text: Our Chief Technology Officer is primarily responsible for managing material risks from cybersecurity threats, and is supported by our Vice President of Information Technology, Operations and Security, along with a dedicated team of internal cybersecurity specialists. The Information Technology leaders participate in periodic training and education on cybersecurity related topics, while members of our internal security team also maintain industry certifications, such as Certified Information Systems Security Professional (CISSP). Our current Chief Technology Officer has more than 35 years of experience in information technology. Our Chief Technology Officer is informed about and monitors prevention, detection, mitigation, and remediation efforts through regular communication and reporting from the internal team. We also engage specialized cybersecurity consultants and leverage third-party expertise to bolster our cybersecurity defenses. Our enterprise risk management program is designed to identify, prioritize and assess a broad range of risks, including risks from cybersecurity threats, that may affect our ability to execute our corporate strategy and fulfill our business objectives. Our Vice President of Risk Management oversees this program and works with our information technology leadership team to formulate plans to mitigate the effects of risks from cybersecurity threats. In addition, we have an escalation process in place to inform senior management and the Board of Directors of material issues.


text: In addition, our third-party vendors and service providers play a role in our cybersecurity. These third parties are integral to our operations but pose cybersecurity challenges due to their access to our data and our reliance for various aspects of our operations, including our supply chain. We have developed a third-party vendor risk management program to assess and manage the risks associated with third-party partnerships, particularly in data security and cybersecurity. We conduct due diligence before onboarding new vendors and maintain ongoing evaluations to ensure compliance with our security standards.

companyName: Sprouts Farmers Market, Inc.

ticker: SFM

secItem: Item 1C


text: As of the date of this report, no cybersecurity incidents have had, either individually or in the aggregate, a material adverse effect on our business, financial condition or results of operations. Notwithstanding the extensive approach we take to cybersecurity, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While we maintain cyber risk insurance, the costs relating to certain kinds of security incidents could be substantial, and our insurance may not be sufficient to cover all losses related to any future incidents involving our data or systems.


text: See Item 1A. "Risk Factors – Disruptions to, security breaches or non-compliance involving, our information technology systems could harm our ability to run our business and expose us to potential liability and loss of revenues." for a discussion of cybersecurity risks that may materially impact us.


text: Cybersecurity Risk Management Strategy We have implemented various processes and policies for identifying, assessing, and managing material risks from cybersecurity threats. Our cybersecurity risk management strategy is designed following the Cybersecurity Framework set by the National Institute of Standard and Technology, or NIST.

companyName: LeonaBio, Inc.

ticker: LONA


text: We assess our information technology, or IT, environment against the NIST Cybersecurity Framework, as well as various cyber-attack vectors, working to identify and remediate risks. We implement reasonable administrative, technical and procedural safeguards to manage cybersecurity risks, for example, by enforcing single sign-on or multi-factor authentication where supported, and the use of mobile device management to secure company resources on employee personal devices. Additionally, we engage third-party cybersecurity experts to assess the security of our network and perform continuous system monitoring, and we engage a third party to perform internal audits of our IT General Controls, or ITGCs. We have implemented certain processes to oversee and identify risks from cybersecurity threats associated with our use of third-party service providers, for example, by evaluating such service providers' own cybersecurity processes and reviewing available certification and audit reports, including International Organization for Standardization, or ISO, certifications for information security management systems, and System and Organization Controls, or SOC, reports.


text: At this time, we have not experienced cybersecurity incidents, or are aware of any risks from cybersecurity threats, that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition.


text: Board of Directors Our board of directors is responsible for general oversight and regular review of information regarding our risks, including cybersecurity risks. Members of management communicate an overview of our current cybersecurity environment to our board of directors at least annually and provide updates to our board of directors regarding cybersecurity matters periodically throughout the year. Additionally, our third-party auditors inform the audit committee of our board of directors of our ITGC framework and control testing results, which include controls related to cybersecurity risks. Further, management has established cybersecurity incident response processes for escalating the communication of cybersecurity incidents up to the board of directors, as appropriate.


text: Material risks from cybersecurity threats are assessed and managed by a dedicated team comprised of internal and external IT professionals experienced in cybersecurity threat risk management, who ultimately report to our chief operating officer. Our chief operating officer has extensive strategic and operational experience at several life sciences companies, leading a wide range of business functions, including IT. Our technology team leader has over 20 years of experience with IT and cybersecurity risk management, having served in senior executive-level IT positions at multiple Fortune 500 companies and companies within the life sciences industry.


text: The technology team leader oversees our internal team of IT professionals, which continuously monitors our IT environment for cybersecurity threats and incidents. Our IT professionals routinely report on cybersecurity incident prevention, detection, mitigation, and remediation efforts to our technology team leader and chief operating officer. Additionally, we have established policies addressing processes for responding to potential cybersecurity incidents, including assessment, communication, and remediation protocols. Our incident response processes further provide for the escalation of cybersecurity incidents to our executive management team and board of directors, as appropriate.


text: We understand the importance of preventing, assessing, identifying, and managing material risks associated with cybersecurity threats. Cybersecurity processes to assess, identify and manage risks from cybersecurity threats have been incorporated as a part of our overall risk assessment process and have been embedded in our operating procedures, internal controls and information systems. On a regular basis, we implement into our operations these cybersecurity processes, technologies, and controls to assess, identify and manage material risks.

companyName: VAPOTHERM INC


text: Specifically, we engage a third-party cybersecurity firm to assist with network and endpoint monitoring, cloud system monitoring and assessment of our incident response procedures. Further, we employ periodic penetration testing and tabletop exercises to inform our risk identification and assessment of material cybersecurity threats.


text: To manage our material risks from cybersecurity threats and to protect against, detect, and prepare to respond to cybersecurity incidents, we: • Monitor emerging data protection laws and implement changes to our processes to comply • Conduct periodic customer data handling and use requirement training for our employees • Conduct periodic vulnerability assessments and mitigate vulnerabilities for our systems and processes that include sensitive data; • Conduct regular security awareness trainings and phishing simulation attacks • Carry cybersecurity risk insurance that provides protection against the potential losses arising from a cybersecurity incident; and • Perform periodic gap analyses to review our cybersecurity controls for gaps and implement the closure actions Our incident response plan coordinates the activities that we and our third-party cybersecurity provider take to prepare to respond and recover from cybersecurity incidents, which include processes to triage, assess severity, investigate, escalate, contain, and remediate an incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage.


text: Management has implemented risk management structures, policies and procedures, and manages our risk exposure on a day-to-day basis. We have a cybersecurity organization within our information technology department that focuses on current and emerging cybersecurity matters and leverages cybersecurity consultants and third-party cybersecurity firms. Our cybersecurity function is led by our Chief Financial Officer, who reports to our Chief Executive Officer. Our Chief Financial Officer and cybersecurity organization are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies.


text: Our Audit Committee of the Board of Directors is responsible for oversight of our risk assessment, risk management, disaster recovery procedures and cybersecurity risks. Periodically during each year, the Audit Committee receives an overview from our Chief Financial Officer of our cybersecurity threat risk management and strategy processes, including potential impact on the Company, the efforts of management to manage the risks that are identified and our disaster recovery preparations. Members of the Board of Directors regularly engage in discussions with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs.


text: As of the date of this filing, we do not believe that our business strategy, results of operations or financial conditions have been materially affected by any cybersecurity incidents for the reporting period covered by this report. However, companies like us, as well as our employees, service providers and other third parties, have experienced information security and cybersecurity attacks in the past and will likely continue to be the target of cyber actors.


text: We describe whether and how risks from identified cybersecurity threats have or that are reasonably likely to affect our financial position, results of operations and cash flows, under the heading "Risks Related to Our Business" included as part of our "Item 1A. Risk Factors" of this Annual Report on Form 10-K, which disclosures are incorporated by reference herein.


text: The Company faces various risks from cybersecurity threats in connection with its business on a day to day basis, including, without limitation, information theft, destruction and inaccessibility; unauthorized disclosure of sensitive or confidential information; extortion; harm to clients and employees; reputational risk, legal and regulatory risk and increased costs to manage cyber risk, which could materially adversely affect our business, strategy, results of operations and financial condition. Our cybersecurity risks arise out of managing sensitive and confidential information of our clients, as well as our own confidential and proprietary information, and our dependence on information technology systems and networks to securely process, transmit and store this information and to communicate among our global locations and with third parties, including our clients and other key stakeholders involved in our clients' transactions. The cyber threat landscape is constantly evolving, and the increase in periodic work-from-home workforce and their reliance on technology that enables such work has increased the cyber threat landscape and related risks. While we do not believe we have, as of the date of this Form 10-K, experienced a cybersecurity incident that materially affected our business, our business strategy, our results of operations or financial condition, there can be no guarantee that we will not experience such an incident in the future. For further information, see "Our business is subject to various cybersecurity and other operational risks" and "We may incur losses as a result of unforeseen or catastrophic events, including the emergence of a pandemic, cybersecurity incidents and events, terrorist attacks, war, trade policies, military conflict, climate-related incidents, or other natural disasters" in Item 1A, Risk Factors of this Annual Report.

companyName: Moelis & Co

ticker: MC


text: We maintain a cybersecurity program, which includes processes for the continuous monitoring of our information systems in order to assess, identify and manage cybersecurity threats. We use known industry strategies to manage these cyber threats, including, without limitation, identity and access management, security awareness training, network security, physical access controls, endpoint security, encryption, incident response planning and vulnerability management. The relevant information collected from the tools is, among other things, leveraged to identify potential weaknesses, monitor threats that seek to identify and exploit these weaknesses and refine and adjust our security controls as the cyber threat landscape changes. Our cybersecurity program includes policies governing how employees access, use and interact with our firm assets and data deemed to be in our custody. Our security team considers industry cybersecurity best practices and applicable statutory and regulatory obligations when creating policies, implementing controls and engineering technology integrations.


text: Recognizing the complexity and continuously developing nature of cybersecurity threats, Moelis periodically engages with a variety of external experts, including consultants, auditors and cybersecurity assessors in evaluating and testing our cyber risk management systems. Our collaboration with these third parties include, but are not limited to; threat assessments, consultation on security enhancements and regular periodic audits.


text: Our security program also contains a third-party risk management process which is designed to assess third-party vendors' information security posture and inform management on the potential cyber risk introduced by third-party products and services and the broader security team's recommendations for risk management.


text: Our cybersecurity program is overseen by a full-time security team led by our Chief Information Security Officer ("CISO"), reporting directly to our Chief Information Officer ("CIO"). Our CISO has over 20 years of experience in the field of cybersecurity, including prevention, detection, mitigation, and remediation of cybersecurity incidents. Our CIO has over 17 years of experience as a Chief Information Officer, over 35 years of experience in the field of information technology and oversees the cybersecurity function.


text: Our cyber security program includes a cyber incident response policy overseen by our CISO. This incident policy sets forth the procedures to be followed in the event of a cybersecurity event, including escalation, mitigation, and remediation steps. Our cyber security procedures provide criteria for the escalation of cybersecurity events to management of the other operational functions of the Company to participate in determining and executing on the response. Depending on the nature and severity of the incident, we have procedures for escalating notification to our executive officers and Board of Directors.


text: Our Board of Directors is responsible for oversight of our cybersecurity risks. Cybersecurity risk management is integrated into our broader risk management framework. Our Board meets at least quarterly to conduct a review of matters related to cybersecurity, including an assessment of the cybersecurity threat landscape, cyber risk mitigation initiatives, the status of projects to strengthen internal cybersecurity, and an update on security events during the period. In addition, management will escalate cybersecurity incidents to the Board of Directors between quarterly meetings in accordance with our escalation procedures.


text: To effectively identify, assess and manage risks from cybersecurity threats, the Company maintains a cybersecurity and cyber risk management program which is comprised of the Company-wide cybersecurity strategy and its supporting policies, processes and architecture. This program is part of the Company's enterprise risk management program.

companyName: Apple Hospitality REIT, Inc.

ticker: APLE


text: Risk Management Strategy The Director of Information Technology, who reports to the Chief Financial Officer, has extensive information technology ("IT") and cybersecurity knowledge and skills gained from over 15 years of relevant work experience at the Company, and is responsible for leading the Company's cybersecurity and cyber risk management program which includes certain cybersecurity processes covering the Company's corporate systems. These processes include, among other items, the Company's information technology and risk management departments' use of an internal set of applications and control activities to actively monitor potential threats to its corporate IT environment and regularly conduct internal testing to identify potential vulnerabilities to the Company's corporate information technology infrastructure and systems. These activities include, but are not limited to, continuous monitoring of network and infrastructure vulnerabilities, automated patching and software updates, redundancy and back-up systems, and incident response planning and handling. The Company's employees are required to report cybersecurity events, including suspicious activity or emails, to the Company's information technology department. Should a cybersecurity event occur within its corporate systems, the Company is positioned to coordinate a swift response to mitigate impacts to its information technology infrastructure and systems. The Company has in place an incident response plan which provides guidance for leadership and employees to swiftly evaluate and respond to cybersecurity incidents. The Company also carries cybersecurity insurance to further mitigate certain potential losses from a cybersecurity incident affecting its corporate IT equipment and systems.


text: The Company's cybersecurity processes also include self-assessments using industry benchmarks as well as input from external industry consultants and ongoing communication with third-party business partners to identify cybersecurity incidents and threats that could potentially impact the Company. The Company has relationships with a number of third-party business partners to assist with cybersecurity incident containment and recovery efforts and assesses the processes and tools used by its third-party business partners to manage their cybersecurity risks. The Company uses a risk-based approach with respect to its use and oversight of third-party service providers, tailoring processes according to the nature and sensitivity of network connectivity or of data accessed, processed, or stored by such third-party service provider.


text: The Company's corporate IT systems are not used to process business transactions with its guests and those systems currently have no connectivity to hotel and/or third-party management and brand technology platforms. The Company's information technology and risk management departments regularly engage with its third-party management companies and brands to understand and benchmark their execution and alignment with applicable policies and industry practices for data protection and cybersecurity.


text: Management and Board Oversight The Company's Board of Directors administers cybersecurity risk oversight primarily through its Audit Committee. The Board's Audit Committee is tasked with oversight responsibility for the Company's enterprise risk management program, including those related to cybersecurity and cyber risks. The Audit Committee receives regular reports from the Chief Financial Officer on, among other things: the Company's cybersecurity risks and threats; the status of projects to strengthen the Company's information security systems; internal and third-party assessments of the Company's cybersecurity program; and the emerging threat landscape. The Audit Committee also receives updates on any cybersecurity incidents experienced by third-party business partners that may pose significant risk to the Company. The Audit Committee provides periodic reporting to the Board of Directors on cybersecurity matters. The Company's IT and risk management departments report directly to the Chief Financial Officer and are directed to immediately report any incidents to the Chief Financial Officer. The Chief Financial Officer also apprises the Audit Committee of cybersecurity incidents consistent with the Company's incident response procedures for more significant incidents and in the aggregate for less significant incidents.


text: Cybersecurity Risks The Company faces a number of cybersecurity risks in connection with its business, although such risks have not materially affected the Company, including its business strategy, results of operations or financial condition, to date. The Company has not experienced any material cybersecurity incidents to date. Notwithstanding the extensive approach the Company takes to address cybersecurity, it may not be successful in preventing or mitigating all cybersecurity incidents or threats. For more information about the cybersecurity risks the Company faces, see the risk factor entitled "Technology is used in operations, and any material failure, inadequacy, interruption or security failure of that technology from cyber-attacks or other events could harm the Company's business" in Item 1A- Risk Factors.


text: Cyber Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program that includes processes for the identification, assessment and mitigation of cybersecurity risks. This process is overseen by the Director of IT Operations and Information Security, or the IT Director, and includes periodic security assessments, audits, and testing, which are informed by industry standards and supported by cybersecurity technologies, including automated tools, designed to monitor, identify and address cybersecurity risks. We periodically engage with third parties to support these efforts. We maintain internal information security policies, including an incident response plan, which are reviewed by or at the direction of the IT Director and are updated periodically to reflect material changes and improvement in our information security practices. We have a process to assess and review the cybersecurity practices of third-party vendors and service providers prior to onboarding and periodically throughout the engagement, including through vendor questionnaires and contractual requirements, as appropriate.

companyName: Relay Therapeutics, Inc.

ticker: RLAY


text: Governance Related to Cybersecurity Risks The IT Director oversees and manages the day-to-day functions of our cybersecurity risk management program. The IT Director reports to the VP of Information Technology and Facilities, or VP of IT. The IT Director and VP of IT roles are both held by individuals who each have over twenty years of professional information technology, or IT, management experience. The VP of IT meets regularly with the Audit Committee to report on and discuss information security and technology risks to our business, including our cyber risk management programs, controls and procedures. The VP of IT and the Audit Committee also conduct a high-level review of the threat landscape facing our business, discuss risk mitigation strategies and the prioritization of our remediation efforts.


text: The IT Director meets periodically with members of the Relay Information Security Council, or RISC, which is comprised of the VP of IT and senior leaders from various functions, including finance, legal, human resources, corporate development and research and development. The RISC provides input to the IT Director in connection with proposed cyber strategies as it relates to potential business impacts from new or proposed technologies and security solutions across the organization, including implementation strategies designed to address potential risks and disruptions to the business. In the event we or one of our business partners experiences a cybersecurity incident, the RISC is responsible for assisting in evaluating the incident, including whether any disclosure of the incident is required. The VP of IT reports to the Audit Committee on cyber initiatives and implementation resulting from RISC discussions.


text: Through the Audit Committee, the Board of Directors is informed of: (i) security initiatives, (ii) existing and emerging cybersecurity risks, including cybersecurity incidents; and (ii) any disclosure obligations arising from any cybersecurity incidents. The Board of Directors oversees our general risk management strategy and the most significant risks facing our business, and is responsible for ensuring that appropriate risk mitigation strategies are implemented.


text: Risk Management and Strategy We have instituted policies and processes dedicated to assessing, identifying, and managing risks from cybersecurity threats. Cybersecurity risks are managed as part of our enterprise risk management program. We are committed to safeguarding our critical information assets and data and have implemented a defense-in-depth strategy that is informed by industry standard cybersecurity frameworks. We benchmark against these frameworks and our internal risk assessment process to inform how we identify, protect, detect, respond to, and recover from risks, threats, vulnerabilities, and cybersecurity incidents across our information assets.

companyName: TPI COMPOSITES, INC

ticker: TPICQ


text: We incorporate reputable third-party vendors and solutions into our cyber risk management strategies to fortify our cyber defense mechanisms. We collaborate with internal stakeholders across the Company to integrate cybersecurity principles into our operations, including deployment of multiple layers of cybersecurity defenses, restricted access based on business need, and integrity of our business information. We also train our employees during onboarding and annually thereafter on matters including cybersecurity awareness, confidential information protection, and phishing attacks.


text: We actively enhance our cybersecurity program through testing by third-party assessors and measure the results against industry standards. We also have standing engagements with incident response experts and external counsel to provide timely support to our incident response capabilities, and we regularly engage with external experts to analyze the threat landscape.


text: Our cybersecurity risk management is integrated into our business continuity program and enterprise risk management framework, which promotes proactive planning and preparedness to address potential threats. Members of our global information security team collaborate with subject matter experts within our organization to assess and refine our cybersecurity posture and incident response and preparedness, including evaluating and updating contingency plans, participating in tabletop exercises, threat hunting, red team engagements, and simulating real-world scenarios related to cyber incidents.


text: Although risks from cybersecurity threats have to date not materially affected us, and we do not believe they are reasonably likely to materially affect our Company, business strategy, results of operations or financial condition, we could, from time to time, experience threats and security incidents relating to our and our third party vendors' information systems. For more information, please see the section entitled "Risk Factors" included in Part I, Item 1A of this Annual Report on Form 10-K.


text: Our board of directors is responsible for monitoring and assessing strategic risk exposure, and administers its cybersecurity risk oversight function through the Audit Committee. The Audit Committee receives quarterly updates on our enterprise risk management program, including information on cybersecurity risks and initiatives undertaken to identify, assess and mitigate such risks.


text: Our chief information security officer is the senior director responsible for the cybersecurity organization, which has primary oversight of material risks from cybersecurity threats. Our chief information security officer reports to our chief information officer. Our chief information officer is responsible for the overall Information Technology (IT) organization.


text: Our chief information officer and chief information security officer assess our cybersecurity readiness through internal assessment tools, as well as third-party assessments, audits, penetration tests, and evaluation against industry standards. We have governance and compliance structures that are designed to elevate issues relating to cybersecurity to our chief information officer and chief information security officer, as appropriate.


text: Our chief information officer meets with the Audit Committee each quarter to review our information technology systems and discuss key cybersecurity risks. In addition, at least annually, the chief financial officer reviews with the board of directors our global enterprise risk management program, which includes cybersecurity risks.


text: We believe cybersecurity is a necessity for operating our business. As a global leader in computational science and artificial intelligence, we face many cybersecurity threats that range from common attack patterns, such as ransomware and denial-of-service, to attacks from sophisticated and persistent adversaries, including nation state actors, that target companies with innovative technology. Our customers, vendors and other third-party partners face similar cybersecurity threats, and a cybersecurity incident impacting us or any of these entities could materially adversely affect our operations, performance and results of operations. These cybersecurity threats and related risks make it imperative that we carefully execute our cybersecurity operations, strategy and governance.

companyName: Altair Engineering Inc.


text: The Board of Directors are informed of cybersecurity risks and provide oversight to the executive management team with the day-to-day responsibility of cybersecurity functions, auditing and budget. Senior leadership, including our Chief Information Security Officer (CISO), regularly briefs the Board of Directors on our cybersecurity and information security posture and the Board of Directors is apprised of cybersecurity incidents deemed to impair data confidentiality, integrity and/or availability. In the event of an incident, we intend to follow our customized incident response playbooks, which outline the steps to be followed from incident detection to mitigation, recovery and notification, including notifying functional areas (e.g. legal), as well as senior leadership and the Board, as appropriate. Our procedures vary slightly depending on the type of incident at issue (e.g., account compromise, malware, data loss) as well as the data compromised.


text: Our corporate information security team, led by our CISO, is responsible for our overall information security strategy, policy, security engineering, security operations (as a second line of defense) and cyber threat detection and response. The current CISO has ten years' experience in cybersecurity and 35 years as an information technology professional. Given that our CISO has more than 25 years at the Company in multiple positions, he helped incubate and grow our corporate information security team into what it is today. Our information security management philosophy is one of cyber risk prevention and we have the ultimate goal of preventing cyber incidents. Simultaneously, our information security team focuses on increasing our system resilience to minimize data breach (or other compromise) business impact should an incident occur. Cybersecurity is not the sole responsibility of our information security team. Our Security team meets with business leaders regularly and works closely with internal departments to keep security at the forefront. Our employees and vendors also play a role in our company's cybersecurity efforts. Through our cybersecurity awareness training and other team training we are fostering a culture that all employees and vendors have a role in our cybersecurity defenses.


text: The corporate information security team has implemented a governance structure and processes to assess, identify, manage and report cybersecurity risks. We also have threat intelligence and insider threat programs to identify external and internal threats, and to mitigate those threats in a timely manner to the best of our ability. In addition, we have developed security corporate practices, controls, and frameworks, which we believe enhance our ability to identify and manage cybersecurity risks.


text: Third parties also play a role in our cybersecurity and supplement our program. We engage third-party services in some areas of our business to conduct evaluations of our security controls, whether through penetration testing, independent audits or consulting on best practices to address new challenges.


text: We employ risk management functionality and document enterprise information security risks. Our information security team maintains documentation to assess risk and mitigate cyber risk in alignment with risk (understanding general impact and likelihood of risk exploitation), resources, and business process. Cybersecurity risks are tracked throughout the risk management process from risk mitigation to ultimate completion of remediation. From time-to-time significant risks may be escalated to the executive management team and/or the Board in the existing executive management processes for cybersecurity and Board briefing schedule.


text: We rely on our indirect sales channel partners and supply chain to deliver our products and services to our customers, and a cybersecurity incident at a channel partner, supplier, subcontractor or joint venture partner could materially adversely impact us. We also contractually flow cybersecurity regulatory requirements to our subcontractors in alignment with legal and contractual obligations. Extensive international law and US-sector specific laws pertaining to privacy and data security may create challenges for our supply chain and increase costs as we continue to flow down legal obligations.


text: Despite our careful planning, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us. While the Company maintains cybersecurity insurance, the costs related to cybersecurity threats or disruptions may not be fully insured. See Item 1A. "Risk Factors" for a discussion of cybersecurity risks.


text: Governance Related to Cybersecurity Risks Our Board of Directors ("Board") holds overall oversight responsibility for the Company's strategy and risk management, including in relation to cybersecurity risks. Our Board exercises its oversight function through the Audit Committee, which oversees the management of risk exposure across various areas, including data security risks, in accordance with its charter. The Audit Committee receives quarterly reports from our Chief Information Officer ("CIO") on the status of the Company's cybersecurity program, including measures implemented to monitor and address cybersecurity risks and threats, as appropriate.

companyName: REPLIGEN CORP

ticker: RGEN


text: Under the leadership of our general counsel, we have constituted an enterprise risk management committee ("ERMC") composed of senior management, including the CIO and other senior executives. The ERMC monitors and oversees risk areas that potentially could pose a high impact to the business, and cybersecurity currently is one of the ERMC's priority focus areas. The ERMC reports on our top identified risks and steps to address those risks to the full Board on a semi-annual basis.


text: Our IT Infrastructure & Operations team manages the day-to-day administration of our cybersecurity program. We also work with a managed security service provider to monitor for vulnerabilities and threats, which are reported to the IT Infrastructure & Operations team and up to the CIO and other members of senior management, where appropriate. We engage employees in our cybersecurity efforts through a quarterly process for employees to complete security and awareness training as well as periodic simulated phishing campaigns. We also conduct specific training and tabletop exercises for key personnel involved in cybersecurity risk management.


text: Cybersecurity Risk Management and Strategy We maintain a cybersecurity program, which is informed by industry standards, that includes processes for identification, assessment, and management of cybersecurity risks. We conduct periodic risk assessments, including with support from external vendors, to assess our cyber program, identify areas of enhancement, and develop strategies for the mitigation of cyber risks. We also conduct regular security testing and have established a vulnerability management process supported by security testing, for the treatment of identified security risks based on severity. Third-parties that access, process, collect, share, create, store, transmit or destroy our information or have access to our systems may have additional contractual controls.


text: Our IT Infrastructure & Operations team is informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks through various means, including by leveraging managed security service providers and other third-party security software and technology services. In addition, we institute processes and technologies for the monitoring of security alerts from internal parties and external resources, including from information security research sources. We also have implemented processes and technologies for network monitoring and data loss prevention procedures.


text: We maintain processes to inform and update management and, as needed, the Audit Committee, about security incidents that may pose a significant risk for the business, as applicable. Although risks from cybersecurity threats have to date not materially affected us, our business strategy, results of operations or financial condition, we have, from time to time, experienced threats and security incidents relating to our and our third party vendors' information systems. See Item 1A, "Risk Factors," to this report for more information.


text: Cybersecurity Risk Management We have implemented an information security program that is informed by, and incorporates elements of, industry standards and frameworks, including those issued by NIST (National Institute of Standards and Technology), ISO (International Organization for Standardization), and CIS (Center for Internet Security). Our security program is designed to identify, assess, manage, mitigate, and respond to cybersecurity threats.

companyName: BridgeBio Pharma, Inc.

ticker: BBIO


text: Our cybersecurity risk management program includes a number of components, such as information security program assessments and ongoing monitoring of critical risks from cybersecurity threats using automated tools. We periodically engage third parties to conduct risk assessments and testing of our systems, including penetration testing and other vulnerability analyses. Additionally, we have implemented an employee education program that is designed to raise awareness of cybersecurity threats, including risks posed by phishing attempts. We have implemented a process for this training to be included during the employee onboarding process and periodically thereafter.


text: As part of our cybersecurity risk management program, we maintain processes to assess and review the cybersecurity practices of third-party vendors and service providers. Our process includes a security assessment informed by vendor questionnaires and contractual security requirements related to data privacy for certain vendors.


text: We, like other companies in our industry, face a number of cybersecurity risks in connection with our business. Although our business strategy, results of operations, and financial condition have not, to date, been materially affected by risks from cybersecurity threats, including as a result of previously identified cybersecurity incidents, we have, from time to time, experienced threats to and security incidents related to our data and systems, including phishing attacks and attacks to the security of the systems of our third-party vendors and service providers. For more information on our cybersecurity related risks, see "Our internal computer systems, or those used by our third-party collaborators, contractors or consultants, may fail or suffer security breaches, which could result in a material disruption of our development programs and business operations" in Item 1A- Risk Factors.


text: Our internal information security team is responsible for day-to-day operations related to our cybersecurity risk management strategy, including identifying, assessing, and managing cybersecurity threats and risks. We established a process that intends for our Incident Response Team to respond to and address incidents as they arise. The Incident Response Team is multidisciplinary and comprised of members of our information technology and security function, accounting and finance department, and legal department. This team is led by our Director of Security and Network Infrastructure. The Director of Security and Network Infrastructure role is currently held by an individual who has approximately twenty (20) years of information technology and ten (10) years of information security related experience.


text: The Incident Response Team provides periodic reports to our Data Privacy and Security Committee, as well as our Chief Executive Officer and other members of our senior management, as appropriate. These reports include updates on the Company's cybersecurity risk management program, assessments of current cybersecurity risks, and status updates for projects designed to enhance our information security systems. Our Data Privacy and Security Committee meets to further discuss such items on a monthly basis and reports periodically to the Audit Committee of the Board of Directors.


text: Our Board of Directors, as a whole and through its committees, has oversight responsibility over the Company's strategy and risk management, including our response to critical risks related to cybersecurity threats. The Audit Committee of the Board of Directors specifically oversees the management of enterprise risks, including risks associated with privacy and data security (including cybersecurity), in accordance with its charter. The Audit Committee engages in periodic discussions, on at least a bi-annual basis, with a member of the Data Privacy and Security Committee as well as members of legal and executive leadership as appropriate regarding the Company's significant financial risk exposures and the measures implemented to monitor and control these risks, including those that may result from critical cybersecurity threats. Executive leadership periodically reports on critical cybersecurity risks and risk management to the full Board of Directors.


text: Risk Management and Strategy. The cybersecurity program at Cars Commerce is part of our enterprise risk management program. At Cars Commerce, we believe cybersecurity risk management is of the utmost importance. As a result, Cars Commerce has implemented an information security management system (the "ISMS") designed to protect our infrastructure from potential threats and is designed to allow us to assess, identify and manage material risks from cybersecurity threats as described in more detail below. The ISMS supports the security safeguards that are designed to protect the confidentiality, integrity, availability, and contractual compliance of the Cars.com Inc. (d/b/a Cars Commerce, Inc.) entities, which include Cars.com LLC, Accu-Trade, LLC, CreditIQ, LLC, DealerRater.com LLC and Dealer Inspire Inc. which is inclusive of the In-Market Video and NewCars brands. In addition, we engage with external resources to contribute to, and provide independent evaluation of, our existing cybersecurity practices. As a result, in 2023, Cars Commerce engaged an independent auditor to conduct an audit of the ISMS. As a result of the independent audit, in December 2023, Cars Commerce completed the certification to meet International Organization for Standardization 27001 requirements for the above-stated entities. In October 2023, Cars Commerce, through its subsidiary, completed the acquisition of D2C Media Inc. ("D2C Media"). During the due diligence, Cars Commerce completed a robust evaluation of its cybersecurity risk management process and plans to integrate D2C Media into the ISO Certification Process.

companyName: Cars.com Inc.

ticker: CARS


text: Protect. Our employees are the first line of defense against cybersecurity incidents. As such, employees receive annual security awareness training to understand the behaviors and technical requirements necessary to protect information. We also conduct periodic phishing awareness exercises to educate employees to recognize and report suspicious activity. We also use a combination of tools and in-house technologies to protect Cars Commerce, our employees and our customers, including but not limited to using only SOC 2 compliant hosting providers, anti-malware software, intrusion prevention systems, network and web application firewalls, multi-factor authentication, encryption, and remote access via virtual private network ("VPN") software.


text: Assess. In addition to in-house assessments, we engage with security and technology vendors to assess our information security and cybersecurity program and test our technical capabilities, including conducting penetration testing. We conduct risk assessments and audits to identify new risks and include any newly identified risks in remediation planning, as well as confirming that previously identified risks have been remediated. Identified risks are included in a central risk register and assigned an overall risk score. Risk levels are assigned based on a number of factors, including the nature of the risk and likelihood of exploitation. Lastly, we create remediation plans to bring unacceptable risks to an acceptable level.


text: Identify. We use several methods to identify cybersecurity events, including, but not limited to, security alert tools, log monitoring by systems engineers working on operational incidents that are later determined to be security incidents, or suspicious activity reported directly by employees. Cars Commerce has developed security incident response procedures to (1) assess cybersecurity incidents, (2) identify and implement containment measures, (3) preserve evidence, (4) log response activities and (5) determine corrective actions to prevent similar incidents.


text: Respond and Manage. When detected, suspected cybersecurity threats are escalated to the Information Security Team (as described below) in various ways based on the nature of the cybersecurity incident, including but not limited to system engineer escalation, the Cars Commerce helpdesk and in-house and third-party security tools. Cars Commerce employees are also responsible for reporting any suspected cybersecurity or information security event that they observe or experience as soon as possible, by either contacting the Cars Commerce helpdesk, or the Information Security Team directly. The Information Security Team then creates a Security Incident Response Team ("SIRT") which, depending on the incident, comprises of the cybersecurity staff, Systems and Network Engineers, the Chief Technology Officer and the Chief Legal Officer, or other stakeholders as appropriate. The SIRT investigates and manages the impact of cybersecurity incidents in accordance with the security incident response procedures.


text: Report. Following the conclusion of a security investigation, the SIRT prepares a report for the Information Security Governance Committee, as appropriate. The report includes information about the incident, details about the response and includes recommendations to prevent similar security events from occurring in the future. Additionally, the Information Security Team provides the Audit Committee and the Board with regular updates on cybersecurity matters, including recent cybersecurity threats and incidents and ongoing efforts to prevent, detects and respond to internal and external cybersecurity threats.


text: As of the date of this Report, we are not aware of any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected, or are reasonably likely to materially affect, Cars Commerce, including our business strategy, results of operations or financial condition. However, there can be no assurance that our cybersecurity prevention and mitigation efforts have been or will continue to prevent possible cybersecurity threats or whether a cybersecurity threat could have a material adverse effect on our business strategy, results of operations or financial condition. See "Risks Related to Technology" in "Risk Factors" of this Report.


text: In July 2023, the SEC adopted rules requiring the disclosure of material cybersecurity incidents. To ensure compliance with the SEC requirement, Cars Commerce has a review process to determine whether the impact of a cybersecurity threat is material and requires disclosure of the cybersecurity incident. In compliance with the SEC rule and Cars Commerce's process, if such a cybersecurity incident occurs and the appropriate representatives from the Information Security Governance Committee determine that the cybersecurity incident is material, Cars Commerce will make the appropriate disclosures in a Current Report on Form 8-K within the required timeframe.


text: Governance. The Board of Directors provides strategic guidance regarding Cars Commerce's overall risk oversight, including identification, management and mitigation of risk. The Board has delegated direct cybersecurity and information security risk oversight to the Audit Committee. Cars Commerce management provides the Audit Committee with regular updates at least quarterly regarding the effectiveness of Cars Commerce's overall cybersecurity program and other cyber security related matters, which may include, Cars Commerce's inherent cybersecurity risks, updates on recent cybersecurity threats and incidents, policies and practices, industry trends, regulatory developments, threat environment and vulnerability assessments and specific and ongoing efforts to prevent, detect and respond to internal and external cybersecurity threats. The Chair of the Audit Committee informs the Board of the outcome of these meetings through updates presented to the Board at regularly scheduled Board meetings.


text: At the management level, our CEO provides general management, oversight and mitigation of Cars Commerce's risk. The Chief Legal Officer and the Chief Technology Officer are the key executives responsible for managing Cars Commerce's Information Security function and ensuring that Cars Commerce's information security processes comply with applicable laws, SEC requirements and contractual obligations respectively. Cars Commerce's Information Security Team, in conjunction with the Information Security Governance Committee are responsible for assessing and managing material risks from cybersecurity threats and providing management direction and support for information security. The Information Security Team is composed of skilled professionals with relevant information and cybersecurity education, certifications and experience. The Information Security Team coordinates the Cars Commerce Information Security Governance Committee, comprised of senior business leaders who support Cars Commerce's Information Security Management System based on their area of expertise. Working together the teams initiate and control the implementation and operation of information security within Cars Commerce.


text: Item 2. Properties. We maintain administrative offices and other facilities to support our operations. We have a lease for our principal executive office in Chicago, Illinois. In 2023, we ceased operations at our Naperville, Illinois office and terminated the lease effective February 2024.


text: Item 3. Legal Proceedings. From time to time, we may be party to various claims and legal actions arising in the ordinary course of our business. We do not believe that we have any pending litigation that, separately or in the aggregate, would have a material adverse effect on our results of operations, financial condition or cash flows. We hereby incorporate by reference Note 10 (Commitments and Contingencies) to the Consolidated Financial Statements included in Part II, Item 8. "Financial Statements and Supplementary Data" of this Annual Report on Form 10-K.


text: Our business and industry has become increasingly dependent upon digital technologies, including information and operational systems and related infrastructure as well as cloud applications and services, to process and record financial and operating data; analyze seismic, drilling, completion and production information; manage production equipment; conduct reservoir modeling and reserves estimation; communicate with employees and business associates; perform compliance reporting and many other activities. We recognize the importance of developing, implementing, and maintaining effective cybersecurity measures to safeguard our information systems and protect the confidentiality, integrity, and availability of our data. The Company has an Insider Threat and Data Loss Prevention program that is designed to protect the confidentiality, integrity and availability of such data, and we maintain processes designed to assess, identify, and manage material risks from cybersecurity threats.

companyName: CONTINENTAL RESOURCES, INC


text: The Company has a cybersecurity team with relevant subject-matter expertise that is part of the Company's Information Technology department (the "Cybersecurity Team"). This team reports to the Company's Vice President and Chief Information Officer ("CIO") and is led by the Company's Chief Information Security Officer ("CISO"), who has primary responsibility for oversight of the Company's assessment, identification, and management of cybersecurity risks. The CISO has 27 years of cybersecurity experience, 17 of which are in the oil and gas industry. The Company's CISO is certified in strategic planning, policy and leadership, and is one of less than 400 CISOs globally that has graduated from the FBI's CISO Academy in Quantico, Virginia. The CIO and CISO jointly determine whether a given cybersecurity matter is sufficiently important to warrant elevating it to the attention of the Company's Cybersecurity Executive Committee (defined below) and/or Board of Directors.


text: The Cybersecurity Team monitors the cybersecurity environment for threats and indicators of compromise. It also considers the risks attendant to the Company's business operations and strategy and develops solutions and mitigation measures for the risks identified, including risks arising in connection with third-party interactions and the integration of newly acquired assets. In addition, the Company invests in Security Awareness training to help promote employee awareness of cybersecurity.


text: The Company's internal cybersecurity efforts are supported by a team of outside consultants, assessors, and third-party vendors who assist with identifying and monitoring risks and indications of compromise.


text: The Cybersecurity Team regularly engages third-party assessors to conduct evaluations of the Company's cybersecurity risk mitigation efforts and strategy. The Company also engages a third-party auditing firm to periodically assess our information security program. Audits are also conducted from time-to-time by other third parties, such as insurance adjusters and regulators.


text: The Cybersecurity Team engages third-party vendors to assist with managing endpoint security, managing the Company's security operations center, providing threat detection and response capabilities, monitoring certain operational technology and control system environments, and providing threat detection and vulnerability identification and remediation services. Additionally, the Company is a member of the Oil and Natural Gas Information and Analysis Center. This center provides the Company with information regarding threats to the oil and gas industry and threats reported by other industry participants. Finally, the Cybersecurity Team periodically engages with the cybersecurity-related guidance of other third parties such as law enforcement, industry trade groups and vendors.


text: The Cybersecurity Team reviews the integrity of services provided by vendors engaged to support the Company's cybersecurity efforts using the same methods as are used to evaluate the services provided by other vendors engaged to support the Company's regular business operations.


text: The above cybersecurity risk management processes are integrated into the Company's overall enterprise risk management program. Cybersecurity risks are understood to be significant business risks, and as such, are considered an important component of our enterprise-wide risk management approach.


text: Since the Company is private, it has no independent members of its Board of Directors. All of the Company's directors are also executive officers. The body primarily responsible for oversight of the Cybersecurity Team is the Cybersecurity Executive Committee, which is composed of the Company's President and Chief Executive Officer; Executive Vice President, Chief Culture Officer and Administrative Officer (both of whom are also members of the Company's Board of Directors); Chief Financial Officer and Executive Vice President of Strategic Planning; Senior Vice President, General Counsel and Secretary; CIO; Director of Corporate Security; and the Information Security Manager. The Cybersecurity Executive Committee meets regularly and during these meetings its members review and discuss cybersecurity information provided by the CISO, which may include: (i) metrics relevant to cybersecurity issues; (ii) summaries of changes or proposed changes to the Company's cybersecurity program; and (iii) cybersecurity risk and threat updates. Information regarding any critical cybersecurity-related matter is communicated to the Cybersecurity Executive Committee as soon as practicable.


text: In addition, the CISO annually briefs the Company's Audit Committee regarding cybersecurity matters at a regularly scheduled committee meeting and these briefings cover the same types of information as is presented to the Cybersecurity Executive Committee. The Audit Committee is composed of the two members of the Board of Directors who are also members of the Cybersecurity Executive Committee.


text: The Company has developed a Cybersecurity Incident Response Plan (the "Response Plan"), which is based upon NASA's mission control incident response procedures to address and manage certain cybersecurity incidents. If an incident meets certain criteria, the incident response plan is invoked by the CISO and General Counsel. Once the plan is invoked, an impact assessment is conducted and a remediation plan is developed, if needed. The plan also sets forth procedures for monitoring incidents and post-incident follow-up so that any lessons learned can be discussed. Where appropriate, the post-incident follow up identifies measures that can be implemented to aid with future incident prevention and detection. Under the Response Plan any incident-related information is communicated using the channels outlined in the Response Plan.


text: As of the date of this report, though the Company and our service providers have experienced certain cybersecurity incidents, the Company does not believe any prior cybersecurity threat or incident has materially affected or are reasonably likely to materially affect the Company, including its business operations or prospects. However, the Company acknowledges that cybersecurity threats are continually evolving and the possibility of future cybersecurity incidents remains. Despite the implementation of our cybersecurity processes, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences for the business. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. No security measure is infallible. For additional information about the risks to our business associated with cybersecurity incidents, please see "A cybersecurity incident could result in information theft, data corruption, operational disruption, and/or financial loss" under Part I, Item IA. Risk Factors.


text: The Company relies on our internal Technology Solutions team and third-party vendors to provide effective and efficient service to our customers, process claims and timely and accurately report information to carriers, which often involves secure processing of confidential, sensitive, proprietary and other types of information. We monitor the risks presented by the possibility of cybersecurity breaches of any of these systems. Accordingly, we have significantly invested, and will continue to invest, in technology security initiatives, information technology policies and resources, and teammate training to mitigate the risk of improper access to private information.

companyName: BROWN & BROWN, INC.

ticker: BRO


text: The Audit Committee, composed entirely of independent directors, is responsible for organization-wide oversight regarding information security and reports to the full Board. All directors typically attend our committee meetings, which we believe creates transparency and a more collaborative and informed Board. The Audit Committee receives reports on at least a quarterly basis from the Company's chief information security officer, who is typically accompanied by the Company's chief security officer and chief information officer, on the Company's latest information security risks and mitigation strategies.


text: Assessing, identifying and managing cybersecurity related risks are integrated into our overall enterprise risk management (ERM) program. As part of the Company's ERM program, the Board receives a report at least annually from the Company's chief executive officer and chief legal officer concerning the Company's risks, which include cybersecurity risks.


text: The Company's chief information security officer, under the direction of our chief security officer, is responsible for developing and implementing our information security program. Our chief information security officer and our chief security officer each has more than 35 years of experience in technology, operations, information risk and security. Our chief information security officer has deep experience developing comprehensive information security programs for large and complex financial services and insurance organizations. Our chief security officer brings extensive experience in both the military and the private sector and is a specialist in attack surface reduction, incident response and recovery, targeted threat hunting, forensics/malware analysis and threat group analysis.


text: Our Information Security team has deployed a structured and measured vulnerability management program that proactively identifies vulnerabilities across our platforms and processes. The program is composed of the following: • Internal persistent scans and external monthly scans; • Static and dynamic software custom code to develop scans for secure code development; • Periodic third-party executed penetration tests and risk assessments; and • A model to comply with SOC 2 Type II standards or other industry certifications at certain offices based on an office's contractual agreements with carrier partners or other third parties.


text: In addition, external partners and products are submitted through a security risk assessment process facilitated through our security scorecard tool for data security risk and vulnerability maturity rating, and our teammates undertake a yearly security and compliance online training with test certification. Our teammates are also subject to security awareness communications and random simulated phishing campaigns. Teammates are also required to complete Health Insurance Portability and Accountability Act of 1996 (HIPAA) training every one or two years, depending on location. In 2023, substantially all Brown & Brown teammates completed ethical conduct training; cybersecurity awareness training; the California Consumer Privacy Act (CCPA) Survey; and the Annual Certification for Insurance Licensees training as a reminder of the regulatory obligation to report certain changes to the jurisdictions in which they are licensed.


text: We have also established a structured incident response process driven by the severity and type of issue. This process, which engages our Security Operations Center (SOC) for incident identification, our internal security team for incident analysis and assignment, our Technology Solutions teams for isolation/remediation and our third-party business partner for continuity awareness and escalations. These teams operate at the direction of our Legal Department when we identify potentially impactful information security incidents, which, among other things, directs external and internal reporting, including escalation to other functional areas within the Company and the Board of Directors. We have adopted an in-depth defense approach that includes intrusion detection systems and intrusion prevention systems, endpoint protection, endpoint detection and response and a log management platform. Additionally, to defray the costs of any future data breach, we have a cyber liability insurance policy.


text: We face a number of cybersecurity risks in connection with our business and have from time-to-time experienced cybersecurity incidents, such as malware infections, phishing campaigns and vulnerability exploit attempts, which to date have not had a material impact on our business strategy, results of operations, or financial condition. For more information about the cybersecurity risks we face, see the risk factor entitled "A cybersecurity attack, or any other interruption in information technology and/or data security that may impact our operations or the operations of third parties that support us, could adversely affect our business, financial condition and reputation" in Item 1A - Risk Factors.


text: We recognize the importance of maintaining the security of our electronic networks, information systems, and data. We face significant and persistent cybersecurity threats, including risks heightened by the numerous geographies that we serve; our reliance on complex information networks; remote work among certain of our employees; reliance on digital operations to service certain of our customers; and our use of third-party software and services. Our vendors and customers also face cybersecurity threats. A cybersecurity incident impacting our company or any of our vendors or customers could materially adversely affect our operations and/or financial condition. To protect against and prevent cybersecurity incidents, we employ a comprehensive approach where our Board and management teams work together to oversee our cybersecurity program. We are committed to maintaining robust cybersecurity oversight, controls, and strategies that are designed to help us assess, identify, and manage cybersecurity risks.

companyName: Regional Management Corp.

ticker: RM


text: Our Board includes members with skills and experience in cybersecurity, technology, and innovation. The Board ultimately oversees cybersecurity risks and evaluates such risks as part of our enterprise risk management ("ERM") program. As part of our ERM processes, we utilize a formal corporate risk and governance structure that sets out the roles, responsibilities, and expectations of the various parties involved throughout our company in risk mitigation and management. The Risk Committee of the Board is responsible for approving and periodically reviewing and assessing the effectiveness of our ERM policies and procedures. The Risk Committee also assists the Board in its oversight of risks related to cybersecurity by regularly engaging with management and/or third-party consultants to assess the cyber threat landscape; evaluate our information security program; review the results of penetration testing; and analyze the design, effectiveness, and ongoing enhancement of our capabilities to monitor, prevent, and respond to cyber threats and events. The Risk Committee generally meets with management and/or third-party consultants regarding cybersecurity matters on a quarterly basis. Any material developments are reported by the Risk Committee to the Board. Further, any cybersecurity incidents deemed to have a high impact on our business are also generally reported to the Board, regardless of materiality.


text: Our Senior Director of Information Security (the "SDIS"), who holds a graduate degree in cybersecurity and several industry leading cybersecurity certifications, is responsible for our overall information security program including strategy, security engineering, cyber threat detection, and response. The information security team managed by our SDIS contains certified cybersecurity professionals with broad experience and expertise in cybersecurity threat assessment and detection, mitigation technologies, cybersecurity training, incident response, cyber forensics, insider threats, and regulatory compliance, among other areas. The information security team continually evaluates our cybersecurity posture, which aligns with the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF) industry standard, and makes on-going investments in our networks, in addition to performing regular testing of our environment.


text: In addition, we engage third-party consultants to conduct evaluations of the operational effectiveness of our security controls. These consultants perform penetration testing on our cybersecurity practices and procedures on an annual basis.


text: Third-party risk is assessed as part of our information security program and includes risk-tiered criteria for due diligence. Contractually, data handling third parties are required to uphold all applicable rules, laws, and regulations in addition to, when applicable, notifying us of cyber security events that may negatively impact us or our data.


text: We also require all employees to perform annual cybersecurity training. We expect our employees to follow our company-wide policies and procedures relating to cybersecurity matters, which include policies related to IT security, remote access, multifactor authentication, use of the internet and social media, and handling of confidential information, among other items. Additionally, while we have insurance coverage in place designed to address certain aspects of cyber risks, such insurance coverage may be insufficient to cover all insured losses or all types of claims that may arise.


text: While we have not, as of the date of this Form 10-K, experienced a cybersecurity incident that has materially affected our business strategy, results of operations, or financial condition, we may not be successful in preventing or mitigating a cybersecurity incident that could have a material adverse effect on us in the future. See Item 1A. "Risk Factors" for information about our cybersecurity risks.


text: Risk Management and Strategy Our business operations and strategy are highly dependent on our ability, and the ability of certain third parties, to access internal and external systems and data to perform necessary business functions. We are heavily reliant on data and information, including non-public information, as well as technology systems that process and store such data and information, the integrity and functionality of which are critical to our ability to grow our business, operate efficiently, and generate earnings. As discussed in further detail in "Risk Factors" in Part I – Item 1A, and like others in the financial services industry, we have from time to time experienced, and are likely to continue to experience, security events and data intrusions, and while none of these events to date have had a material adverse effect on our business, no assurances can be made that such attacks or security events will not have a material adverse impact on our business, results of operations or financial condition in the future, due to impairments in our ability to conduct our business or harm to our relationships with our business partners and customers.

companyName: HANOVER INSURANCE GROUP, INC.

ticker: THG


text: We have established an enterprise-wide cybersecurity program that provides overall governance, direction and executive support for assessing, identifying and managing cybersecurity risks. Our cybersecurity program is based upon leading industry frameworks including the National Institute of Standards and Technology Cyber Security Framework, International Organization for Standardization, and Control Objectives for Information and Related Technologies. Our cybersecurity program is designed to identify relevant assets and associated risks, protect against, detect, respond to and recover from cybersecurity events, and employs a "defense in depth" strategy that uses multiple security measures to protect the confidentiality, integrity, and availability of our systems and information assets. We continually assess our cybersecurity and threat detection capabilities, including our proficiency in identifying emerging tactics, techniques, and procedures of threat actors, and to enhance our ability to focus resources appropriately.


text: Our cybersecurity program incorporates ongoing risk management practices such as risk identification and the maintenance of a cyber risk register, threat intelligence tracking, identification and monitoring of key controls using key performance indicators, the performance of independent control effectiveness testing by internal audit, annual third-party risk assessments, external penetration testing, and cyber incident response exercises. Our cybersecurity program also incorporates processes intended to help anticipate emerging technology innovation, utilizing a security capability map as a resource in combination with our cyber risk and enterprise risk assessment processes, to inform and prioritize investment decision-making in connection with the cybersecurity program. Additionally, we collaborate with industry associations, government authorities, peers and external advisors to monitor the threat environment and to inform our security practices, including for industry best practices for cybersecurity programs and capabilities, incident response processes, legal and regulatory developments, and experiential guidance. Our cybersecurity risk management activities are integrated in our overall enterprise risk management processes, so that cyber risks are assessed in the context of other risks relevant to our overall enterprise risk profile, to inform the organization's decision-making and planning.


text: We have implemented a third-party risk management process that assesses the inherent risks of third-party service providers and informs our engagement, contracting with, and oversight of such parties. Through this process, our information security personnel, in collaboration with our vendor management operations, evaluate the information security and business continuity capabilities, risks and vulnerabilities, of prospective and existing service providers.


text: We manage information security incidents pursuant to a documented incident response plan executed by an incident response team consisting of senior leaders and their team members who are integral to effective incident response management, including but not limited to representatives from information security, legal, compliance, risk management, communications, facilities, operations, marketing and distribution, finance, and human resources, as well as external, nationally recognized legal and forensics resources who are familiar with our operations and incident response team, and who routinely participate in our tabletop training. We employ a formal incident escalation process based on the nature of the incident and its risk severity, for alerting and engaging with executive leadership and members of our Audit Committee and Board of Directors. The incident response plan includes processes integrated with our business continuity and emergency response plans.


text: Our Board of Directors monitors the major risks we face, including cybersecurity and operational risks, and reviews management's plans for mitigating or remediating such risks. The Board has designated the Audit Committee, which oversees controls for our major risk exposures, to have principal responsibility for monitoring management's cybersecurity risk management program and associated risks. The Audit Committee reviews management's overall approach to managing and mitigating our exposure to data security and privacy risks, and reviews information technology's program to monitor and assess data security and the related efforts associated with cybersecurity, considering, among other things, emerging cybersecurity developments and threats. Our Chief Information Security Officer ("CISO") and Chief Information and Innovation Officer ("CIIO") provide regular reports and update briefings on cybersecurity matters to the Audit Committee. The topics covered by these briefings routinely include a review of top cybersecurity threats and exploits, a review of the recurring internal risk assessments and annual cyber risk assessment performed by third parties, key updates to the cyber risk management program, cybersecurity risk-mitigating controls, strategic planning considerations, security and infrastructure investments, regulatory and compliance updates, and cybersecurity incident updates, among other topics.


text: Our CISO is a certified information security manager, and has primary responsibility for our cybersecurity program, and the management and oversight of our information security department. Our CISO has more than 20 years of experience in information technology, including 13 years of cybersecurity experience, all of which has been in the property and casualty insurance industry. We have a diverse information security team with varying backgrounds, years of experience and levels of information security certification. Our CISO reports directly to our CIIO, who reports directly to our Chief Executive Officer ("CEO"). The CISO and CIIO routinely inform and advise executive management of salient aspects of our cybersecurity program, and developments related to key risks, threats and data incidents, addressing in further detail the matters noted above that are reported to the Audit Committee. Members of the information security team participate in our Enterprise Risk Management Group consisting of senior leaders who meet regularly to assess new and emerging risks to the organization, including cybersecurity risks.


text: As a global technology company, and the provider of electronic trading platforms and solutions for fixed-income and other securities, we view cybersecurity as fundamental to our business. Accordingly, we aim to appropriately secure all of our business operations, including information that we generate in the performance of our services, and data provided to us by third parties, including clients, vendors, business partners and employees.

companyName: MARKETAXESS HOLDINGS INC

ticker: MKTX


text: Risk Management and Strategy The Company has adopted an Enterprise Risk and Resilience Framework (the "ERRF") to identify, assess, monitor, and control the Company's risks, including cybersecurity risks. Our Chief Risk Officer (the "CRO") is responsible for implementing and executing the ERRF. The Company's information security team is staffed with skilled professionals who manage the safeguarding of our information and is led by our Chief Information Security Officer (the "CISO"). This team is responsible for aligning our practices with the requirements of local regulations and the voluntary standards to which we strive to adhere, such as ISO/IEC 27001 and the Institute of Standards and Technology ("NIST") Cyber Security Framework. The CISO reports directly to our Chief Information Officer (the "CIO") and CRO. The CIO is responsible for designing and executing the Company's technology strategy, which includes overseeing the Company's cybersecurity strategy.


text: The Company's cybersecurity policies, standards, processes and practices are fully integrated into the Company's ERRF and are based on recognized frameworks established by NIST, the International Organization for Standardization and other applicable industry standards. In general, the Company seeks to address cybersecurity risks through a comprehensive, cross-functional approach that is focused on preserving the confidentiality, integrity and availability of the information that the Company collects and stores by identifying, preventing and mitigating cybersecurity threats and effectively responding to cybersecurity incidents when they occur.


text: As one of the critical elements of the Company's overall ERRF approach, the Company's cybersecurity program is focused on the following key areas: • Governance: As discussed below in more detail under the heading "The Board's Oversight of Cybersecurity Risk," the Board's oversight of cybersecurity risk management is supported by the Risk Committee of the Board (the "Risk Committee"), which regularly interacts with the Company's CRO, CIO, CISO and other members of management. • Collaborative Approach: The Company has implemented a comprehensive, cross-functional approach to identification, protection, detection, response and recovery from cybersecurity threats and incidents, while also implementing controls and procedures that are designed to provide for the prompt escalation of certain cybersecurity incidents so that decisions regarding the public disclosure and reporting of such incidents can be made by management in a timely manner. • Technical Safeguards: The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, intrusion prevention and detection systems, anti-malware functionality and access controls, which are evaluated and improved through vulnerability assessments and cybersecurity threat intelligence. • Incident Response and Recovery Planning: The Company has established and maintains its Information Security Incident Management Policy that addresses the Company's response to a cybersecurity incident, and such policy is tested and evaluated on a regular basis. The policy applies to all full- and part-time employees and contractors. The goal of the policy is to restore normal service operation as quickly as possible following an event, provide timely and accurate information to relevant stakeholders regarding such an event, as appropriate, and minimize the impact of such an event on our business operations. The policy is designed to ensure that we are meeting both our contractual and regulatory requirements related to cybersecurity events. • Data Collection, Use, Processing and Monitoring: The Company maintains robust policies and procedures relating to our data collection, use and processing activities as well as mechanisms for monitoring our data systems and usage. We do not have retail clients and any gathering and maintaining of individual consumer data is very limited. We seek to maintain compliance with global data protection laws, including the EU General Data Protection Regulation (the "GDPR"), the UK Data Protection regime and the California Consumer Privacy Act (the "CCPA"), in the countries in which we operate, and meet our contractual commitments to our clients. • Third-Party Risk Management: The Company maintains a comprehensive, risk-based approach to identifying and overseeing cybersecurity risks presented by third parties, including vendors, service providers and other external users of the Company's systems, as well as the systems of third parties that could adversely impact our business in the event of a cybersecurity incident affecting those third-party systems.


text: • Education and Awareness: The Company provides regular, mandatory training for personnel regarding cybersecurity threats as a means to equip the Company's personnel with effective tools to address cybersecurity threats, and to communicate the Company's evolving information security policies, standards, processes and practices. In addition, the Company provides regular, mandatory training for personnel regarding key data privacy laws and the appropriate collection, use, and storage of data.


text: We periodically assess and test our policies, standards, processes and practices that are designed to address cybersecurity threats and incidents. These efforts include a wide range of activities, including audits, assessments, tabletop exercises, vulnerability testing and other exercises focused on evaluating the effectiveness of our cybersecurity measures and planning. The Company regularly engages third parties to perform assessments on our cybersecurity measures, including information security maturity assessments, audits and independent reviews of our information security control environment and operating effectiveness. The results of such assessments, audits and reviews are reported, as appropriate, to the Risk Committee, and the Company adjusts its cybersecurity policies, standards, processes and practices as necessary based on the information provided by these assessments, audits and reviews.


text: We experience cybersecurity threats and incidents from time to time. However, as of the date of this report, we have not experienced a cybersecurity threat or incident that has materially affected the Company in at least the last three years. While we are not currently aware of any risks from cybersecurity threats that are reasonably likely to materially affect the Company, please see Part I, Item 1A. – "Risk Factors – Malicious cyber-attacks, attempted cybersecurity breaches, and other adverse events affecting our operational systems or infrastructure, or those of third parties, could disrupt our businesses, result in the disclosure of confidential information, damage our reputation and cause losses or regulatory penalties."


text: The Board's Oversight of Cybersecurity Risk The Board recognizes the critical importance of maintaining the trust and confidence of our clients, business partners and employees. The Board is actively involved in oversight of the Company's ERRF, and cybersecurity represents an important component of the Company's overall approach to enterprise risk management. The Board is responsible for overseeing the Company's risk management processes over the short-, medium- and long-term by staying informed of the Company's material risks and evaluating whether management has reasonable controls in place to address such material risks. As part of its oversight responsibilities, the Board dedicates meaningful time and attention to oversight of cybersecurity risk. The Board is not responsible, however, for defining or managing the Company's various risks. See "Management's Involvement in Cybersecurity Risk Oversight" below.


text: The Board and its committees oversee risk through regular reports from management. The Board's committees report on the matters discussed at the committee level to the full Board. The Risk Committee has primary responsibility for cybersecurity oversight. In that capacity, the Risk Committee receives quarterly presentations and reports, as well as additional reports as needed, on cybersecurity risks. Such reports address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The Board and the Risk Committee also receive prompt and timely information regarding any cybersecurity incident that meets established internal escalation thresholds, as well as ongoing updates regarding any such incident until it has been addressed.


text: Management's Involvement in Cybersecurity Risk Oversight The CISO, in coordination with the Information Security Management System Committee, which includes our Chief Executive Officer and Interim Chief Financial Officer ("CEO"), CIO, CRO and General Counsel & Corporate Secretary (the "GC"), works collaboratively across the Company to implement a program designed to protect the Company's information systems from cybersecurity threats and to promptly respond to any cybersecurity incidents in accordance with the Company's incident response and recovery plans. To facilitate the success of the Company's cybersecurity risk management program, multidisciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents. Through ongoing communications with these teams, the CISO and the Information Security Management System Committee monitor the prevention, detection, mitigation and remediation of cybersecurity threats and incidents in real time, and report such threats and incidents to the Risk Committee and/or the full Board when appropriate.


text: The CISO has served in various roles in information technology and information security for over 30 years, including previously serving as the Deputy Chief Information Security Officer of a large European banking group. The CISO has attained the professional certification of Certified Information System Security Professional (CISSP). The CIO holds undergraduate and masters degrees in computer science and has served in various roles in information technology for over 25 years. The Company's CRO holds an undergraduate degree and has over 25 years of experience managing risks, including risks arising from cybersecurity threats.


text: The Company is ISO/IEC 27001:2013 certified, which is a global standard that specifies the requirements for establishing, implementing, maintaining, and continually improving information security management systems. Additionally, we have received an independent examination regarding our compliance with SOC 2 Type 1 and Type 2.


text: Risk Management and Strategy We employ information systems to support our business. As is the case for other manufacturing companies of comparable size and scope, we, from time to time, experience attempted cyber-attacks on our information system. We also face risks associated with other potential significant failures or disruptions of our information technology networks. We utilize a risk-based, multi-layered information security approach that incorporates some of the National Institute of Standards and Technology ("NIST") Cybersecurity Framework ("CSF"). We have adopted and implemented this approach to identify and mitigate information security risks in a manner that we believe is commercially reasonable for manufacturing companies of our size and scope.

companyName: KAISER ALUMINUM CORP

ticker: KALU


text: The review of cybersecurity risks and threats is integrated into our enterprise risk management ("ERM"). Our ERM program includes an annual risk prioritization process to identify key enterprise risks. Each key risk is assigned risk owners to establish action plans and implement risk mitigation strategies. The cybersecurity threat risk action plan is managed at the enterprise level by our Chief Information Officer ("CIO"). Management employs in-depth defense mechanisms throughout the enterprise. We regularly engage and consult with independent third-party consultants as part of our overall ERM, including penetration testing and periodic tabletop exercises to better prepare us for potential cyber threats. We also conduct annual information security training to educate employees and make them aware of information security risks and to enable them to take steps to mitigate those risks. As part of this program, we take reasonable steps to provide our executive management and employees who may come into possession of confidential financial information with appropriate information security awareness training. In addition, we employ multi-factor authentication and vulnerability management to mitigate and/or prevent cybersecurity incidents.


text: A cybersecurity incident may be detected in a number of ways, including, but not limited to, through automated reporting mechanisms, network and system indicators, intrusion detection systems, employee reports, law enforcement reports, or other third-party notification. To oversee and identify cybersecurity threat risks on a day-to-day basis, including from third-party service providers, the Company maintains a cybersecurity operations team with round-the-clock monitoring, and the CIO and Director of Cybersecurity receive regular reports on industry activity. Upon receiving notification of a cybersecurity incident, the cybersecurity operations team acts to isolate and contain the threat. The CIO along with the Director of Cybersecurity will consult and determine the incident severity level, which determines whether the incident should be escalated. Critical and high severity incidents must be reported to our President and Chief Executive Officer, Executive Vice President and Chief Financial Officer, Executive Vice President, Chief Administrative Officer and General Counsel and Executive Vice President - Manufacturing. The Company may engage third-party experts for assistance with crisis management, including forensic investigations, ransom negotiation, or crisis communication. During this process, the cybersecurity operations team will take steps to preserve evidence as soon as possible, including, but not limited to, memory dumps, log preservation and forensic hard drive collection. In addition, our Executive Vice President, Chief Administrative Officer and General Counsel, in consultation with the CIO and Director of Cybersecurity, will promptly evaluate whether the incident requires legal notifications or disclosure, including whether the incident requires disclosure under the U.S. securities laws. Following a cybersecurity incident, the Executive Vice President and Chief Financial Officer will direct the development of documentation regarding lessons learned in the response, including evaluation of preparedness capability, to continuously strengthen the cybersecurity posture of the Corporation.


text: Management has not identified risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, that have materially affected or are reasonably likely to materially affect the Company, including its business, strategy, results of operations, or financial condition. See "Item 1A. Risk Factors - Risks Related to Cybersecurity and Privacy" for additional information. While we continually work to safeguard the information systems we use, and the proprietary, confidential and personal information residing therein, and mitigate potential risks, there can be no assurance that such actions will be sufficient to prevent cybersecurity incidents or mitigate all potential risks to such systems, networks and data or those of our third-party providers. In the event an attack or other intrusion were to be successful, we have a response team of internal and external resources engaged and prepared to respond. We also have a cyber risk insurance policy to help us mitigate risk exposure by offsetting costs involved with recovery and remediation in the event of a successful attack or other intrusion.