cybersecurity risks and cyber incidents may adversely affect our business or the business of our portfolio companies by causing a disruption to our operations or the operations of our portfolio companies, a compromise or corruption of our confidential information or the confidential information of our portfolio companies and/or damage to our business relationships or the business relationships of our portfolio companies, all of which could negatively impact the business, financial condition and operating results of us or our portfolio companies."


text: Management Oversight of Cybersecurity Risk Management Management's role in assessing and managing material cybersecurity risks includes various management positions, committees and subcommittees responsible for assessing such risks. The IT Department's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation and, where appropriate, for escalation to the Board. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO"), and OFS Advisor's General Counsel (the "GC"), who has received a CERT Certificate in Cyber Oversight through the Cyber Oversight Program of the National Association of Corporate Directors, as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is also responsible for implementing our cybersecurity strategy and overseeing and managing our cybersecurity risk. In addition to the Committee's responsibilities, OFS Advisor has established a Cybersecurity Subcomittee (the "Subcommittee"). The Subcommittee consists of the CCO, the CTO, the GC, and the chief financial officer of each of OFS Advisor's public clients, including our Chief Financial Officer. The Subcommittee is responsible for overseeing our cybersecurity-related public disclosure obligations and ensuring our management and the Board is informed of material cybersecurity incidents affecting us and OFS Advisor. The Committee is chaired by CIM Group's CTO, and the Subcommittee is co-chaired by CIM Group's CTO and the CCO.


text: The Committee and Subcommittee each conduct both regular quarterly and as-needed meetings throughout the year during which members of the IT Department provide updates and report on meaningful cybersecurity risks, threats, incidents and vulnerabilities in accordance with the Committee's and the Subcommittee's respective reporting frameworks, as well as related priorities, mitigation and remediation activities, financial and employee resource levels, regulatory compliance, technology trends and third-party provider risks. To help inform this reporting framework, the IT Department and OFS Advisor maintain incident response plans and other policies and procedures designed to respond to, mitigate and remediate cybersecurity incidents based on the potential impact to our business, IT systems, network or data, including data held by third parties, or to the IT or other critical services provided by third-party vendors and service providers.


text: The IT Department's management responsible for developing and executing both OFS Advisor's and our cybersecurity policies, and is comprised of individuals with either formal education and degrees in IT or cybersecurity, or with experience working in IT and cybersecurity, including relevant industry experience in security related industries.


text: Board of Directors Oversight of Cybersecurity Risk Management Our Board has ultimate oversight of cybersecurity risks as part of our enterprise risk management program, including oversight of the processes implemented by OFS Advisor and the IT Department to identify, assess, manage and mitigate cybersecurity risks. The Board receives quarterly updates from senior management of OFS Advisor and the IT Department with respect to the effectiveness of the cyber readiness and cybersecurity program that the IT Department administers on our behalf. This oversight includes briefing and a report by the CTO or CIM Group's Head of Operations, as well as a discussion of any cybersecurity breaches detected by the IT Department and a summary of, among other things, the current cybersecurity threat landscape, defensibility measures implemented by the IT Department, the health of our information security system, effectiveness of our cybersecurity controls and recoverability and business continuity testing.


text: Management Oversight of Cybersecurity Risk Management Management's role in assessing and managing material cybersecurity risks includes various management positions, committees and subcommittees responsible for assessing such risks. The IT Department's internal processes require escalation of material cybersecurity risks to its management and its Cybersecurity Committee (the "Committee") for evaluation and, where appropriate, for escalation to the Board. The Committee consists of CIM Group's Chief Technology Officer (the "CTO"), CIM Group's Chief Compliance Officer (the "CCO"), and OFS Advisor's General Counsel (the "GC"), who has received a CERT Certificate in Cyber Oversight through the Cyber Oversight Program of the National Association of Corporate Directors, as well as representatives from CIM Group's operations, compliance and accounting departments. The Committee is also responsible for implementing our cybersecurity strategy and overseeing and managing our cybersecurity risk. In addition to the Committee's responsibilities, OFS Advisor has established a Cybersecurity Subcommittee (the "Subcommittee"). The Subcommittee consists of the CCO, the CTO, the GC, and the chief financial officer of each of OFS Advisor's public clients, including our Chief Financial Officer. The Subcommittee is responsible for overseeing our cybersecurity-related public disclosure obligations and ensuring our management and the Board is informed of material cybersecurity incidents affecting us and OFS Advisor. The Committee is chaired by CIM Group's CTO, and the Subcommittee is co-chaired by CIM Group's CTO and the CCO.


text: The Company's Board of Directors (the "Board") recognizes the critical importance of maintaining the trust and confidence of our customers, clients, suppliers, business partners, employees and investors with respect to cybersecurity matters. The Board is actively involved in oversight of the Company's risk management program, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management ("ERM"). The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERM program and are based on recognized frameworks established by the National Institute of Standards and Technology. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, security and availability of the information that the Company collects and stores by identifying, preventing, assessing, managing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.

companyName: Vishay Precision Group, Inc.

ticker: VPG


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Corporate Governance and Oversight," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with and receives reports from the Company's ERM function, the Vice President of IT and Digital, the Company's Chief Information Security Officer ("CISO"), and other members of management. • Collaborative Approach: The Company has integrated cybersecurity risk management into its broader risk management framework to promote a Company-wide culture of cybersecurity risk management. To that end, the Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains comprehensive incident response and recovery plans that fully address the Company's response to a cybersecurity incident, and such plans are tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Company conducts security assessments of all of its electronic information-related third-party service providers before the Company engages them, and the Company maintains policies and procedures to oversee and identify cybersecurity risks associated with its use of third-party service providers. • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: The Company engages in the periodic assessment and testing of the Company's policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, threat modeling, penetration and vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties, including consultants and outside monitoring agencies, to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported to the Audit Committee during management's annual update to the Audit Committee and the Board, and the Company updates and adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: Management's Role in Managing Risk The Vice President of IT and Digital, along with the CISO, have developed a strategy and multi-year plan for cybersecurity and regularly update it based on evolving technology trends. The Audit Committee reviews the Company's information security program, including cybersecurity controls, annually (and/or if and when a significant event occurs as defined by its Incident Management policy). The Audit Committee updates the Board annually and upon request of the Board as detailed under the Corporate Governance and Oversight Section.


text: Our Vice President of IT and Digital, holds a Bachelor of Science in Computer Science and brings a wealth of experience from managing IT organizations in large, publicly traded companies, in addition to a distinguished background of service in the Israeli army, where she was responsible for managing classified information. Our CISO has an impressive 20-plus years in the field of cybersecurity, underpinned by a Bachelor's degree specializing in Knowledge and Information Management. Our CISO's extensive experience includes a period of 12 years during which he was employed by the Government of Israel, where he managed classified information systems and teams, a role that demands the highest levels of diligence and expertise in information security.


text: Through third party service providers and attendance at seminars, Vice President of IT and Digital and CISO are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition enhances our processes to identify, prevent, mitigate and remediate of cybersecurity threats and cybersecurity incidents.


text: Together, our Vice President of IT and Digital and CISO lead a dynamic, cross-functional team that includes relevant stakeholders from all Company divisions. This team plays a pivotal role in raising cybersecurity awareness throughout the Company, ensuring that every employee is informed and cautious about potential cyber threats. They are committed to keeping our Company's management and Board regularly informed on cybersecurity matters, ensuring transparency and proactive management of digital risks. Additionally, they actively collaborate with division managers, participating in divisional management meetings to identify and protect sensitive information. Their involvement at this level ensures that cybersecurity is integrated into every aspect of our operations, aligning with our broader strategic objectives.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: Corporate Governance and Oversight The Audit Committee is central to the Board's oversight of cybersecurity risks and bears the primary responsibility for this domain. The Audit Committee is composed of directors who have diverse qualifications and experiences.


text: Significant cybersecurity matters, and strategic risk management decisions are escalated to the Audit Committee and, as appropriate, the Board, ensuring that such bodies maintain comprehensive oversight and can provide guidance on critical cybersecurity issues.


text: The Audit Committee regularly reports to the Board regarding the Audit Committee's oversight of cybersecurity matters, such as the periodic assessment and testing of the Company's policies, standards, processes and practices and the risks identified in such assessment and testing.


text: Risk Management and Strategy As one of the critical elements of the Company's overall ERM approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed in more detail under the heading "Corporate Governance and Oversight," the Board's oversight of cybersecurity risk management is supported by the Audit Committee of the Board (the "Audit Committee"), which regularly interacts with and receives reports from the Company's ERM function, the Vice President of IT and Digital, the Company's Chief Information Security Officer ("CISO"), and other members of management. • Collaborative Approach: The Company has integrated cybersecurity risk management into its broader risk management framework to promote a Company-wide culture of cybersecurity risk management. To that end, the Company has implemented a comprehensive, cross-functional approach to identifying, preventing and mitigating cybersecurity threats and incidents, while also implementing controls and procedures that provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response: The Company has established and maintains a comprehensive incident response plan that fully address the Company's response to a cybersecurity incident, and this plan is tested and evaluated on a regular basis. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems. The Company conducts security assessments of all of its electronic information-related third-party service providers before the Company engages them, and the Company maintains policies and procedures to oversee and identify cybersecurity risks associated with its use of third-party service providers. • Education and Awareness: The Company provides regular, mandatory training for the Company's personnel regarding cybersecurity threats as a means to equip them with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices.


text: Through third-party service providers and attendance at seminars, the Vice President of IT and Digital and CISO are regularly informed about the latest developments in cybersecurity, including potential threats and innovative risk management techniques. This ongoing knowledge acquisition enhances our processes to identify, prevent, mitigate and remediate of cybersecurity threats and cybersecurity incidents.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and, to the best of our knowledge, are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition.


text: Information Technology and Cybersecurity Risk Management As is the case for all large companies, we are regularly subject to cyberattacks and other cyber incidents and, therefore, cybersecurity occupies a pivotal role within our risk management process. We adhere to a risk-based, multi-layered "defense in depth" approach that is dedicated to the identification, protection, detection, response, and recovery from cyber threats and incidents. We understand that a single technology, process, or business control cannot wholly prevent or mitigate all potential risks. Therefore, we employ a multitude of technologies, processes, and controls, each functioning independently but collectively forming a cohesive strategy aimed at minimizing risk. This strategy is evaluated through various means, such as frequent research and industry security briefings among our information technology group, internal and external audits, independent program assessments, control attestation reports, penetration testing, and other exercises that gauge its effectiveness. Threats and incidents connected with third party service providers are considered and managed under this process as well.

companyName: Ameresco, Inc.

ticker: AMRC


text: We engage external parties, including consultants, independent privacy assessors, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consults with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the National Institute of Standards and Technology Cybersecurity Framework.


text: Cybersecurity Governance and Oversight The Audit Committee of our Board of Directors provides direct oversight over cybersecurity risk. The Audit Committee receives and provides feedback on periodic updates from management regarding cybersecurity. Agendas for quarterly updates are developed and adjusted throughout the year to adapt to any emerging risks or key topics and include, a wide range of information, including the prevailing cybersecurity threat landscape, investments in infrastructure, trainings programs and opportunities for bolstering the security of our company's systems and the protection of our products and operations. The full Board of Directors receives regular reports from the Audit Committee and our management on our cyber security program and the emerging threat landscape.


text: We have a Senior Vice President of Information Technology whose team is responsible for leading company-wide cybersecurity strategy, policy, standards and processes and works across relevant units of Ameresco. Our Senior Vice President of Information Technology has more than thirty years of experience in cybersecurity and information technology and based on his long career with Ameresco he has a deep understanding of our information technology and business needs and the cyber security opportunities and risks we face.


text: In actioning our cyber security strategy, our management together with our Senior Vice President of Information Technology evaluate the materiality of any cybersecurity threats and incidents utilizing both qualitative and quantitative considerations. Our internal audit team also provides independent testing on aspects of the operations of our cybersecurity program and the supporting control framework.


text: Our cybersecurity program is designed to ensure the confidentiality, integrity, and availability of data and systems as well as to ensure timely identification of and response to any incidents. This design is geared toward supporting our business objectives and the needs of our valued customers, employees, and other stakeholders. We firmly believe that cybersecurity is a collective responsibility that extends to every employee, and we prioritize it as an ongoing objective. To increase our employees' awareness of cyber threats, we provide education and share best practices through a security awareness training program. This includes receiving regular exercises, cyber-event simulations, training programs and an annual attestation to our Technology Acceptable Use Policy.


text: See "A failure of our information technology ("IT") and data security infrastructure or cyber or other security incidents, vulnerabilities or other deficiencies, could adversely impact our business, reputation or results of operation or could cause us to default under our contractual obligations." in Item 1A, Risk Factors.


text: We engage external parties, including consultants, independent privacy assessors, computer security firms and risk management and governance experts, to enhance our cybersecurity oversight. For example, we have engaged an outside consulting firm with expertise in the field to help us assess our systems, monitor risk and implement best practices and to support the internal audit of our cyber security programs and we regularly consult with industry groups on emerging industry trends. In addition, as part of our overall risk mitigation strategy, we also maintain cyber insurance coverage. Our cybersecurity policies, standards and procedures include cyber and data breach response plans, which are periodically assessed against the National Institute of Standards and Technology Cybersecurity Framework.


text: Our Senior Vice President of Information Technology is responsible for leading our company-wide cybersecurity strategy, policy, standards and processes and together with our whole information technology team works across relevant units of Ameresco. Our Senior Vice President of Information Technology has more than thirty years of experience in cybersecurity and information technology and based on his long career with Ameresco he has a deep understanding of our information technology and business needs and the cyber security opportunities and risks we face.


text: Cybersecurity Risk Management and Strategy, Governance and Incident Disclosure Cybersecurity risk is a significant operational risk facing our business. Cybersecurity risks result from intentional malicious attacks or unintentional acts that result in an impact to the confidentiality, integrity or availability of our or our clients' or third parties' operations, systems or data. Cybersecurity risk management is an integral element of Customers' overall risk management strategy.

companyName: Customers Bancorp, Inc.

ticker: CUBI


text: The Cybersecurity Risk Management and Strategy, Governance, and Incident Disclosure Program (the "Program") of Customers consists of six key areas focused on technology governance and compliance, standards management and architecture, physical security, application security, cybersecurity operations, and workforce training and preparedness. The Corporate Security Group manages Customers' documented security and cybersecurity incident ("Incident") response and business continuity functions and utilizes annual table-top exercises to test Customers' preparedness for any Incidents ranging from pandemics to cybersecurity events. Incidents are classified with a priority Level 1 (low) to a priority Level 5 (high) rating. Priority Levels 4 and 5 Incidents that may cause material or significant disruption to Customers are immediately reported to Customers' Directors Risk Committee for appropriate disclosure in a Current Report on Form 8-K as required by SEC rules requiring public companies to promptly disclose material cybersecurity Incidents. Our Incident Management Process is illustrated below.


text: Third-Party Risks Our Program is designed to decrease the likelihood of an impact to Customers' operations, reputation, or revenue due to a third-party or fourth-party vendor, supplier, service provider or partner of Customers ("Third-Party") issue, vulnerability, or compromise. The Program achieves this mission through a mix of monitoring, information gathering, and analysis of Third-Party quality and security at the contracting, pre-production and post-implementation stages.


text: Third-Party technology risks that exceed Customers' tolerance level are escalated monthly within the Cybersecurity Risk Indicators Report. Customers' Directors' Risk Committee approves the CISO's mitigant decisioning, including prioritization and resource allocation. Customers has a formal budgeting process. Corporate Security expenses, solutions and staffing needs are subject to zero-based budgeting and additional needs are forecasted based on the previous year's metrics.


text: Customers' Board of Directors periodically reviews and determines Customers' cyber risk tolerance level. The Statement of Cyber Risk Appetite is maintained for record by Customer's Enterprise Risk Management team. Customers' IT Risk Assessment and FFIEC Cybersecurity Assessment are presented annually to Customers' Directors' Risk Committee and Board of Directors, identifying Customers' cybersecurity risk posture, with recommendations for reduction as the Customers' Directors' Risk Committee and Board of Directors deems appropriate.


text: Cybersecurity Governance While often viewed as a technical discipline, we approach cybersecurity as a corporate governance responsibility that involves risk management, reporting controls, testing, and training, and executive accountability. Our motto is that every member of our organization is a member of our security team, a mantra that is driven as part of Customers' overall culture.


text: The cybersecurity group for Customers reports to the Chief Information Officer and is overseen by Customers' Directors' Risk Committee. Our Program is led by the CISO. The Program has been designed to conform with the National Institute of Standards & Technology's ("NIST") Cybersecurity Framework, International Organization for Standardization ("ISO") 27001, as well as the FFIEC guidelines for cybersecurity. We use these frameworks to assist our organization as it seeks to ensure the confidentiality, integrity, and availability of technology and services for its customers, employees, and partners. Our Program is ISO 27001 certified and is audited annually by an external accredited ISO 27001 certification body.


text: Our Program takes a holistic approach to organizational security focusing on both the protection of our core technologies and the protection of the operations and areas of business it supports. The Program manages 86 distinct metrics and operates 24x7x365 to meet the growing needs of Customers as it seeks to ensure the continued protection of its customers.


text: Customers' Directors' Risk Committee receives a monthly Cybersecurity Risk Indicators report from the CISO which provides information on cyber risk, vulnerabilities, disaster recovery testing, employee security awareness training, and Third-Party cybersecurity risk. An annual report named "The State of Security" is compiled and shared with Customers' Directors' Risk Committee summarizing the previous year's activities along with a comprehensive view of trends and the risks they pose. Customers' security policies are reviewed and ratified on an annual basis by the Board of Directors who provide oversight of executive-level enforcement and compliance. Customers also utilizes several global external advisors to ensure the appropriateness of its security posture, adherence to established controls, proper assessment of risk, and efficient operation of its cybersecurity discipline. Customers' Board of Directors includes a vetted board member who possesses expertise in Information Security across various domains.


text: Cybersecurity Risk Management and Strategy, Governance and Incident Disclosure Cybersecurity risk is a significant operational risk facing businesses today. It results from intentional malicious attacks or unintentional acts that impact the confidentiality, integrity, or availability of our, our clients' or third parties' operations, systems, or data. Cybersecurity risk management is an integral element of Customers' overall risk management strategies.


text: The Cybersecurity Risk Management and Strategy, Governance, and Incident Disclosure Program (the "Program") at Customers encompasses six key areas that focus on technology governance and compliance, standards management and architecture, physical security, application security, cybersecurity operations, and workforce training and preparedness. This training includes monthly phishing exercises and annual cybersecurity training required by all employees. The Corporate Security Group oversees Customers' documented security and cybersecurity incident ("Incident") response and business continuity functions employing annual table-top exercises to test Customers' preparedness for any Incidents, ranging from pandemics to cybersecurity events. Incidents are classified by priority levels from Level 1 (low) to Level 5 (high). Incidents classified as Levels 4 and 5, which could lead to material or significant disruptions to Customers, are immediately reported to the Customers' Directors' Risk Committee for appropriate disclosure in a C urrent Report on Form 8-K as required by SEC rules requiring public companies to promptly disclose material cybersecurity Incidents.


text: Third-Party Risks Our Program is designed to reduce the likelihood of impacts on Customers' operations, reputation, or revenue due to issues, vulnerabilities, or compromises related to a third-party or fourth-party vendor, supplier, service provider, or partner of Customers ("Third-Party"). The Program accomplishes this goal through a combination of monitoring, information gathering, and analysis of Third-Party quality and security at the due diligence, contracting, ongoing monitoring and termination stages.


text: Cybersecurity Governance Although often seen as a technical discipline, we view cybersecurity as a responsibility of corporate governance that encompasses risk management, reporting controls, testing, training, and executive accountability. Our motto is that every member of our organization is a part of our security team, a mantra that is embedded in our overall culture of service to our customers.


text: The cybersecurity group for Customers reports to the Chief Information Officer and is overseen by the Customers' Directors' Risk Committee. Our Program is led by the CISO. The Program has been designed to conform to the ISO 27001 standard, as well as the FFIEC guidelines for cybersecurity. We use these frameworks to help our organization ensure the confidentiality, integrity, and availability of technology and services for customers, team members, and partners. Our Program is ISO 27001 certified and is audited annually by an external accredited ISO 27001 certification body. Customers has recently achieved SOC2 Type 2 attestation.


text: Our Program takes a holistic approach to organizational security, focusing on protecting our core technologies and the operations and areas of business it supports. The Program manages numerous metrics and operates on a 24x7x365 basis to meet the growing needs of Customers and ensure the continued protection of its customers.


text: The Customers' Board of Directors periodically reviews and determines Customers' cyber risk tolerance level. The Statement of Cyber Risk Appetite is kept on record by Customer's Enterprise Risk Management team. The Customers' IT Risk Assessment and FFIEC Cybersecurity Assessment are presented annually to the Customers' Directors' Risk Committee and Board of Directors, identifying Customers' cybersecurity risk posture, with recommendations for reduction as deemed appropriate by the Customers' Directors' Risk Committee and Board of Directors. The FFIEC Cybersecurity Assessment will be phased out on August 31, 2025, with Customers introducing an annual NIST CSF 2.0 assessment in its place.


text: The Customers' Directors' Risk Committee receives a quarterly Cybersecurity Risk Indicators report from the CISO, which provides information on cyber risk, vulnerabilities, disaster recovery testing, employee security awareness training, and Third-Party cybersecurity risk. An annual report titled, "The State of Security" is compiled and shared with the Customers' Directors' Risk Committee summarizing the previous year's activities and offering a comprehensive view of trends and the risks they pose. Customers' security policies are reviewed and ratified annually by the Board of Directors, who oversee executive-level enforcement and compliance. Customers also engages several global external advisors to ensure the appropriate security posture, adherence to established controls, proper risk assessment, and efficient operation of its cybersecurity discipline. The Customers' Board of Directors includes a vetted board member with expertise in information security across various domains.


text: Thermon's cybersecurity risk management system is a comprehensive framework that helps the Company identify, assess, and mitigate known cybersecurity risks. The system is designed to protect the confidentiality, integrity, and availability of the Company's information assets.

companyName: Thermon Group Holdings, Inc.

ticker: THR


text: The system includes a risk assessment process that identifies and assesses the Company's cybersecurity risks. The risk assessment process is based on the security principles set forth in the National Institutes of Standards and Technology Common Industry Format Cybersecurity Framework and includes the following steps: • Identification of assets • Identification of threats • Identification of vulnerabilities • Assessment of risk The system is primarily implemented by the Company's cybersecurity team. This team is responsible for: • Developing and implementing the risk assessment process • Developing and implementing the risk mitigation strategy • Developing and implementing the risk monitoring and reporting process • Training the Company's employees on cybersecurity risk management The Company's cybersecurity risk management system is reviewed and updated on an annual basis. This includes a comprehensive incident response plan. The review process is designed to ensure that the system remains effective and efficient as the cybersecurity threat landscape evolves.


text: The Company currently uses a third-party system for training our people on cybersecurity risks as well as strategies to mitigate those risks through interactive learning and tests. The Company tracks the compliance and performance of the relevant people who participate in the training.


text: Monitoring is another key component of the cybersecurity risk management system. We employ 24/7 monitoring and regular testing to mitigate threats and possible weaknesses. Additionally, we maintain insurance coverage for cybersecurity attacks.


text: The Company's Chief Executive Officer ("CEO"), through the appropriate reporting channels, is responsible for the cybersecurity risk management program. The Company's information technology department is responsible for developing and implementing the Company's cybersecurity policies, procedures, and strategies; overseeing the Company's cybersecurity risk assessment process; and monitoring the Company's cybersecurity risk profile.


text: The Company's cybersecurity risk management program is subject to periodic review and updates. The Company's Board of Directors is responsible for overseeing the Company's cybersecurity risk management program through the Audit Committee. The Board receives quarterly reports on the Company's cybersecurity risk profile and the effectiveness of the Company's cybersecurity risk management program.


text: During the past year, there have been no material risks from cybersecurity threats or prior cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. Despite our cybersecurity risk management program and the associated controls, and those of our third-party providers, we may be vulnerable to cyber-attacks, computer viruses, security breaches, ransomware attacks, inadvertent or malicious employee actions, program failures, and other risks that could materially impact our financial condition, results of operations and cash flows. For risks regarding cybersecurity and our information systems, please refer to Item 1A. "Risk Factors" in this annual report.


text: The system includes a risk assessment process that identifies and assesses the Company's cybersecurity risks. The risk assessment process is based on the security principles set forth in the National Institutes of Standards and Technology ("NIST") Cybersecurity Framework and includes the following steps: • Identification of assets • Identification of threats • Identification of vulnerabilities • Assessment of risk The system is primarily implemented by the Company's cybersecurity team. This team is responsible for: • Developing and implementing the risk assessment process • Developing and implementing the risk mitigation strategy • Developing and implementing the risk monitoring and reporting process • Training the Company's employees on cybersecurity risk management The Company's cybersecurity risk management system is reviewed and updated on an annual basis. This includes a comprehensive incident response plan. The review process is designed to ensure that the system remains effective and efficient as the cybersecurity threat landscape evolves.


text: The Company's Chief Executive Officer ("CEO"), through the appropriate reporting channels, is responsible for the cybersecurity risk management program. The Company's information technology department is responsible for developing and implementing the Company's cybersecurity policies, procedures, and strategies; overseeing the Company's cybersecurity risk assessment process; and monitoring the Company's cybersecurity risk profile. Our VP, Information Technology, who leads the information technology department, has over 15 years of experience with information security and information technology matters.