text: Security audits and assessments We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, assessments, tabletop exercises, vulnerability scanning and penetration tests. We regularly engage third parties to assess our cybersecurity program, including cybersecurity maturity assessments, penetration testing, and independent review of our security control environment and operating effectiveness. The results of the assessments are included for review by the Security Steering Committee and the Audit and Finance Committee of the Board. We believe our cybersecurity program is enhanced with the results of the audits, assessments and reviews performed.


text: The Board is responsible for general oversight of our risk management, including cybersecurity risk. The Audit and Finance Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity and data protection, as well as the steps management has taken to monitor and control such exposures. Cybersecurity reviews are conducted at least quarterly and reported to the Board or the Audit and Finance Committee by the CISO and/or Chief Financial Officer at least quarterly.

companyName: PENTAIR plc

ticker: PNR

secItem: Item 1C


text: Our cybersecurity team, which assesses and manages our risks from cybersecurity threats, is led by the CISO, who reports to our Chief Financial Officer. Additional oversight for assessing and managing cybersecurity risk include the Security Steering Committee and as part of our ERM program.


text: The CISO has over 20 years of cybersecurity and technology experience and has previously held Chief Information Security Officer positions at a large public retail company, as well as at a public technology company and services organization. The CISO has an undergraduate degree in Management Information Systems. Members of our cybersecurity team have, combined, over 100 years of cybersecurity experience, have degrees including Bachelors in Information Systems, Management Information Systems and/or Masters in Security Technologies, and hold professional certifications including Certified Information Systems Security Professional, Global Information Assurance Certification Security Essentials, Certified Cloud Security Professional, Certified Information Systems Auditor, Microsoft Cybersecurity Architect Expert and/or Certified Digital Forensics Examiner. Our Chief Executive Officer, Chief Financial Officer and General Counsel each hold degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Impact of Cybersecurity Threats Previous cybersecurity incidents have not materially affected us, including our business strategy, results of operations or financial condition. However, risks from cybersecurity threats, including but not limited to exploitation of vulnerabilities, ransomware, denial of service, supply chain attacks, or other similar threats may materially affect us, including our execution of business strategy, reputation, results of operations and/or financial condition. See ITEM 1A. "Risk Factors - Increased cybersecurity threats and computer crime pose a risk to our systems, networks, products and services, and we are exposed to potential regulatory, financial and reputational risks relating to the protection of our data" for a discussion of cybersecurity risks.


text: Our management and Board of Directors (the "Board") recognize the importance of maintaining the security and resiliency of our cybersecurity environment to deliver on the expectations of our customers, dealers, business partners, employees and investors. The Board oversees our risk management practices, including our overall enterprise risk management ("ERM") program, in which cybersecurity risk is included. Our cybersecurity program is aligned with the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF") and leverages the International Organization for Standardization and other applicable industry standards. Overall, the purpose of our information security program is to protect the confidentiality, integrity and availability of our systems and data, along with the safe operation of our connected products. This is supported by our security operating framework, roadmap and governance.


text: Security governance We have established processes aimed to assess, identify and manage material risks from cybersecurity threats. Our ERM organizational process includes annual risk assessments. Our cybersecurity team, which is led by our Chief Information Officer and Chief Information Security Officer (the "CIO/CISO"), is responsible for identifying, assessing and managing strategic and operational cybersecurity risks. Our cybersecurity team shares information regarding such risks with our Security Steering Committee, which consists of our General Counsel, Chief Financial Officer, CIO/CISO, and members of our IT, Legal and ERM functions. Both our Security Steering Committee and our ERM function support the Board's oversight of cybersecurity risk.


text: Technical safeguards We deploy technical safeguards designed to protect our systems from cybersecurity threats, including firewalls, anti-malware software, and authentication and authorization controls. Ongoing enhancements are integrated into our security roadmap, as informed by our security audits and assessments.


text: Security and privacy incident response We maintain an incident response plan to identify, protect, detect, respond to and recover from cybersecurity threats and incidents. We test and evaluate our plans on a regular basis. The CIO/CISO, the Security Steering Committee, our Chief Executive Officer and the Board are notified of any material cybersecurity incidents through an established escalation process.


text: Third-party risk management We maintain a risk-based third-party risk management process designed to identify, assess and manage risks presented by service providers, vendors and other third parties that access our systems or that process or store our data.


text: Security audits and assessments We perform periodic security audits and assessments to test our cybersecurity program. These efforts span across our cybersecurity program, including but not limited to audits, assessments, tabletop exercises, vulnerability scanning and penetration tests. We regularly engage third parties to assess our cybersecurity program, including cybersecurity maturity assessments, penetration testing, and independent review of our security control environment and operating effectiveness. The results of the assessments are included for review by the Security Steering Committee and the Audit and Finance Committee of the Board. We look to enhance our cybersecurity program with the results of the audits, assessments and reviews we perform.


text: The Board is responsible for general oversight of our risk management, including cybersecurity risk. The Audit and Finance Committee of the Board is responsible for overseeing our risk exposure to information security, cybersecurity and data protection, as well as the steps management has taken to monitor and control such exposures. We conduct cybersecurity audits and assessments on a regular basis and either our CIO/CISO or Chief Financial Officer report to the Audit and Finance Committee on a quarterly basis.


text: Our cybersecurity team, which is responsible for assessing and managing our risks from cybersecurity threats, is led by the CIO/CISO, who reports to our Chief Financial Officer. The Security Steering Committee provides additional oversight for assessing and managing cybersecurity risk.


text: The CIO/CISO has over 20 years of cybersecurity and technology experience and has previously held Chief Information Security Officer positions at a large public retail company, as well as at a public technology company and services organization. The CIO/CISO has an undergraduate degree in Management Information Systems. Members of our cybersecurity team have broad experience in security functions in various industries. Our Chief Executive Officer, Chief Financial Officer and General Counsel each hold degrees in their respective fields, and each have over 25 years of experience managing risks at the Company and at similar companies, including risks arising from cybersecurity threats.


text: Cybersecurity Risk Management and Strategy We are regularly subject to cyberattacks and other cyber incidents. In response, we have implemented cybersecurity processes, technologies, and controls to aid in our efforts to assess, identify, and manage cybersecurity risks. Our enterprise risk management framework considers cybersecurity risk alongside other company risks as part of our overall risk assessment process. Our enterprise risk management team collaborates with our Information Security function, led by the Company's Chief Strategy and Transformation Officer and the Company's Chief Information Security Officer, to gather insights for identifying, assessing and managing cybersecurity threat risks, their severity, and potential mitigations.

companyName: PEPSICO INC

ticker: PEP


text: We assess PepsiCo's Information Security program using an industry-leading cybersecurity framework from the National Institute of Standards and Technology. To help assess and identify our cybersecurity risks, we maintain internal resources to perform penetration testing designed to simulate evolving tactics and techniques of real-world threat actors, engage with industry partners and law enforcement and intelligence communities and conduct tabletop exercises and periodic risk interviews across our business. We also engage an independent third party to perform internal and external penetration testing of PepsiCo's environment periodically and engage other third parties to periodically conduct assessments of our cybersecurity capabilities. In addition, we continue to expand training and awareness practices to mitigate human risk, including mandatory computer-based training, internal communications, and regular phishing awareness campaigns that are designed to emulate real-world contemporary threats and provide immediate feedback (and, if necessary, additional training or remedial action) to employees.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform PepsiCo during contracting and vendor selection processes. Additionally, when third party risks are identified, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked and periodic monitoring is conducted for third parties in order to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a successful material cyberattack, the Company has established well-defined response procedures to address cyber events that do occur. The program provides for the coordination of various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to assess for potential disclosure, comply with potentially applicable legal obligations and mitigate brand and reputational damage. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures.


text: Based on the information we have as of the date of this Form 10-K, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations or financial condition. See "Item 1A. Risk Factors" for further information about these risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management processes and an area of focus for our Board and management. Given that cybersecurity risks can impact various areas of responsibility of the Committees of the Board, the Board believes it is useful and effective for the full Board to maintain direct oversight over cybersecurity matters. In 2021, the Board amended our Corporate Governance Guidelines to specifically mention cybersecurity as an area of Board oversight to reflect this existing practice. The Board receives and provides feedback on regular updates from management, including from the Company's Chief Strategy and Transformation Officer and the Company's Chief Information Security Officer, regarding cybersecurity governance processes, the status of projects to strengthen internal cybersecurity, results from third-party assessments, and also discusses any significant cyber incidents, including recent incidents at other companies and the emerging threat landscape.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by the Company's Chief Strategy and Transformation Officer and the Company's Chief Information Security Officer. Such individuals have significant prior work experience in various roles across multiple industries involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs and managing compliance environments.


text: These members of management are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Our processes also address cybersecurity risks associated with our use of third-party service providers including suppliers, software and cloud-based service providers. We proactively evaluate the cybersecurity risk of a third party by utilizing a repository of risk assessments, external monitoring sources, threat intelligence and predictive analytics to better inform PepsiCo during contracting and vendor selection processes. Additionally, we require those third parties to agree by contract to implement appropriate security controls. Security issues are documented and tracked and periodic monitoring is conducted for third parties in order to mitigate risk. In addition to the processes, technologies, and controls that we have in place to reduce the likelihood of a successful material cyberattack, the Company has established well-defined response procedures to address cyber events that do occur. The program provides for the coordination of various corporate functions and governance groups and serves as a framework for the execution of responsibilities across businesses and operational roles. Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to assess for potential disclosure, comply with potentially applicable legal obligations and mitigate brand and reputational damage. We also maintain insurance coverage that, subject to its terms and conditions, is intended to address costs associated with certain aspects of cyber incidents and information systems failures.


text: Cybersecurity Governance Cybersecurity and risks related to our information technology ("IT") are an important focus of our Board of Directors' risk oversight. Our Board of Directors, with assistance from the Audit Committee, oversees the Company's enterprise risk management process, which includes cybersecurity risk management. The Audit Committee, a member of which holds a Certificate in Cyber Risk Governance and a Qualified Risk Director designation from the DCRO Institute, receives regular reports from our Chief Information Officer ("CIO"), along with members of senior management, on the identification and status of cybersecurity risks and management.

companyName: TUTOR PERINI CORP

ticker: TPC


text: Our IT and cybersecurity programs are managed by our CIO, who reports to the President. Our CIO has over 35 years of experience in managing IT and cybersecurity. We also have a dedicated Chief Information Security Officer ("CISO"), who reports to the CIO and has overall responsibility for establishing our enterprise-wide cybersecurity strategy, standards, architecture, processes and procedures, and policies. Our CISO has over 25 years of experience in IT and cybersecurity. The Company has adopted incident response plan procedures for assessing and escalating cybersecurity incidents to various response teams that include the CISO, the CIO and other senior management, as necessary.


text: Cybersecurity Risk Management and Strategy We have established various policies, processes, and technologies to aid in our efforts to assess, identify, manage, and mitigate material risks posed by cybersecurity threats, including, among other things: • Our CISO and IT teams continuously monitor our systems and perform an annual cybersecurity risk assessment; • We have implemented a proactive incident response and management plan generally aligned with the National Institute of Standards and Technology (NIST), with annual plan testing and training for employees involved in the response process; • Annual penetration tests are performed by a third party and any notable findings are included in remediation plans; • We engage with key industry partners and threat intelligence services, including assessors, consultants and other industry third parties to evaluate our cybersecurity risk management and incident response plans and processes; • All employees, contractors and temporary workers are required to review and acknowledge our acceptable use policies, which include sections on information and cybersecurity practices and policies; • Employees are regularly engaged in cybersecurity awareness campaigns, anti-phishing tests, and mandatory training as needed; • We address third-party cybersecurity risks through interviews and third-party independent assessment reports; • We maintain cybersecurity insurance coverage as part of our overall insurance portfolio; and • In conformity with customer requirements, we require proof that subcontractors complete relevant cybersecurity education and awareness training prior to being awarded a subcontract.


text: We are not aware of any risks from cybersecurity threats that have materially affected, or are reasonably likely to materially affect, our Company, business strategy, or financial results, and we have not experienced any cybersecurity incidents that have had a material adverse impact on our operations or financial results. See Item 1A. Risk Factors for a discussion of cybersecurity risks.


text: Our IT and cybersecurity programs are managed by our CIO, who reports to the President (who also became the Chief Executive Officer effective January 1, 2025). Our CIO has over 30 years of experience in managing IT and cybersecurity. We also have a dedicated Chief Information Security Officer ("CISO"), who reports to the CIO and has overall responsibility for establishing our enterprise-wide cybersecurity strategy, standards, architecture, processes and procedures, and policies. Our CISO has over 25 years of experience in IT and cybersecurity. The Company has adopted incident response plan procedures for assessing and escalating cybersecurity incidents to various response teams that include the CISO, the CIO and other senior management, as necessary.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) approach, which is subject to oversight by our BOD. Our cybersecurity policies and practices are aligned with relevant industry standards.

companyName: PFIZER INC

ticker: PFE


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity operation that endeavors to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing business disruptions. • External Collaboration: We collaborate with public and private entities, including intelligence and law enforcement agencies, industry groups and third-party service providers to identify, assess and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls and data protection. We continuously conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Education: We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events. • Supplier Ecosystem Management: We extend our cybersecurity management control expectations to our supply chain ecosystem, as applicable. This includes identifying cybersecurity risks presented by third parties. • Incident Response Planning: We have established, and maintain and periodically test, incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which material incidents would be communicated to executive management, our BOD, external regulators and shareholders. • Enterprise-Wide Coordination: We engage experts from across the Company to identify emerging risks and respond to cybersecurity threats. This cross-functional approach includes personnel from our R&D, manufacturing, commercial, technology, legal, compliance, internal audit and other business functions. Pfizer Inc.


text: • Governance: Our BOD's oversight of cybersecurity risk management is led by the Audit Committee, which oversees our ERM program. Cybersecurity threats, risks and mitigation are periodically reviewed by the Audit Committee and such reviews include both internal and independent assessment of risks, controls and effectiveness.


text: Our risk assessment efforts have indicated that we are a target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors including nation states, organized crime, malicious insiders and activists. The impacts of attacks, abuse and misuse of Pfizer's systems and information include, without limitation, loss of assets, operational disruption and damage to Pfizer's reputation.


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through auditing, assessments, drills and other exercises focused on evaluating the sufficiency and effectiveness of our risk mitigation. We regularly engage third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. Certain results of such assessments and reviews are reported to the Audit Committee and the BOD, as appropriate, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes and practices that management implements to prevent, detect and address risks from cybersecurity threats. The Audit Committee receives regular briefings on cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and considerations arising from our supplier ecosystem. The Audit Committee may also promptly receive information regarding any material cybersecurity incident that may occur, including any ongoing updates regarding the same. The Audit Committee periodically discusses our approach to cybersecurity risk management with our Chief Information Security Officer (CISO).


text: Our CISO is a member of our management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. The CISO works in coordination with other members of the management team, including, among others, the Chief Digital Officer, the Chief Financial Officer, the Chief Compliance and Risk Officer and the General Counsel and their designees. We believe our business leaders have the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats.


text: Our CISO, along with leaders from our privacy and corporate compliance functions, collaborate to implement a program designed to manage our exposure to cybersecurity risks and to promptly respond to cybersecurity incidents. Prompt response to incidents is delivered by multi-disciplinary teams in accordance with our incident response plan. Through ongoing communications with these teams during incidents, the CISO monitors the triage, mitigation and remediation of cybersecurity incidents, and reports such incidents to executive management, the Audit Committee and other Pfizer colleagues in accordance with our cybersecurity policies and procedures, as is appropriate.


text: As of the date of this Form 10-K, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition at this time. For further discussion of the risks associated with cybersecurity incidents, see the Item 1A. Risk Factors—Information Technology and Security section in this Form 10-K.


text: Managing cybersecurity risk is a crucial part of our overall strategy for safely operating our business. We incorporate cybersecurity practices into our Enterprise Risk Management (ERM) program. Management is responsible for assessing and managing risk, including through the ERM program, subject to oversight by our BOD. Our cybersecurity policies and practices are aligned with NIST (National Institute of Standards and Technology) industry standards.


text: Consistent with our overall ERM program and practices, our cybersecurity program includes: • Vigilance: We maintain a global cybersecurity operation that endeavors to detect, prevent, contain, and respond to cybersecurity threats and incidents in a prompt and effective manner with the goal of minimizing business disruptions. • External Collaboration: We collaborate with public and private entities, including intelligence and law enforcement agencies, industry groups and third-party service providers to identify, assess and mitigate cybersecurity risks. • Systems Safeguards: We deploy technical safeguards that are designed to protect our information systems, products, operations and sensitive information from cybersecurity threats. These include firewalls, intrusion prevention and detection systems, disaster recovery capabilities, malware and ransomware prevention, access controls and data protection. We continuously conduct vulnerability assessments to identify new risks and periodically test the efficacy of our safeguards through both internal and external penetration tests. • Education: We provide periodic training for all personnel regarding cybersecurity threats, with such training appropriate to the roles, responsibilities and access of the relevant Company personnel. Our policies require all workers to report any real or suspected cybersecurity events. • Supplier Ecosystem Management: We extend our cybersecurity management control expectations to our supply chain ecosystem, as appropriate. This includes identifying cybersecurity risks presented by third parties. • Incident Response Planning: We have established, and maintain and periodically test, incident response plans that direct our response to cybersecurity events and incidents. Such plans include the protocol by which certain significant or potentially material incidents would be communicated to executive management, our BOD, external regulators and shareholders, as appropriate. • Enterprise-Wide Coordination: We engage relevant stakeholders from across the Company to identify emerging risks and respond to cybersecurity threats. This cross-functional approach includes personnel from our R&D, manufacturing, commercial, technology, legal, compliance, internal audit and other business functions. Pfizer Inc.


text: Our risk assessment efforts have indicated that we are a target for theft of intellectual property, financial resources, personal information, and trade secrets from a wide range of actors including nation states, organized crime, malicious insiders and activists. The impacts of attacks, abuse and misuse of Pfizer's systems and information could include, without limitation, loss of assets, operational disruption and damage to Pfizer's reputation.


text: A key element of managing cybersecurity risk is the ongoing assessment and testing of our processes and practices through auditing, assessments, drills and other exercises focused on evaluating the sufficiency and effectiveness of our risk mitigation. We regularly engage third parties to perform assessments of our cybersecurity measures, including information security maturity assessments and independent reviews of our information security control environment and operating effectiveness. Certain results of such assessments and reviews are reported by the Chief Information Security Officer (CISO) to certain senior leaders, the Audit Committee and the BOD, as appropriate, and we make adjustments to our cybersecurity processes and practices as necessary based on the information provided by the third-party assessments and reviews.


text: The Audit Committee oversees cybersecurity risk management, including the policies, processes and practices that management implements to prevent, detect and address risks from cybersecurity threats. The Audit Committee receives periodic briefings on, and discusses with our CISO, cybersecurity risks and risk management practices, including, for example, recent developments in the external cybersecurity threat landscape, evolving standards, vulnerability assessments, third-party and independent reviews, technological trends and considerations arising from our supplier ecosystem. The Audit Committee may also promptly receive information regarding certain significant or potentially material cybersecurity incidents that may occur, including any ongoing updates regarding the same.


text: Our CISO is a member of our management team who is principally responsible for overseeing our cybersecurity risk management program, in partnership with other business leaders across the Company. We believe our CISO and the information security organization have the appropriate expertise, background and depth of experience relating to monitoring the prevention, mitigation, detection and remediation of cybersecurity incidents to manage risks arising from cybersecurity threats. The CISO works in coordination with other members of the management team, including, among others, the Chief Digital Officer, the Chief Financial Officer and the Chief Legal Officer and their designees.


text: For the fiscal year ended December 31, 2024, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. For further discussion of the risks associated with cybersecurity incidents, see the Item 1A. Risk Factors—Information Technology and Security section in this Form 10-K.


text: Risk Management and Strategy Cybersecurity is a critical priority within, and has been integrated into, our enterprise risk management framework. We have instituted a risk-based, multi-dimensional global cybersecurity program, guided by the framework established by NIST (National Institute of Standards and Technology). This program aims to assess, identify, and manage risks from potential threats to our data, systems and networks, as well as those of our primary third-party suppliers. We have deployed a suite of physical, administrative and technological safeguards to protect our information systems, encompassing personal data (associate, consumer, customer and business partner), intellectual property and confidential business information. These protections are designed to maintain the confidentiality, integrity and availability of all information housed within our network infrastructure.

companyName: PVH CORP. /DE/

ticker: PVH


text: Risk-based Controls for Information and Systems – We strive to secure our information technology infrastructure and data by implementing, maintaining and executing controls and continuously improving our cybersecurity program's maturity, risk management framework, policies, procedures and governance.


text: Incident Response Plan and Testing – We have a cybersecurity incident response plan and dedicated teams to respond to incidents. Cross-functional teams assess priority and severity, and external experts, including legal counsel, may be consulted. Our cybersecurity teams respond to incidents based on severity levels and improve our plan through regular table top breach exercises, penetration tests and simulations.


text: Education & Interactive Training – We provide cybersecurity training to associates, which includes monthly phishing exercises, to help them protect sensitive information and follow best practices. We offer role-based training for regulatory compliance and work with external partners to develop and deliver education and training to mitigate cybersecurity risks. We continually evaluate trends within the industry, apply necessary controls and empower our leadership to make informed, risk-based decisions.


text: Third-Party Risk Management – We execute targeted cybersecurity assessments of suppliers, evaluating their risk profiles and using a rating mechanism to identify vulnerabilities. We also partner with primary suppliers to implement advanced security measures to safeguard their information technology systems and have data security provisions in our contracts with third parties that handle our data.


text: Threat and Vulnerability Management – We, along with our external partners, use resources, technology, and processes to identify, remediate, and report security threats in our systems. These controls are crucial to minimize our attack surface and prioritize possible threats.


text: Cybersecurity and Compliance Assessment Practices – We conduct regular cybersecurity assessments with independent firms and annual evaluations for compliance with Payment Card Industry – Data Security Standards (PCI DSS) and benchmark maturity assessments aligned with the NIST Cybersecurity Framework. Our Internal Audit department evaluates our information security program through annual information security and cybersecurity audits. We also perform internal controls testing as Section 404 of the Sarbanes-Oxley Act mandates.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion of related risks, please see our Information Technology risk factor "We rely significantly on information technology. Our business and reputation could be adversely impacted if our computer systems, or systems of our business partners and service providers, are disrupted or cease to operate effectively or if we or they are subject to a data security or privacy breach" in Item 1A. Risk Factors of this report.


text: Board of Directors The Board of Directors oversees the management of risks related to the operation of our business. As part of its oversight, the Board receives periodic reports (no less often than annually) from members of senior management on various aspects of risk, including, among other things, our enterprise risk management program, business continuity planning, and cybersecurity. The Audit & Risk Management Committee of the Board of Directors has principal Board-level responsibility for reviewing and assessing our significant risks, including cybersecurity risks, and management's program to assess, monitor, and manage such exposures, and can raise any significant issues pertaining to these items with the full Board of Directors at each Board meeting. As part of this role, the Committee receives updates at most meetings from the Chief Information Security Officer (CISO) on various cybersecurity matters, including material risks and threat trends, mitigation strategies, security incidents, the status of priorities and initiatives, and other related matters of importance, as well as an annual in-depth review of cybersecurity strategy and initiatives for the coming year. The Committee also reviews the results of the independent cybersecurity assessments and compliance evaluations discussed above. In addition to these regular updates, the Committee and the full Board of Directors would also be promptly informed by the Chief Executive Officer of any cybersecurity incidents should they occur, as well as provided ongoing updates from lead members of the incident response teams, including the CISO, regarding any such incidents in accordance with our incident response plan.


text: The CISO reports to the Chief Technology and Information Officer and leads our Information Security Group, a global function that spans our organization and is responsible for executing against our global cybersecurity program. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. Our CISO has over 25 years of experience managing and leading information technology and cybersecurity teams and participates in various industry and public sector cybersecurity groups.


text: Risk Management and Strategy Cybersecurity is a critical priority within, and has been integrated into, our enterprise risk management framework. We have instituted a risk-based, multi-dimensional global cybersecurity program, guided by the framework established by NIST. This program aims to assess, identify, and manage risks from potential threats to our data, systems and networks, as well as those of our primary third-party suppliers. We have deployed a suite of physical, administrative and technological safeguards to protect our information systems, encompassing personal data (associate, consumer, customer and business partner), intellectual property and confidential business information. These protections are designed to maintain the confidentiality, integrity and availability of all information housed within our network infrastructure.


text: Education and Interactive Training – We provide cybersecurity training to associates, which includes monthly phishing exercises, to help them protect sensitive information and follow best practices. We offer role-based training for regulatory compliance and work with external partners to develop and deliver education and training to mitigate cybersecurity risks. We continually evaluate trends within the industry, apply necessary controls and empower our leadership to make informed, risk-based decisions.


text: Cybersecurity and Compliance Assessment Practices – We conduct regular cybersecurity assessments with independent firms and annual evaluations for compliance with Payment Card Industry – Data Security Standards (PCI DSS) and benchmark maturity assessments aligned with the NIST Cybersecurity Framework version 2.0. Our Internal Audit department evaluates our information security program through annual information security and cybersecurity audits. We also perform internal controls testing as Section 404 of the Sarbanes-Oxley Act mandates.


text: As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition. For a discussion of related risks, please see our Information Technology risk factor "We rely significantly on information technology. Our business and reputation could be adversely impacted if our computer systems, or the systems of our business partners and service providers, are disrupted or cease to operate effectively or if we or they are subject to a data security or privacy breach" in Item 1A. Risk Factors of this report.


text: Board of Directors The Board of Directors oversees the management of risks related to the operation of our business. As part of its oversight, the Board receives periodic reports (no less often than annually) from members of senior management on various aspects of risk, including, among other things, our enterprise risk management program, business continuity planning, and cybersecurity. The Audit & Risk Management Committee of the Board of Directors has principal Board-level responsibility for reviewing and assessing our significant risks, including cybersecurity risks, and management's program to assess, monitor, and manage such exposures, and can raise any significant issues pertaining to these items with the full Board of Directors at each Board meeting. As part of this role, the Committee receives updates at most meetings from the Chief Information Security Officer ("CISO") on various cybersecurity matters, including material risks and threat trends, mitigation strategies, security incidents, the status of priorities and initiatives, and other related matters of importance, as well as an annual in-depth review of cybersecurity strategy and initiatives for the coming year. Additionally, quarterly advisory services and annual training are provided to the Committee from an independent firm which gives the Committee an outside perspective on the Company's cybersecurity program and keeps them abreast of cybersecurity trends affecting the industry. The Committee also reviews the results of the independent cybersecurity assessments and compliance evaluations discussed above. In addition to these regular updates, the Committee and the full Board of Directors would also be promptly informed by the Chief Executive Officer or Chief Financial Officer of any potentially significant cybersecurity incident should one occur, as well as provided ongoing updates from lead members of the incident response teams, including the CISO, regarding any such incidents in accordance with our incident response plan.


text: The CISO leads our Information Security Group, a global function that spans our organization and is responsible for executing against our global cybersecurity program. The CISO is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity incidents through our key cybersecurity processes, discussed above, and, together with other lead members of the incident response teams, is responsible for informing senior leadership across the organization about any cybersecurity incidents that may occur. Our CISO has over 25 years of experience managing and leading information technology and cybersecurity teams and participates in various industry and public sector cybersecurity groups. The CISO reports to the Chief Technology and Information Officer, who has over 20 years of experience leading technology teams for multi-brand consumer businesses and leads the Company's information technology strategy and oversees the global cybersecurity function.


text: A comprehensive cybersecurity program is critical to achieving our business goals. Like all companies in today's world, we face a multitude of cybersecurity threats that range from ransomware and denial-of-service, to attacks from more advanced nation state actors, and even insider threats. Likewise, our customers, suppliers, subcontractors and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business operations and financial performance. These cybersecurity threats and related risks make it imperative that we expend considerable resources to safeguard our organization's assets and to prevent service disruptions or minimize the impact should an incident occur.

companyName: PITNEY BOWES INC /DE/

ticker: PBI


text: The Audit Committee of the Board of Directors oversees the technology functions, including management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior technology leadership, including our Chief Information Security Officer (CISO), briefs the Audit Committee of the Board of Directors on our cybersecurity and information security posture semi-annually and on an as needed basis and the full Board of Directors is apprised on an annual basis. In the event of an incident, we strive to follow our detailed incident response playbook, which outlines the steps to be taken from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), customers, as well as senior leadership and the Board, in each case, as appropriate.


text: Our information security organization is led by the CISO, who is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. The Vice President of Product Security (VP of Product Security) provides additional expertise and focus attempting to ensure the integrity and resiliency of the products and services we provide to our customers. Combined, the CISO and VP of Product Security possess over 50 years of deep information technology, cyber security, program management, and risk experience. The information security organization manages and continually enhances a robust enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system resilience in an effort to minimize the business impact should an incident occur. Our cybersecurity program attempts to follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles. We have adopted a risk-based management process used to define, manage, and prioritize controls required to maintain the integrity and availability of our digital assets. Employees outside of our corporate information security organization also have a role in our cybersecurity defenses and they are immersed in a corporate culture and periodic training, supportive of security, which we believe improves our overall cybersecurity posture.


text: We have also extended our cybersecurity governance to our operational business executives. Mission critical information assets, those that would cause significant business, customer, or employee impact, are periodically presented by technical leadership to the appropriate senior management executive. This is a formal assessment which describes the underlying cyber posture, mitigation plan, and commitments. In addition, the Company's Privacy and Cybersecurity Steering committee, which is co-led by the CISO and the VP of Product Security and comprised of leaders from the Company's information technology, innovation, legal and internal audit organizations, meets periodically to ensure the overall Cybersecurity Program is progressing against its goals and new risks are operationally prioritized.


text: We rely heavily on third parties to support our products, business operations and technology services, and a cybersecurity incident at a supplier, subcontractor or partner could materially adversely impact us. Where possible, we endeavor to include information security provisions, audit rights and insurance requirements, in contracts with our suppliers and third-parties based on their level of access to our systems and data. For our most critical suppliers, where possible, we attempt to pursue an annual attestation of ongoing compliance to our standard policies and practices. For select suppliers, we engage third-party cybersecurity monitoring and alerting services, and seek to work directly with those suppliers to address potential deficiencies identified.


text: Given the constantly evolving cyber-threat landscape, as well as the previously disclosed ransomware attacks we experienced in 2019 and 2020, we continuously test and evolve our cybersecurity program. We engage internal security team experts who perform 'ethical hacks' against our information assets to uncover risks. As part of its risk based annual audit plan, our internal audit team reviews a number of components of our information technology operations, which taken together, comprise our cybersecurity defenses. A report of its findings is distributed to certain members of management and completion of the auditor's comments is tracked and reported up to the Audit Committee of the Board. We also engage third-party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that our ERM process evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process annual risk assessment is presented to the Audit Committee of the Board of Directors.


text: Notwithstanding the cybersecurity protections we have in place, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: A comprehensive cybersecurity program is critical to achieving our business goals. Like all companies in today's world, we face a multitude of cybersecurity threats that range from ransomware, and denial-of-service, to attacks from more advanced nation state actors, and even insider threats. Likewise, our customers, suppliers, subcontractors and partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our business operations and financial performance. These cybersecurity threats and related risks make it imperative that we expend considerable resources to safeguard our organization's assets and to prevent service disruptions or minimize the impact should an incident occur. Our processes for assessing, identifying, and managing material risks from cyberecurity threats are described below. These cybersecurity risk managment processes are integrated into our overall risk management system.


text: The Audit Committee of the Board of Directors oversees the Company's technology functions, including management's processes for identifying and mitigating risks, including cybersecurity risks, to help align our risk exposure with our strategic objectives. Senior technology leadership, including our Chief Information Security Officer (CISO), briefs the Audit Committee and the full Board of Directors on our cybersecurity and information security posture on a regular cadence. In addition to this regular reporting, cybersecurity risks or threats may also be escalated to the Audit Committee on an as-needed basis. In the event of an incident, we strive to follow our detailed incident response playbook, which outlines the steps to be taken from incident detection to mitigation, recovery, escalation to senior management, the Board of Directors, and functional areas, and notification to customers and employees as appropriate.


text: Our information security organization is led by the CISO, who is responsible for our overall information security strategy, policy, security engineering, product security, operations and cybersecurity threat detection and response. The CISO has 32 years of experience serving in various information technology roles. The information security organization manages and continually enhances an enterprise security structure with the goal of preventing cybersecurity incidents to the extent feasible, while simultaneously increasing our system and product resilience in an effort to minimize the business impact should an incident occur. Our cybersecurity program attempts to follow the National Institute of Standards and Technology (NIST) Cybersecurity Framework principles. We also strive to maintain ISO certification and assurance reporting under AICPA SOC2 for several of our systems and products. We have adopted a risk-based management process to define, manage, and prioritize controls required to maintain the integrity and availability of our digital assets. Employees outside of our information security organization also have a role in our cybersecurity defenses and are required to receive periodic cybersecurity training, which we believe improves our overall cybersecurity posture.


text: We have also extended our cybersecurity governance to our operational business executives. Technical leadership periodically presents an assessment of mission critical information assets, those that would cause significant business, customer, or employee impact to the appropriate senior management executives. This is a formal assessment which describes the underlying cyber posture, mitigation plan, and commitments. It ensures that the cybersecurity program in the business unit is progressing against its goals and new risks are operationally prioritized. In addition, the CISO meets with leaders from the Company's legal, IT, and internal audit organizations to ensure alignment with privacy, regulations, legal compliance and audit plans.


text: We rely heavily on third party partners (i.e. suppliers, subcontractors, consultants, etc.) to support our products, business operations and technology services, and a cybersecurity incident at a partner could materially adversely impact us. Where possible, we include information security provisions, audit rights and insurance requirements, in contracts with these partners based on their level of access to our systems and data. For our most critical partners, where possible, we attempt to pursue an annual attestation of ongoing compliance to our standard policies and practices. For select partners, we engage third party cybersecurity monitoring and alerting services, and seek to work directly with those partners to address potential deficiencies identified.


text: Given the constantly evolving cyber-threat landscape, as well as the previously disclosed ransomware attacks we experienced in 2019 and 2020, we continuously test and evolve our cybersecurity program. We engage internal security team experts who perform 'ethical hacks' against our information assets to uncover risks. As part of its risk based annual audit plan, our internal audit team reviews a number of components of our information technology operations, which taken together, comprise our cybersecurity defenses. A report of its findings is distributed to certain members of management and completion of the auditor's comments is tracked and reported up to the Audit Committee. We also engage third party service providers to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges. These evaluations include testing both the design and operational effectiveness of security controls.


text: Assessing, identifying, and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) process. Cybersecurity related risks are included in the risk universe that our ERM process evaluates to assess top risks to the enterprise on an annual basis. To the extent the ERM process identifies a heightened cybersecurity related risk, risk owners are assigned to develop risk mitigation plans, which are then tracked to completion. The ERM process annual risk assessment is presented to the Audit Committee.


text: As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably likely to have a material effect on the organization. The Company and its service providers have experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place. Notwithstanding the cybersecurity protections we have in place, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: The Company's Global Chief Information Officer ("Global CIO") leads all aspects of the Company's information technology ("IT") strategy, including digital capabilities and information systems. The Company's Global Chief Information Security Officer ("Global CISO"), who reports to the Global CIO, is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including the Brink's Global Information Security ("GIS") Program. The Global CIO, with support from the Global CISO, provides periodic reports to the Board of Directors (the "Board"), the Chief Executive Officer, the Chief Financial Officer ("CFO") (to whom the Global CIO reports) and other members of our senior management. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. The GIS Program is regularly evaluated internally and externally, including by third-party experts, and the results of those evaluations are reported to senior management and the Board. The Company also actively engages with key vendors, industry participants and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security program, policies and procedures.

companyName: BRINKS CO

ticker: BCO


text: Cybersecurity Risk Management and Strategy The Company's Processes for Assessing, Identifying, and Managing Material Cybersecurity Risks The Company's processes for assessing, identifying, and managing cybersecurity risks generally follow frameworks established by the International Organization for Standardization (ISO) and the U.S. National Institute of Standards and Technology (NIST). The Company relies on its IT infrastructure, including the GIS Program, which is designed to reduce cybersecurity risks by ensuring that computer systems are secure through protecting networks, systems, applications, hardware, and data to mitigate cyber attacks. Our business includes managing, processing, storing and transmitting proprietary and confidential data, including personally identifiable information and other confidential information. The Company's IT infrastructure and GIS Program are critical to its business activities, and any unauthorized access to, unplanned disruptions or failures of, or cybersecurity attacks, on these systems pose risks to our business, financial condition and results of operations.


text: The Company has an enterprise risk management ("ERM") program, for which the Board has oversight responsibility. Under the ERM program, senior leaders from across the Company's global footprint annually evaluate risks according to likelihood, significance and velocity to identify and prioritize the most significant risks facing the Company. "IT and Cybersecurity risk" has been identified as part of the ERM program as a significant risk, and the CFO is assigned to this risk area to ensure the development of mitigation plans, monitor progress against those plans, and maintain and measure against a set of key risk indicators.


text: In addition, the Company's Global Security Operations Center (the "GSOC"), an internal monitoring and reporting center that is a part of the GIS Program, provides 24/7 monitoring, detection and response capabilities for cybersecurity events. The GSOC also analyzes cyber threat intelligence from a variety of paid and non-paid sources..


text: Cybersecurity Risk Management and Mitigation The Global CISO manages our risk monitoring and mitigation processes and is responsible for cybersecurity risk management. The Company has adopted physical, technological and administrative cybersecurity controls and has defined procedures for incident detection, containment, response and remediation. The Global CISO works with business units and IT to ensure the appropriate policies are in place and to improve efficiency. Our global IT governance, risk and compliance team, which is a part of the GIS Program, manages IT general controls and cybersecurity best practices. We have an internal cybersecurity incident response plan designed to minimize the impact of cyber incidents and ensure consistent responses to any such incident. This plan undergoes regular reviews and updates.


text: The Company builds information security awareness among our employees by conducting regular training on our cybersecurity and data protection policies and executing vulnerability testing with employee simulated email threats. The Company also regularly updates employees on cybersecurity issues, assesses for susceptibility to email phishing and provides tools to alert the global information security team to potential phishing activity. Our employees have multiple mechanisms for reporting cybersecurity and data privacy concerns to the Company, including the Brink's GSOC and the Brink's Ethics Hotline. We believe providing ongoing training and real-world learnings to the Company's workforce is a crucial part of ensuring security and defending against future attacks.


text: The Company internally assesses its cybersecurity regularly and engages a third-party external auditor to conduct annual cybersecurity risk assessments, both of which allow us to identify key cybersecurity and data protection risks and develop plans, policies, and procedures to mitigate such risks.


text: We also have a vulnerability management program in place that is designed to protect our external and internal networks and critical assets. In addition, we have designed policies and procedures so that our Disclosure Committee, which is composed of members of management and is co-chaired by the Company's CFO and General Counsel, is appropriately informed of significant cybersecurity matters to ensure compliance with applicable cybersecurity disclosure requirements for our public filings. The Disclosure Committee meets on a quarterly basis and more often as necessary.


text: We maintain cybersecurity insurance and regularly consult with third-party cybersecurity experts during our review of cybersecurity controls in place. We also perform periodic assessments of our key vendors, which allows the Company to identify vendor cybersecurity risks and to develop reasonable mitigation plans.


text: Impacts of Cybersecurity Threats and Prior Incidents We have experienced and expect to continue to experience cybersecurity attacks and have expended human and financial resources to respond to such attacks.


text: Although we have taken significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security. As of December 31, 2023, management has determined that none of the cyberattacks we have experienced, individually or in the aggregate, have had a material adverse effect on our business, financial condition, or results of operations, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information about these risks, see the risk factor titled "Risks associated with information technology can expose Brink's to business disruptions, cybersecurity breaches and regulatory violations" under Item 1A of this Annual Report on Form 10-K and incorporated by reference herein.


text: Cybersecurity Governance Board's Oversight of Risks from Cybersecurity Threats The Board oversees our ERM program, including the review of cybersecurity and IT risks. The Board is also regularly briefed by the Global CIO, with the support of the Global CISO, on our cybersecurity risk management framework and completed, ongoing and planned actions relating managing to cybersecurity risks. These reports also include updates on the status of projects to strengthen our information security systems, recent assessments of the information security program and the emerging threat landscape.


text: Management's Role in Assessing and Managing our Material Risks from Cybersecurity Threats Ms. Sethi serves as the Company's Global CIO and reports to Kurt McMaken, the Company's CFO. Ms. Sethi has over 25 years of experience in the IT field and oversees all aspects of our IT, from planning and implementing enterprise IT systems to improving service quality, compliance and corporate development. Ms. Sethi sets our strategic vision and roadmap to define, build and optimize our IT systems, policies and operations. Ms. Sethi regularly reports to the Board regarding cybersecurity risks.


text: James Holley, the Global CISO, oversees our information, cyber, and technology security and reports to Neelu Sethi, the Company's Global CIO. Mr. Holley has over 30 years of leadership, operational and technical experience in information security. He leads the development, implementation and enforcement of security policies and data breach resiliency plans, as well as works with internal and external cybersecurity and IT teams to monitor and maintain the security of our IT infrastructure. Mr. Holley holds a Master's Degree in Computer Science with a concentration in information security as well as multiple information security certifications.


text: The Company's Global Chief Information Officer ("Global CIO") leads all aspects of the Company's IT strategy, including digital capabilities and information systems. The Company's Global Chief Information Security Officer ("Global CISO"), who reports to the Global CIO, is responsible for leading our enterprise-wide cybersecurity strategy, policy, standards, architecture and processes, including the Brink's GIS Program. The Global CIO, with support from the Global CISO, provides periodic reports to the Board, the Chief Executive Officer, the Chief Financial Officer ("CFO") (to whom the Global CIO reports) and other members of our senior management. These reports include updates on our cybersecurity risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program and the emerging threat landscape. The GIS Program is regularly evaluated internally and externally, including by third-party experts, and the results of those evaluations are reported to senior management and the Board. The Company also actively engages with key vendors, industry participants and intelligence and law enforcement communities as part of its continuing efforts to evaluate and enhance the effectiveness of its information security program, policies and procedures.


text: In addition, the Company's Global Security Operations Center (the "GSOC"), an internal monitoring and reporting center that is a part of the GIS Program, provides 24/7 monitoring, detection and response capabilities for cybersecurity events. The GSOC also analyzes cyber threat intelligence from a variety of paid and non-paid sources.


text: We maintain cybersecurity insurance and regularly consult with third-party cybersecurity experts during our review of existing cybersecurity controls. We also perform periodic assessments of our key vendors, which allow the Company to identify vendor cybersecurity risks and develop reasonable mitigation plans.


text: Although we have taken significant steps to mitigate cybersecurity risk across a range of functions, such measures can never eliminate the risk entirely or provide absolute security. As of December 31, 2024, management has determined that none of the cyberattacks we have experienced, individually or in the aggregate, have had a material adverse effect on our business, financial condition, or results of operations, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information about these risks, see the risk factor titled " Risks associated with information technology can expose Brink's to business disruptions, cybersecurity breaches and regulatory violations" under Item 1A of this Annual Report on Form 10-K and incorporated by reference herein.


text: Management's Role in Assessing and Managing our Material Risks from Cybersecurity Threats Neelu Sethi serves as the Global CIO and reports to Kurt McMaken, the CFO. Ms. Sethi has over 25 years of experience in the IT field and oversees all aspects of our IT, from planning and implementing enterprise IT systems to improving service quality, compliance and corporate development. Ms. Sethi sets our strategic vision and roadmap to define, build and optimize our IT systems, policies and operations. Ms. Sethi regularly reports to the Board regarding cybersecurity risks.


text: James Holley, the Global CISO, oversees our information, cyber, and technology security and reports to the Company's Global CIO. Mr. Holley has over 30 years of leadership, operational and technical experience in information security. He leads the development, implementation and enforcement of security policies and data breach resiliency plans, as well as works with internal and external cybersecurity and IT teams to monitor and maintain the security of our IT infrastructure. Mr. Holley holds a master's degree in computer science with a concentration in information security as well as multiple information security certifications.


text: PPG's cybersecurity program is designed to protect and preserve the confidentiality, integrity and availability of our networks and systems as well as information that we own or is in our care through a risk-based approach. The Company's program is based on the U.S. National Institute for Standards and Technology (NIST) cybersecurity framework and other applicable industry frameworks.

companyName: PPG INDUSTRIES INC

ticker: PPG


text: Our cybersecurity program includes: • ongoing employee cybersecurity awareness and training activities, which include frequent phishing testing; • access management and access controls intended to implement Principle of Least Privilege (PoLP) access; • protection of certain data through encryption at rest and in transit; • monitoring and protection software; • a vulnerability management program that includes managing the risk of third-party software; • a cyber incident response plan that provides controls and procedures to support appropriate containment, response, investigation, reporting and recovery of cybersecurity incidents; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provision into various contracts.


text: PPG has continued to invest in cybersecurity to evolve and improve its program. PPG regularly assesses and measures itself against industry practices to identify opportunities to improve its people, processes and technology used to identify, prevent, detect, respond and recover from cybersecurity incidents. When such improvements are identified and validated as appropriate in PPG's business context, they are incorporated in the roadmap for implementation.


text: To date, the risks from cybersecurity threats have not materially affected the Company. We have significantly increased our cybersecurity investments over the last five years and have implemented cybersecurity safeguards designed to detect and prevent cybersecurity events that may have a material adverse effect on the Company. Notwithstanding our increased cybersecurity investments and preparedness activities, sophisticated and targeted computer crime perpetrated by threat actors internal or external to the Company poses a risk to the security of our systems, facilities, and networks and to the confidentiality, availability and integrity of our data, including but not limited to intellectual property and confidential and personal data. This could lead to negative publicity, theft or other financial loss, modification or destruction of proprietary information or key information, manufacture of defective products, production downtimes and operational disruptions, which could materially and adversely affect our reputation, competitiveness and results of operations. Refer to the risk factor titled "The security of our information technology systems could be compromised which could adversely affect our operations or reputations" in Item 1A of this Form 10-K for further detail regarding cybersecurity risks that could affect PPG's operations. We maintain insurance covering certain costs that we may incur in connection with cybersecurity incidents, which we believe is commensurate with the size and the nature of our operations. However, the Company may incur expenses and losses related to a cyber incident that are not covered by insurance or are in excess of our insurance coverage.


text: The PPG Board of Directors (the "Board") has overall responsibility for the oversight of risk management at PPG, which includes cybersecurity risks. The Audit Committee of the Board (the "Audit Committee"), is responsible for oversight of the Company's enterprise risk management ("ERM") program which provides oversight and governance of all of the Company's operational and financial risks including risks from cybersecurity threats to the Company. The Audit Committee receives bi-annual reports and periodic briefings on cybersecurity matters, including key risks to the Company, recent developments, and risk mitigation activities from our Vice President and Chief Information Officer ("CIO") and our Chief Information Security Officer ("CISO"), who are both responsible for overseeing our cybersecurity program. In addition, the full Board receives bi-annual briefings from our CIO on our cybersecurity program. The Board and the Audit Committee also periodically review the results of exercises performed by our advisors as part of an independent assessment of PPG's cybersecurity program and internal preparedness.


text: In addition, the Enterprise Risk Committee, a committee of senior executives who identify and monitor the risks to PPG and are responsible for our ERM program, receives updated information on cybersecurity risks at each of its meetings.


text: As part of their oversight of our cybersecurity program, our CIO and our CISO oversee a team of cybersecurity professionals and are responsible for assessing and managing our material risks from cybersecurity threats. Our CIO and CISO are trained information technology professionals, each of whom has earned degrees in information systems and business administration and has many years of experience in or managing global enterprise information technology at various organizations.


text: PPG maintains an internal communication hierarchy that is designed to communicate the occurrence of certain cybersecurity events and/or incidents into our systems to our CISO, our CIO, our company crisis response team, and, as appropriate, to certain members of senior management. This communication hierarchy includes protocols for informing the Audit Committee and the full Board of certain cybersecurity events and/or incidents and for determining the materiality thereof.


text: Our cybersecurity program includes: • ongoing employee cybersecurity awareness and training activities, which include frequent phishing testing; • access management and access controls intended to implement Principle of Least Privilege (PoLP) access; • protection of certain data through encryption at rest and in transit; • monitoring and protection software; • a vulnerability management program that includes managing the risk of third-party software; • a cyber incident response plan that provides controls and procedures to support appropriate containment, response, investigation, reporting and recovery of cybersecurity incidents; • periodic testing of our cybersecurity posture, including by independent third-party consultants; and • integrating cybersecurity requirements and other provisions into various contracts.


text: Cybersecurity Risk Management and Strategy Cybersecurity represents an important component of our overall approach to enterprise risk management. Our cybersecurity policies and processes are fully integrated into our Enterprise Risk Management program and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is set from the top and continuously reinforced with our employees through education and regular testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. The Board of Directors is briefed on our strategy and roadmap in alignment with the NIST Cybersecurity Framework. The Board receives annual updates on program maturity, cybersecurity risks, threat landscape and overall program progress.

companyName: POWELL INDUSTRIES INC

ticker: POWL


text: Education and Awareness We provide required security awareness education and training to our employees and contractors with system access that focuses on various aspects of the cybersecurity world. Users of Powell's internal systems are required to complete an annual cybersecurity awareness training and are tested for awareness on a regular basis. We also provide tailored training courses to functional technology employees and employees who process personal or sensitive information.


text: Threat Management, Incident Response, and Recovery Planning We have established and maintain a comprehensive incident response and recovery plan designed to identify, contain and eradicate cybersecurity threats, with recovery from an incident as rapidly as possible. Our information security team utilizes threat technologies and vendors to monitor and respond to security threats via a 24/7/365 Security Operations Center. In the event of a security incident, a defined procedure outlines containment, response and immediate recovery actions. The incident response plan is tested, evaluated and updated no less than on an annual basis.


text: Data and Consumer Privacy Our data and consumer privacy program monitors, adapts to and works diligently to comply with changes in global privacy legislation. We have implemented technical, procedural and organizational measures designed to comply with applicable data protection and consumer privacy laws. We conduct external benchmarking, as well as privacy compliance audits, to stay abreast of developing privacy laws and understand developing risks, best practices and industry trends.


text: Third-Party Risk Management We recognize the risks associated with the use of vendors, service providers, and other third parties that provide information system services to us, process information on our behalf, or have access to our information systems. The Company has processes in place to oversee and manage these risks. We have an information risk management program that includes a vendor risk assessment process, whereby we systematically oversee and identify risks from cybersecurity threats related to our use of key third-party service providers.


text: Cybersecurity Governance Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. Our Board of Directors has delegated responsibility to the Audit Committee for the oversight of cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, the cybersecurity program is led by the Chief Information Security Officer who reports to the Chief Information Officer. Our Chief Information Security Officer has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint. He leads global teams in cybersecurity and infrastructure operations and regularly attends training in cybersecurity and risk mitigation. The Information Technology (IT) Cybersecurity Risk Management Committee, comprising senior IT leaders, meets quarterly and reviews trending risks and remediation efforts, and reports to the Audit Committee. When necessary, we assign resources to mitigate and evaluate risks to the enterprise level as part of our Enterprise Risk Management program.


text: The Audit Committee receives a comprehensive annual report of cybersecurity risks, threat landscape, and overall program status. On an annual basis, the Chief Information Security Officer reports to the Audit Committee on various metrics on threat management, incident response and recovery planning, along with industry benchmarks. The Audit Committee reports on these matters to our Board of Directors as needed. In addition, the Chief Information Security Officer periodically presents directly to our Board of Directors on our cybersecurity program.


text: We believe that the risks from cybersecurity threats thus far, including any previous cybersecurity incidents, have no material impact on our business including our business strategy, financial condition or results of operations. For additional information about the cybersecurity risks, see Item 1A. Risk Factors.


text: Cybersecurity Risk Management and Strategy Cybersecurity represents an important component of our overall approach to enterprise risk management. Our cybersecurity policies and processes are fully integrated into our Enterprise Risk Management program and are based on the National Institute of Standards and Technology Framework for Improving Critical Infrastructure Cybersecurity (the NIST Cybersecurity Framework), a toolkit for organizations to manage cybersecurity risk in its assessment of cybersecurity capabilities and in developing cybersecurity priorities. In addition to internal assessments, our cybersecurity strategy and capabilities are evaluated and audited against the NIST Cybersecurity Framework and industry best practices by independent, third-party, leading specialists in cybersecurity. We strive to create a culture of cybersecurity resilience and awareness. This tone is set from the top and continuously reinforced with our employees through education and regular testing. We continue to improve our programs and invest in the security of our systems, operations, people, infrastructure, and cloud environments. Our cybersecurity strategy seeks to follow industry best practices designed to ensure compliance with applicable global privacy and regulatory requirements. To protect our customers, we administer physical, technological and administrative controls on data privacy and security. We regularly validate our security controls by performing penetration testing, compliance audits, as well as proactive security testing to ensure our systems and controls are secure. The Board of Directors is briefed on our strategy and roadmap in alignment with the NIST Cybersecurity Framework. The Board receives annual updates on program maturity, cybersecurity risks, threat landscape and overall program progress.


text: Cybersecurity Governance Our executive management team and Board of Directors oversee our policies with respect to risk assessment and the management of those risks that may be material to us, including cybersecurity risks. Our Board of Directors has delegated responsibility to the Audit Committee for the oversight of cybersecurity risks. While cybersecurity resilience is the responsibility of every employee and contractor, the cybersecurity program is led by the Chief Information Security Officer who reports to the Chief Financial Officer. Our Chief Information Security Officer has extensive experience in network engineering and cybersecurity operations from both a practical and management standpoint. He leads global teams in cybersecurity and infrastructure operations and regularly attends training in cybersecurity and risk mitigation. The Information Technology (IT) Cybersecurity Risk Management Committee, comprising senior IT leaders, meets quarterly and reviews trending risks and remediation efforts, and reports to the Audit Committee. When necessary, we assign resources to mitigate and evaluate risks to the enterprise level as part of our Enterprise Risk Management program.


text: Risk Management and Strategy The Company employs multiple tools and processes for assessing, identifying, and managing material risks from cybersecurity threats. A multi-functional enterprise security team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the Chief Information Officer (CIO) and Chief Information Security Officer (CISO), and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program and, when identified, are reported to relevant business and governance leaders within the Company for appropriate action.

companyName: PROCTER & GAMBLE Co

ticker: PG


text: To support the ongoing identification and management of cybersecurity issues, the Company provides information security employee training, conducts global and targeted phishing simulation campaigns and conducts tabletop exercises. The Company also deploys a large library of security tools and experts to help prevent, detect, contain, eradicate and recover from potential cybersecurity issues and cyber-attacks. Further, the Company engages third-party consultants and services for cyber intelligence, insights and assessments of its cybersecurity risk posture and governance.


text: Cybersecurity reviews are embedded into the Company's Third-Party Risk Management program. Generally under this program, third parties that process personal data or high-risk business data on behalf of the Company complete privacy and cybersecurity assessments on a risk basis, which may require such third parties to sign data processing agreements, comply with particular security controls or complete an additional security and privacy assessment.


text: As a global company, we manage a variety of cybersecurity threats and cannot wholly eliminate the risk of adverse impacts from such incidents. However, as of the date of this Form 10-K, we have not identified any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of our operations or financial condition. For additional information on the risks from cybersecurity threats that we have faced in the past and expect to continue to face in the future, please refer to the "Risk Factors" in Part I, Item 1A of this Form 10-K.


text: The Company's Board of Directors oversees cybersecurity risks consistent with its general risk oversight responsibility. The Audit Committee of the Board has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems and the general security, including cybersecurity, of the Company's people, assets and information systems. In support of this general oversight, the full Board reviews at least annually the most significant enterprise risks facing the Company, including cybersecurity risks, as identified in the Company's Enterprise Risk Management program. This review, which includes key members of senior management, covers any key risks from information security that have been identified and corresponding action plans. The Audit Committee also receives regular updates from the Company's CIO and CISO about the Company's information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least three times a year, with interim updates as needed.


text: The Company's management is responsible for implementing its strategic plans, including identifying, evaluating, managing and mitigating the risks inherent in them, such as cybersecurity risks. Within management, the Company's CISO has specific responsibility for cybersecurity risk management, reporting to the CIO.


text: The Company's CISO has over 15 years of experience in cybersecurity, information security and information risk management, including several years each in security engineering and in operations, as well as running incident response organizations. The CISO's organization includes a dedicated team of centralized information security experts and a network of security professionals embedded in each business unit and function.


text: The CISO also leads the design and development of the Company's cybersecurity program, relying on functional experts within the central Information Security organization as well as on information security experts within each of the Company's Organizational Units. These embedded experts are responsible for the execution of the Company's overall information security strategy and report security risks in their area of responsibility to their Organization Unit leader and to the CISO. Experts within the Company's central Information Security organization help develop the Company's cybersecurity strategies, policies and standards and similarly report security risks within the central enterprise to the CISO.


text: 10 The Procter & Gamble Company A central team within the Company leads enterprise-wide incident investigations and response, assisting and consulting on cyber security incidents impacting individual Organizational Units. Alerts of potential incidents can arise from security tool alerts, employee reports, threat intelligence sources, threat hunting activities or external entities, among other sources. The Company's Security Operations Center initially responds to incident alerts and notifies central experts to any potentially significant cybersecurity incidents. Members of the Security Operations Center and relevant response teams work to contain and eradicate potential and identified threats and support the system's recovery efforts, advised as needed by the Legal department and other Company experts. Incidents are communicated to the CISO and other members of management, including the Company's Ethics & Compliance Committee, as well as the Audit Committee of the Board, based on documented escalation criteria. The central enterprise team also regularly reviews incident reports to update the CISO. As described above, both the CIO and CISO report information about the Company's identification and management of cybersecurity risks to the Audit Committee.


text: Risk Management and Strategy The Company employs multiple tools and processes for assessing, identifying and managing material risks from cybersecurity threats. A multi-functional enterprise security team reviews and assesses top cybersecurity risks. This assessment is shared with members of senior management, including the Chief Information Officer (CIO) and Chief Information Security Officer (CISO), and helps guide the Company's cybersecurity operational priorities and strategy. In addition, cybersecurity risks are integrated into the Company's broader Enterprise Risk Management program. When cybersecurity risks are identified through the Enterprise Risk Management program or otherwise, they are reported to relevant business and governance leaders within the Company for appropriate action.


text: The Company's Board of Directors oversees cybersecurity risks consistent with its general risk oversight responsibility. The Audit Committee of the Board has specific responsibility for reviewing the status of the security of the Company's electronic data processing information systems and the general security, including cybersecurity, of the Company's people, assets and information systems. In support of this general oversight, the full Board reviews, at least annually, the most significant enterprise risks facing the Company, including cybersecurity risks, as identified in the Company's Enterprise Risk Management program. This review, which includes key members of senior management, covers key risks from information security that have been identified and corresponding action plans. The Audit Committee also receives regular updates from the Company's CIO and CISO about the Company's information security and systems security programs and plans, including emerging trends and progress on overall enterprise cybersecurity programs and priorities. These updates occur at least three times a year, with interim updates as needed.


text: 10 The Procter & Gamble Company The CISO also leads the design and development of the Company's cybersecurity program, relying on functional experts within the central Information Security organization as well as on information security experts within each of the Company's Organizational Units. These embedded experts are responsible for the execution of the Company's overall information security strategy and report security risks in their area of responsibility to their Organization Unit leader and to the CISO. Experts within the Company's central Information Security organization help develop the Company's cybersecurity strategies, policies and standards and similarly report security risks within the central enterprise to the CISO.


text: A central team within the Company leads enterprise-wide incident investigations and response, assisting and consulting on cyber security incidents impacting individual Organizational Units. Alerts of potential incidents can arise from security tool alerts, employee reports, threat intelligence sources, threat hunting activities or external entities, among other sources. The Company's Security Operations Center initially responds to incident alerts and notifies central experts to any potentially significant cybersecurity incidents. Members of the Security Operations Center and relevant response teams work to contain and eradicate potential and identified threats and support the system's recovery efforts, advised as needed by the Legal department and other Company experts. Incidents are communicated to the CISO and other members of management, including the Company's Ethics & Compliance Committee, as well as the Audit Committee of the Board, based on documented escalation criteria. The central enterprise team also regularly reviews incident reports to update the CISO. As described above, both the CIO and CISO report information about the Company's identification and management of cybersecurity risks to the Audit Committee.


text: Our business requires that we develop and maintain large and complex technology systems, and that we rely on third-party systems and applications, to run our operations and to store the significant volume of data that we acquire, including the personal information of our customers and employees and our intellectual property, trade secrets, and other sensitive business and financial information.

companyName: PROGRESSIVE CORP/OH/

ticker: PGR