text: We also engage third party service providers when necessary to both expand our capabilities and capacity as well as evaluate the effectiveness of our cybersecurity program, including hosting regular table-top exercises meant to evaluate and improve the overall effectiveness of our cybersecurity program.


text: As indicated above, our management, with oversight from the Board, performs an annual ERA and cybersecurity is among the main risks identified by the ERA for Board-level oversight. Our full Board has oversight of our efforts in cybersecurity and meets regularly with our Vice President – Information Technology (three times during fiscal 2025) on our cybersecurity risks and programs. The Board is also updated as needed on cybersecurity threats, incidents, or new developments in our cybersecurity risk profile.

companyName: APPLIED INDUSTRIAL TECHNOLOGIES INC

ticker: AIT

secItem: Item 1C


text: Disclosure of Risks: We describe how risks from cybersecurity threats, could materially affect us, including our business strategy, results of operations, or financial condition, as part of our risk factor disclosures at Part I, Item 1A of this Annual Report on Form 10-K.

companyName: NORTHWEST PIPELINE LLC


text: The CISO has been at Williams for over 25 years. During that time, he has held a variety of IT positions at multiple levels in the organization ranging from network engineering to application development, project management as well as several IT Manager and Director roles. He has had oversight of our cybersecurity and risk management programs since 2017. Active in government and private sector partnerships, he is currently serving as the outgoing Chair of the Oil & Natural Gas Subsector Coordinating Council and recently acted as the Chair of the Interstate Natural Gas Association of America security committee.


text: Our CISO holds degrees in Business Administration and MIS from the University of Oklahoma and is certified in Leadership from Harvard Business School's executive education. In 2018, he obtained his Chief Information Security Officer certification from Carnegie Mellon University.


text: The Company maintains a cybersecurity program guided by the ISO 27001 information security standard for information security management systems that is reasonably designed to protect its information, and that of its customers, against cybersecurity threats that may result in material adverse effects on the confidentiality, integrity, and availability of its information systems.

companyName: WOLVERINE WORLD WIDE INC /DE/

ticker: WWW


text: Board of Directors The Company's Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives quarterly reports and presentations from members of the Company's team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer (CISO), Chief Information Officer (CIO), and members of the legal team, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The other members of the Board attend these quarterly reports and presentations to the Audit Committee by members of management. The Company has protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Board and Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.


text: At the management level, the CISO, who has extensive cybersecurity knowledge and skills gained from over 16 years of work experience at the Company and elsewhere, heads the cross-functional team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the business and reports directly to the CIO, who reports directly to the Chief Executive Officer. The CISO receives reports on cybersecurity threats from a number of experienced information security team members, each of whom is responsible for various parts of the business on an ongoing basis and, in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The CISO works closely with the legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: Internal Cybersecurity Team The Internal Cybersecurity Team, led by the CISO, is responsible for the implementation, monitoring, and maintenance of the cybersecurity and data protection practices across the Company. The CISO is supported by experienced information security team members, each of whom is supported by a team of trained cybersecurity professionals. The individuals who report directly to the CISO include the Director of Cyber Security, who oversees the cybersecurity engineers, security operations center, and identity & access management team, and the Privacy and Compliance Manager, who oversees the global privacy and compliance analysts. In addition to internal cybersecurity capabilities, the Company also at times engages consultants or specialists to assist with assessing, identifying, and managing cybersecurity risks.


text: Risk Management and Strategy The Company employs systems and processes designed to oversee, identify, and reduce the potential impact of a security incident at a third-party vendor, service provider or customer or otherwise implicating the third-party technology and systems the Company uses.


text: The Company maintains a Privacy Policy that describes the personal information that it collects about its customers, including how the Company may use such information and when it shares such information with third parties.


text: The Company conducts annual cyber-risk mitigation exercises including awareness outreach, annual IT Security Awareness training, monthly phishing tests, and a variety of ongoing vulnerability scans. Over the past two years, the Company has implemented multiple new security tools designed to provide visibility and controls allowing the cybersecurity team to safeguard data against theft or loss.


text: The Company maintains various role-based access controls to safeguard data and systems. Data center assets are protected and monitored by badged key systems and video surveillance. Access is periodically reviewed and updated.


text: In addition, an external consultant in conjunction with the Company conducted a cybersecurity gap assessment in November 2023 to review and confirm that the Company has appropriate measures in place to assess, identify and manage cybersecurity risks, and the Company is implementing the recommendations made as a result of the gap assessment.


text: The cybersecurity, legal, and Executive Leadership teams also participated in a data security incident tabletop exercise in December 2023 to simulate responses to a ransomware attack and use the findings to improve the Company's processes and technologies.


text: The Company maintains cybersecurity insurance coverage to help defray any financial losses suffered by the Company in the event of an information security breach. The Company's insurance coverage may not cover all cybersecurity incidents the Company experiences or all losses the Company incurs as a result.


text: Incident Response The Company has adopted an Incident Response Plan (the "IRP") that provides a standardized framework for responding to security incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. The IRP applies to all Company personnel (including third-party contractors, vendors and partners) that perform functions or services that require access to secure Company information, and to all devices and network services that are owned or managed by the Company.


text: Material Cybersecurity Risks, Threats & Incidents The Company relies on information technology and third party vendors to support its operations, including its secure processing of personal, confidential, sensitive, proprietary and other types of information. The Company and its vendors may not be able to protect all of their respective information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. While the Company has not experienced any material cybersecurity incidents, there can be no guarantee that it will not be the subject of future successful attacks, threats or incidents.


text: Board of Directors The Company's Board, in coordination with the Audit Committee, oversees the Company's enterprise risk management process, including the management of risks arising from cybersecurity threats. The Board has delegated the primary responsibility to oversee cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews the measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. As part of such reviews, the Audit Committee receives quarterly reports and presentations from members of the Company's team responsible for overseeing the Company's cybersecurity risk management, including the Chief Information Security Officer (CISO), Chief Information Officer (CIO), and members of the legal team, which address a wide range of topics including recent developments, evolving standards, vulnerability assessments, third-party and independent reviews, the threat environment, technological trends and information security considerations arising with respect to the Company's peers and third parties. The other members of the Board attend these quarterly reports and presentations to the Audit Committee by members of management. The Company has protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated to management and, where appropriate, reported promptly to the Board and Audit Committee, as well as ongoing updates regarding any such incident until it has been addressed.


text: At the management level, the CISO, who has extensive cybersecurity knowledge and skills gained from over 16 years of work experience at the Company and elsewhere, heads the cross-functional team responsible for implementing, monitoring, and maintaining cybersecurity and data protection practices across the business and reports directly to the CIO, who reports directly to the Chief Executive Officer. The CISO receives reports on cybersecurity threats from a number of experienced information security team members, each of whom is responsible for various parts of the business on an ongoing basis and, in conjunction with management, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The CISO collaborates closely with the legal team to oversee compliance with legal, regulatory and contractual security requirements.


text: The Company conducts annual cyber-risk mitigation exercises including awareness outreach, annual IT Security Awareness training, periodic phishing simulations, and a variety of ongoing vulnerability scans. Over the past two years, the Company has implemented multiple new security tools designed to provide visibility and controls allowing the cybersecurity team to safeguard data against theft or loss.


text: The Company measures its security posture through several third-party score-based cybersecurity tools. Scores from these tools are reviewed weekly and measure the Company's posture regarding securing applications, infrastructure, data and other assets from theft or loss, both internally and externally. Thresholds are in place for escalation to management.


text: Material Cybersecurity Risks, Threats & Incidents The Company relies on information technology and third-party vendors to support its operations, including its secure processing of personal, confidential, sensitive, proprietary and other types of information. The Company and its vendors may not be able to protect all of their respective information systems, and such incidents may lead to reputational harm, revenue and client loss, legal actions, statutory penalties, among other consequences. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition. While the Company has not experienced any material cybersecurity incidents, there can be no guarantee that it will not be the subject of future successful attacks, threats or incidents.


text: Risk management and strategy The Company has documented cybersecurity policies and standards, assesses risks from cybersecurity threats, and monitors information systems for potential cybersecurity issues. To protect the Company's information systems from cybersecurity threats, the Company uses various security tools supporting protection, detection, and response capabilities. The Company maintains a cybersecurity incident response plan to help ensure a timely, consistent response to actual or attempted cybersecurity incidents impacting the Company.

companyName: JOHNSON & JOHNSON

ticker: JNJ


text: The Company also identifies and assesses third-party risks within the enterprise, and through the Company's use of third-party service providers, across a range of areas including data security and supply chain through a structured third-party risk management program.


text: The Company maintains a formal information security training program for all employees that includes training on matters such as phishing and email security best practices. Employees are also required to complete mandatory training on data privacy.


text: To evaluate and enhance its cybersecurity program, the Company periodically utilizes third-party experts to undertake maturity assessments of the Company's information security program.


text: To date, the Company is not aware of any cybersecurity incident that has had or is reasonably likely to have a material impact on the Company's business or operations; however, because of the frequently changing attack techniques, along with the increased volume and sophistication of the attacks, there is the potential for the Company to be adversely impacted. This impact could result in reputational, competitive, operational or other business harm as well as financial costs and regulatory action. Refer to the risk factor captioned An information security incident, including a cybersecurity breach, could have a negative impact to the Company's business or reputation in Part I, Item 1A. Risk factors for additional description of cybersecurity risks and potential related impacts on the Company.


text: Governance - management's responsibility The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity controls designed to address cybersecurity threats and risks. The Chief Information Officer (CIO), who is a member of the Company's Executive Committee, and the Chief Information Security Officer (CISO) are responsible for assessing and managing cybersecurity risks, including the prevention, mitigation, detection, and remediation of cybersecurity incidents.


text: The Company's CISO, in coordination with the CIO, is responsible for leading the Company's cybersecurity program and management of cybersecurity risk. The current CISO has over twenty-five years of experience in information security, and his background includes technical experience, strategy and architecture focused roles, cyber and threat experience, and various leadership roles.


text: Governance - board oversight The Company's Board of Directors oversees the overall risk management process, including cybersecurity risks, directly and through its committees. The Regulatory Compliance & Sustainability Committee (RCSC) of the board is primarily responsible for oversight of risk from cybersecurity threats and oversees compliance with applicable laws, regulations and Company policies related to, among others, privacy and cybersecurity.


text: RCSC meetings include discussions of specific risk areas throughout the year including, among others, those relating to cybersecurity. The CISO provides at least two updates each year to RCSC on cybersecurity matters. These reports include an overview of the cybersecurity threat landscape, key cybersecurity initiatives to improve the Company's risk posture, changes in the legal and regulatory landscape relative to cybersecurity, and overviews of certain cybersecurity incidents that have occurred within the Company and within the industry.


text: Governance - management's responsibility The Company takes a risk-based approach to cybersecurity and has implemented cybersecurity controls designed to address cybersecurity threats and risks. The Chief Information Officer (CIO), who is a member of the Company's Executive Committee, and the Chief Information Security Officer (CISO) are responsible for assessing and managing cybersecurity risks, including security incident detection, response, and recovery.


text: RCSC meetings include discussions of specific risk areas throughout the year including, among others, those relating to cybersecurity. The CISO provides quarterly updates each year to RCSC on cybersecurity matters. These reports include an overview of the cybersecurity threat landscape, key cybersecurity initiatives to improve the Company's risk posture, changes in the legal and regulatory landscape relative to cybersecurity, and overviews of certain cybersecurity incidents that have occurred within the Company and within the industry.


text: Risk Management and Strategy We assess and identify material risks from cybersecurity threats primarily through the work of our Information Security organization as part of our enterprise risk management ("ERM") process. The ERM process, administered by management with input from each business segment and function, continually monitors material risks facing L3Harris, including cybersecurity threats. Our Chief Information Officer ("CIO"), has extensive experience leading information technology for global organizations across aerospace, defense and industrials, works directly with our CEO and other members of senior management to assess cybersecurity threats as part of the ERM process. The CIO also oversees the internal cybersecurity organization of more than 100 full-time employees headed by our Chief Information Security Officer (our "Cybersecurity Team").

companyName: L3HARRIS TECHNOLOGIES, INC. /DE/

ticker: LHX


text: Risks related to cybersecurity threats are reflected in an enterprise risk "heat map," along with other material risks identified through the ERM process, and any mitigation plans developed to manage such risks are reported to our Board. The "heat map" includes risks related to cybersecurity threats to L3Harris and our customers, suppliers, vendors, subcontractors or other third parties, and the possibility of a data breach of our confidential, personal and proprietary information through a cybersecurity incident impacting L3Harris or any third party. We could be negatively impacted by a security breach, through cyber-attack, cyber intrusion, insider threats, supply chain incidents, or otherwise, or other significant disruption of our IT networks and related systems or of those we operate for certain of our customers. See "Item 1A - Risk Factors" in this Report for further discussion of specific risks related to cybersecurity threats.


text: To actively manage cybersecurity risks identified as part of the ERM process or otherwise and to manage emerging cybersecurity threats in real time, management has implemented an ISO 27001 certified Information Security Management System. Our Cybersecurity Team operates a Security Operations Center that continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our CIO, who briefs senior management, including our CEO, as well the Innovation and Cyber Committee of our Board (the "Innovation and Cyber Committee") and the Audit Committee of our Board (the "Audit Committee"), as appropriate. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting and recovering from cybersecurity threats.


text: We also have a counterintelligence and insider threat program to detect potential external and internal threats, conducted by purposeful or unwitting actors. As a government contractor, we must comply with extensive cybersecurity regulations, including the Defense Federal Acquisition Regulation Supplement ("DFARS") related to adequately safeguarding controlled unclassified information ("CUI") and reporting cybersecurity incidents to the DoD. The policies and implemented controls reflect our adherence to these requirements and have been assessed by external organizations, including industry partners and the federal government.


text: To mitigate cybersecurity risk introduced from our supply chain, we have a dedicated Cybersecurity - Supply Chain Risk Management team. This team assesses new suppliers against best cybersecurity practices, ensures cybersecurity regulations are contractually obligated and coordinates mitigation actions across the company if a supplier is impacted by a cybersecurity incident. They utilize industry monitoring services to identify potential supply chain incidents and work closely with our Cybersecurity team to understand the latest threats affecting our industry.


text: _____________________________________________________________________ Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take annual cybersecurity training and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of the cybersecurity training. We also periodically conduct penetration testing of our network, hold tabletop exercises of cyber incidents, and undertake cybersecurity assessments led by Internal Audit to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.


text: The Audit Committee provides regular oversight and review of our ERM process and other guidelines and policies governing the processes by which our CEO and senior management assess our exposure to risk, including risk from cybersecurity threats. The Innovation and Cyber Committee receives regular briefings from our CIO, Chief Information Security Officer and other members of senior management on cybersecurity threats and related matters and assists the Audit Committee in its oversight and review of our ERM process.


text: The Innovation and Cyber Committee reviews our cybersecurity risk across the enterprise at least annually, including IT, supply chain and products and our cybersecurity strategy framework and operational posture. The Innovation and Cyber Committee also reviews our IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and our other assets or assets of our customers or other third parties in our possession or custody; (c) support the response and management of cybersecurity threats and data breach incidents; and (d) aid in compliance with legal and regulatory requirements governing cybersecurity or data security reporting requirements. The Innovation and Cyber Committee reports its activities to the full Board on a regular basis and makes such recommendations to the Board and management with respect to risks from cybersecurity threats and other matters as it deems necessary or appropriate.


text: Risk Management and Strategy We assess and identify material risks from cybersecurity threats primarily through the work of our Information Security organization, which is fully integrated in our enterprise risk management (" ERM ") process in close partnership with other functions such as Engineering, Industrial Security, Internal Audit, and Legal. The ERM process, administered by management with input from each business segment and function, continuously monitors material risks facing L3Harris, including cybersecurity threats. Our Information Security organization, is led by our Chief Information Officer (" CIO "), who has extensive experience leading information technology for global organizations across aerospace, defense and industrials, and works directly with our Chief Executive Officer (" CEO ") and other members of senior management to assess cybersecurity threats as part of the ERM process. The CIO oversees the internal cybersecurity organization of more than 100 full-time employees headed by our Chief Information Security Officer (our " Cybersecurity Team ").


text: Risks related to cybersecurity threats are reflected in an enterprise risk "heat map," along with other material risks identified through the ERM process, and any mitigation plans developed to manage such risks are reported to our Board of Directors (" Board "). The "heat map" includes risks related to cybersecurity threats to L3Harris and our customers, suppliers, vendors, subcontractors or other third parties, and the possibility of a data breach of our confidential, personal and proprietary information through a cybersecurity incident impacting L3Harris or any third party.


text: To actively manage cybersecurity risks identified as part of the ERM process or otherwise and to manage emerging cybersecurity threats in real time, management has implemented an ISO 27001 certified Information Security Management System. Our Cybersecurity Team operates a Security Operations Center that continuously monitors activity, frequently scans applications and systems for vulnerabilities to risk from cybersecurity threats and creates action plans to address and track identified cybersecurity threats until they have been remediated. Activities and cybersecurity incidents are reported to our CIO, who briefs senior management, including our CEO, as well as the Innovation and Cyber Committee and the Audit Committee of our Board (respectively, the "Innovation and Cyber Committee " and the " Audit Committee "), as appropriate. Our Cybersecurity Team also routinely engages with third parties, including government agencies focused on cyber resiliency, to manage risks from cybersecurity threats. For example, we are members of the DoD Defense Industrial Base Collaborative Information Sharing Environment, the National Defense Information Sharing and Analysis Center, and the National Security Agency Enduring Security Framework. These organizations share real-time cybersecurity threat information and best practices in protecting, detecting and recovering from cybersecurity threats.


text: We are committed to safeguarding against both internal and external security threats through a robust counterintelligence and insider threat program that utilizes cutting-edge data analytics and machine learning. As a defense contractor, we are subject to the Department of Defense's cybersecurity regulations, including the Defense Federal Acquisition Regulation Supplement, ensuring the protection of Controlled Unclassified Information and prompt reporting of cybersecurity incidents. Our practices have been rigorously assessed by the Defense Contract Management Agency to meet the Level 2 Cybersecurity Maturity Model Certification requirements, reflecting our dedication to maintaining stringent security controls.


text: To mitigate cybersecurity risks introduced from our supply chain, we have a dedicated Cybersecurity - Supply Chain Risk Management team. This team assesses new suppliers against best cybersecurity practices, ensures cybersecurity regulations are contractually flowed down and coordinates mitigation actions across the company if a supplier is impacted by a cybersecurity incident. The Supply Chain Risk Management team utilizes industry monitoring services to identify potential supply chain incidents and works closely with our Cybersecurity Team to understand the latest threats affecting our industry.


text: Additionally, as part of our processes to manage risks related to a breach in our information systems, management requires employees to take annual cybersecurity training and shares regular awareness updates regarding cybersecurity threats. Our Cybersecurity Team regularly tests employees throughout the year to assess the effectiveness of the cybersecurity training. We also periodically conduct penetration testing of our network, hold tabletop exercises of cyber incidents, and undertake cybersecurity assessments led by Internal Audit to improve our risk mitigation and assist in the determination of a potential material impact caused by a cybersecurity incident.


text: While we have implemented robust practices to mitigate cybersecurity risks, and prior cybersecurity threats have not materially affected our business strategy, results of operations or financial condition, we could be negatively impacted by a cybersecurity breach, through cyber-attack, cyber intrusion, insider threats, supply chain incidents, or otherwise, or other significant disruption of our IT networks and related systems or of those we operate for certain of our customers. See "Item 1A. Risk Factors" in this Report for further discussion of specific risks related to cybersecurity threats.


text: The Innovation and Cyber Committee reviews our cybersecurity risk across the enterprise at least annually, including IT, supply chain and products and our cybersecurity strategy framework and operational posture. The Innovation and Cyber Committee also reviews our IT, data security and other systems, processes, policies, procedures and controls at least annually to (a) identify, assess, monitor and mitigate cybersecurity risks; (b) identify measures to protect and safeguard against cybersecurity threats and breaches of confidential information and data and IT infrastructure and our other assets or assets of our customers or other third parties in our possession or custody; (c) support the response and management of cybersecurity threats and data breach incidents; and (d) aid in compliance with legal and regulatory requirements governing cybersecurity or data security reporting requirements.


text: The Innovation and Cyber Committee reports its activities to the full Board on a regular basis and makes such recommendations to the Board and management with respect to risks from cybersecurity threats and other matters as it deems necessary or appropriate.


text: Risk Management and Strategy We have implemented a cybersecurity program to assess, identify, and manage risks from cybersecurity threats. Our efforts are designed to maintain the confidentiality, integrity, and availability of our information and operational technology systems and the data stored on those systems.

companyName: GRAYBAR ELECTRIC CO INC


text: The program includes: • periodic risk assessments to identify and assess cybersecurity risks and vulnerabilities in our information technology systems; • security event monitoring, management, and incident response; • third party engagements to perform periodic penetration testing and reviews of program maturity based on industry standard frameworks; • reviews by our internal audit team of the effectiveness of information technology-related internal controls; • cybersecurity risk assessments of our third-party vendors; and • employee training, including regular phishing simulations.


text: Cybersecurity threats on our information systems are included as a topic considered by our risk committee working group. This group identifies, assesses and makes related recommendations for managing a number of risks, including cybersecurity threats. Management has also formed an enterprise risk management committee which is charged with addressing the full spectrum of its risks and managing the potential individual as well as combined impact of those risks as an interrelated risk portfolio. Moreover, this group engages subject matter experts from various departments within the Company to engage in a bi-annual exercise designed to identify potential worse case scenarios, the estimated likelihood of each, and the potential financial impact of each risk, as well as to prioritize such risks, including the risk of a cybersecurity threat.


text: We also have a standing risk committee. The purpose of the risk committee is to oversee a sustainable dynamic process that enables enterprise-wide cross-functional analysis and assessment of risks that may threaten the Company or provide opportunities to leverage resources to create growth opportunities. Under its charter, the committee is to be comprised of at least three members of the Board, selected by the President. The committee has established a working group that is comprised of representatives from the following functional areas of the Company: treasury, human resources, legal, supply chain management, sales, and marketing. Currently, the Senior Vice President, Secretary and General Counsel, a member of the risk committee, apprises the Board quarterly of the working group and this Committee's activities.


text: As a result of these and other initiatives, we believe we have appropriate processes in place, including in many cases, related contractual provisions, as well as appropriate physical and administrative controls, that are designed to allow oversight and identification of cybersecurity threats related to our use of third-party service providers.


text: The Audit Committee charter provides that it shall review, at least annually, the Company's cybersecurity program and shall receive frequent updates on cybersecurity and the development of Company's cyber strategy and the Company's corresponding information technology emergency response plan. Our director, information security, reports at least quarterly to the Audit Committee during its regularly scheduled meetings, and engages in weekly dialogue with the Chair of the Audit Committee and Senior Vice President, Secretary and General Counsel, including with respect to matters identified by our information technology department.


text: Impact of Cybersecurity Events In the fourth quarter of 2023, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, materially affected or would reasonably be likely to materially affect Graybar, including our business strategy, results of operations or financial condition.


text: We have a standing risk committee. The purpose of the risk committee is to oversee a sustainable dynamic process that enables enterprise-wide cross-functional analysis and assessment of risks that may threaten the Company or provide opportunities to leverage resources to create growth opportunities. Under its charter, the risk committee is to be comprised of at least three members of the Board, selected by the President. The committee has established a working group that is comprised of representatives from the following functional areas of the Company: treasury, human resources, legal, supply chain management, sales, and marketing. Currently, the Senior Vice President, Secretary and General Counsel, a member of the risk committee, apprises the Board quarterly of the working group and this Committee's activities.


text: Cybersecurity threats on our information systems are included as a topic considered by our risk committee working group which identifies, assesses and makes related recommendations for managing a number of risks, including cybersecurity threats. This working group is charged with addressing the full spectrum of its risks and managing the potential individual as well as combined impact of those risks as an interrelated risk portfolio. Moreover, the grouping group engages subject matter experts from various departments within the Company to engage in a bi-annual exercise designed to identify potential worse case scenarios, the estimated likelihood of each, and the potential financial impact of each risk, as well as to prioritize such risks, including the risk of a cybersecurity threat.


text: Impact of Cybersecurity Events In the fourth quarter of 2024, no risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, materially affected or would reasonably be likely to materially affect Graybar, including our business strategy, results of operations or financial condition.


text: Our cybersecurity program is intended to assess, identify, and manage material risks from cybersecurity threats, including those associated with our use of third-party service providers. We integrate cybersecurity into our top-level enterprise risk management ("ERM") processes and our site-level operational risk management ("ORM") processes, including management of operational technology ("OT") cybersecurity risks. This involves, in part, direct engagement by, and consultation with, our Senior Director of Cybersecurity and IT Infrastructure ("Senior Director") during ERM and ORM risk assessments, and collaboration between the Senior Director and relevant Operations employees regarding OT cybersecurity.

companyName: Coeur Mining, Inc.

ticker: CDE


text: Our cybersecurity strategy leverages people, processes, and technology to identify and manage cybersecurity risks, including through: security monitoring; vulnerability assessments; patching and security upgrades; deployment of network defenses; regular cybersecurity trainings for users; use of third-party cybersecurity vendors to complement our internal Cybersecurity and IT Infrastructure team, including for monitoring, remediation, and response capabilities; periodic engagement of cybersecurity consultants, including for cybersecurity maturity assessments and recommendations and penetration test exercises; and periodic reviews of aspects of our cybersecurity program by our Internal Audit function.


text: We also have a Cybersecurity Incident Response Plan ("CSIRP") to provide a standardized framework for responding to cybersecurity incidents, including escalation to senior management and other key stakeholders, as appropriate. Our CSIRP is reviewed at least annually, and we conduct cybersecurity tabletop exercises to practice our response.


text: Our Senior Director leads our internal team responsible for assessing and managing cybersecurity risks. The Senior Director has approximately 10 years of experience being responsible for cybersecurity at multi-site industrial companies, in addition to IT infrastructure and strategy, and has earned the Global Information Assurance Certification ("GIAC") Defensible Security Architecture, Security Leadership and Strategic Planning, Policy and Leadership certifications, respectively. The Senior Director reports directly to the General Counsel and regularly engages with and briefs other members of senior and executive management on cybersecurity issues. A number of IT professionals with experience implementing cybersecurity defenses and responding to cyber attacks report to the Senior Director and, as noted above, the Senior Director also oversees third-party firms specializing in security monitoring and vulnerability assessment.


text: Our Board of Directors, with the assistance of the Audit Committee, to whom the Board has delegated to the primary authority and responsibility to oversee cybersecurity risks, oversee the management of risks arising from cybersecurity incidents, and, as noted above, cybersecurity is one of the material risks tracked through our ERM process. The Audit Committee is briefed quarterly by our Senior Director on cybersecurity emerging risks, strategies, key initiatives, incidents and training and compliance. Executive management and other senior leaders participate in the semi-annual updates to our ERM risk register and heat map, and those updates, which incorporate cybersecurity risk and strategy, also are presented to our Board for discussion and feedback annually. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Audit Committee Chair.


text: Despite our cybersecurity processes and risk mitigation strategies and practices, the threat landscape has become increasingly sophisticated and aggressive. While we have not experienced any material cybersecurity threats or incidents to date, there can be no assurance that a future cybersecurity incident would not have a material adverse effect on our cash flows, financial condition or results of operations. Additional information on cybersecurity risks we face can be found above under "Item 1A - Risk Factors," which should be read in conjunction with the foregoing information.


text: Our Senior Director leads our internal team responsible for assessing and managing cybersecurity risks. The Senior Director has more than 10 years of experience being responsible for cybersecurity at multi-site industrial companies, in addition to IT infrastructure and strategy, and has earned the Global Information Assurance Certification ("GIAC") Critical Controls, Defensible Security Architecture, Security Leadership, Security Operations, and Strategic Planning, Policy and Leadership certifications, as well as a Cybersecurity Management degree from the SANS Technology Institute. The Senior Director reports directly to the General Counsel and regularly engages with and briefs other members of senior and executive management on cybersecurity issues. A number of IT professionals with experience implementing cybersecurity defenses and responding to cyber attacks report to the Senior Director and, as noted above, the Senior Director also oversees third-party firms specializing in security monitoring and vulnerability assessment.


text: Our Board, with the assistance of the Audit Committee, to whom the Board has delegated to the primary authority and responsibility to oversee cybersecurity risks, oversees the management of risks arising from cybersecurity incidents, and, as noted above, cybersecurity is one of the material risks tracked through our ERM process. The Audit Committee is briefed quarterly by our Senior Director on cybersecurity emerging risks, strategies, key initiatives, incidents and training and compliance. Executive management and other senior leaders participate in the semi-annual updates to our ERM risk register and heat map, and those updates, which incorporate cybersecurity risk and strategy, also are presented to our Board for discussion and feedback at least annually. We also have protocols by which certain cybersecurity incidents that meet established reporting thresholds are escalated within the Company and, where appropriate, reported promptly to the Audit Committee Chair.


text: We design and assess our program based on the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). This does not imply that we meet any particular technical standards, specifications, or requirements, only that we use the NIST CSF as a guide to help us identify, assess, and manage the cybersecurity risks that are relevant to our business.

companyName: ITT INC.

ticker: ITT


text: Our cybersecurity risk management program is integrated into, and forms an integral part of, our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program to other legal, compliance, strategic, operational, and financial risk areas.


text: We have established a proactive approach to identify and manage material cybersecurity threats which includes, but is not limited to, the following: • Security policies and practices aligned with NIST Special Publication 800-171, Revision 2 (NIST 800-171 Rev 2) and the organization's enterprise risk management requirements; • Annual cybersecurity reporting and strategic update to ITT's Board of Directors; • Enterprise-wide centralized Security Information and Event Management (SIEM); • Regular red-team attack simulations led by industry-leading third-party cybersecurity firms; • Continuous internal and external facing vulnerability management scanning; • Threat intelligence feeds from various external sources (fee and non-fee based); • Threat hunting; • Strategically deployed artificial intelligence-based threat detection technology; • Cyber risk assessment and classification processes; • Cyber threat tabletop simulation exercises; • Cyber Incident Response Plan processes; • Externally led, targeted threat hunting exercises; • Engagement of forensic cybersecurity and data analysis firms (as needed) to conduct independent validation assessments if a breach is suspected and/or validated; • Engagements with third party consultants to build, design, and improve cyber risk management tools and processes; • Third-party technology and service provider risk evaluation process; and • Cybersecurity insurance coverage.


text: During 2023, there were no cybersecurity incidents that had a material effect on the Company. Furthermore, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us to date, including our business, business strategy, results of operations, or financial condition. For a discussion of prospective risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors.


text: Cybersecurity Governance Our Board considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit Committee oversight of cybersecurity and other information technology risks. The Audit Committee oversees management's implementation of our cybersecurity risk management program and discusses with management the Company's cybersecurity and other information technology risks, controls, and procedures.


text: The Board receives annual reports from management on our cybersecurity risks and strategic updates. These reports are designed to provide the Board a view into the progress of previous efforts, an update on existing and new material risks, and an overview of proposed or planned cybersecurity-related projects, and foster a discussion of cyber threats trending within the industry and their applicability to the organization. If a new material risk is identified, or if the Company is impacted by a material security incident, the Audit Committee and the full Board of Directors are notified and apprised of developments.


text: ITT employs a team of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Chief Information Security Officer (CISO), who altogether make up ITT's Cyber Security Operations Center (CSOC). The qualifications of our cybersecurity team include the following industry-recognized certifications: Certified Ethical Hacker (C|EH), Security+, GIAC Incident Handler Certification (GCIH), and GIAC Foundational Cybersecurity Technologies (GFACT). Additionally, our cybersecurity team possesses several Federal Emergency Management Agency (FEMA) and Department of Homeland Security (DHS) certificates pertaining to cybersecurity. The CSOC monitors the global ITT landscape for cyber threats, provides prevention strategies, initiates incident response for detected intrusions, and prescribes proactive and reactive mitigation strategies. The CSOC serves as the cornerstone for protecting, assessing, and managing cybersecurity risks for the enterprise, which includes, but is not limited to, back office processes, critical manufacturing processes, intellectual property, and sensitive data. The CISO reports to the Chief Information Officer (CIO), who in turn reports to the Chief Financial Officer (CFO). The combined expertise and qualifications of our cybersecurity team enable us to effectively monitor, assess, and respond to cybersecurity threats.


text: Management is actively informed about, and monitors, cybersecurity incidents, including their prevention, detection, mitigation, and remediation, through defined processes and reporting mechanisms. This proactive approach includes the alignment of security policies and practices with NIST 800-171 Rev 2 and the organization's enterprise risk management requirements. Twice annually, the CFO and CEO are briefed by the CISO and CIO regarding ongoing projects, investments and changes to the threat landscape that have impacted, or may impact, the organization, ensuring that the highest levels of management are kept abreast of the Company's cybersecurity posture. Overall, this comprehensive approach ensures that management is well-informed and actively involved in safeguarding the Company from cybersecurity threats.


text: We have established a proactive approach to identify and manage material cybersecurity threats which includes, but is not limited to, the following: • An end-user cybersecurity awareness program that requires annual training completion, monthly simulated phishing emails to assess user susceptibility and provide training on emerging threats, and ongoing awareness communications throughout the year to reinforce learnings and raise awareness of specific, actively exploited threat vectors; • Security policies and practices aligned with NIST Special Publication 800-171, Revision 2 (NIST 800-171 Rev 2) and the organization's enterprise risk management requirements; • Annual cybersecurity reporting and strategic update to ITT's Board of Directors; • Enterprise-wide centralized Security Information and Event Management (SIEM); • Regular red-team attack simulations led by industry-leading third-party cybersecurity firms; • Continuous internal and external facing vulnerability management scanning; • Threat intelligence feeds from various external sources (fee and non-fee based); • Threat hunting; • Strategically deployed artificial intelligence-based threat detection technology; • Cyber risk assessment and classification processes; • Cyber threat tabletop simulation exercises; • Cyber Incident Response Plan processes; • Externally led, targeted threat hunting exercises; • Engagement of forensic cybersecurity and data analysis firms (as needed) to conduct independent validation assessments if a breach is suspected and/or validated; • Engagements with third party consultants to build, design, and improve cyber risk management tools and processes; • Third-party technology and service provider risk evaluation process; and • Cybersecurity insurance coverage.


text: During 2024, there were no cybersecurity incidents that had a material effect on the Company. Furthermore, we have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us to date, including our business, business strategy, results of operations, or financial condition. For a discussion of prospective risks related to potential cybersecurity incidents, please refer to Item 1A, Risk Factors.


text: ITT employs a team of certified cybersecurity professionals responsible for assessing and managing cybersecurity risks, led by the Chief Information Security Officer (CISO), who altogether make up ITT's Cyber Security Operations Center (CSOC). The qualifications of our cybersecurity team include the following industry-recognized certifications: ISC2 Certified Information Systems Security Professional (CISSP), Certified Cloud Security Professional (CCSP), Certified Ethical Hacker (C|EH), Security+, and IAPP Certified Information Privacy Professional (CIPP/US). Additionally, our cybersecurity team possesses several certifications from the SANS Institute's Global Information Assurance Certification (GIAC) program, the top cybersecurity accreditation body in the world. These include GIAC Incident Handler Certification (GCIH), GIAC Certified Systems and Network Auditor (GSNA), GIAC Foundational Cybersecurity Technologies (GFACT) and others. The CSOC monitors the global ITT landscape for cyber threats, provides prevention strategies, initiates incident response for detected intrusions, and prescribes proactive and reactive mitigation strategies. The CSOC serves as the cornerstone for protecting, assessing, and managing cybersecurity risks for the enterprise, which includes, but is not limited to, back-office processes, critical manufacturing processes, intellectual property, and sensitive data. The CISO reports to the Chief Information Officer (CIO), who in turn reports to the Chief Financial Officer (CFO). The CIO has over 21 years of experience in information technology, including 14 years at ITT, while the CISO brings over 28 years of experience in information technology, with the last 22 years focused on information security and cybersecurity across various industries. The combined expertise and qualifications of our cybersecurity team enable us to effectively monitor, assess, and respond to cybersecurity threats.


text: Our IT and related systems are critical to the efficient operation of our business and essential to our ability to perform day to day processes. We face persistent security threats, including threats to our IT infrastructure and unlawful attempts to gain access to our confidential, classified or otherwise proprietary information, or that of our employees or customers, via phishing/malware campaigns and other cyberattack methods.

companyName: TEXTRON INC

ticker: TXT


text: Our centrally defined security policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We monitor compliance with these policies and processes through frequent internal audits and a set of robust metrics that assist in protection of our environment. As a U.S. defense contractor, we are additionally obligated to comply with current Department of Defense regulations such as Defense Federal Acquisition Regulation Supplement and the evolving Cybersecurity Maturity Model Certification guidelines.


text: We maintain Information Systems Incident Management Standards applicable to all our businesses that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our disclosure controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition.


text: Board Oversight of Cybersecurity Matters Oversight of information security matters is conducted by our full Board of Directors. The Board annually receives a comprehensive presentation on information security and controls from our Chief Information Officer (CIO) and, as may be necessary for specific topics, follow up occurs at additional meetings during the course of the year.


text: Management of Cybersecurity Risks Textron Information Services is led by our CIO who has held positions of increasing responsibility within our corporate, Bell and Textron Systems IT organizations since 2008, including leading the IT organizations at both segments in maintaining compliance with U.S. Department of Defense information security requirements, as well as with our enterprise information security policies and standards. He previously led strategic IT projects and teams responsible for delivering global IT solutions for several large U.S. based companies.


text: Our corporate information security organization, led by our Chief Information Security Officer (CISO), who reports to our CIO, is responsible for our overall information security strategy, policy, security engineering, operations and cyber threat detection and response. Our CISO has more than 20 years of experience in the field of information security and holds multiple cybersecurity certifications including the designation of Certified Information Systems Security Professional.


text: Cybersecurity related risks have been identified as material business risks, and identifying, assessing and managing these risks is integrated into our Enterprise Risk Management (ERM) process, which is designed to identify, assess and guide in managing material risks throughout Textron at both the business segment and enterprise levels. We maintain cyber risk/network protection mitigation plans through our ERM process to assist in management of these risks. Our full Board oversees our ERM process through discussions at our Board of Directors' Annual Strategic Business and Risk Review and at an annual dedicated ERM Review. In addition, high risk areas, including cybersecurity matters, are reviewed and discussed with the full Board or other Board Committees, as appropriate. The Audit Committee, as reflected in its charter, has been designated to assist the Board in its oversight of our ERM process, including with respect to cybersecurity risk.


text: We maintain a detailed Cybersecurity Incident Response Plan that guides our incident response process. Upon the occurrence of a cybersecurity event, the cyber incident response team will follow a predefined process, documenting each step taken, to analyze and validate the event, and, if a cybersecurity incident is suspected to have occurred, quickly perform an initial analysis to determine the incident's scope. The team will prioritize the response to each incident based on its estimate of the business impact caused by the incident and the estimated efforts required to recover from the incident. Notification of the incident is made to various stakeholders, including senior management and, if appropriate based upon the incident severity assessment, our Board. The team will also conduct incident containment, eradication and recovery, and post incident activity.


text: Our Security Culture We protect our information assets and manage risk by promoting a culture that communicates security risks, designs secure IT systems and operates according to approved processes to reduce the likelihood and impact of security incidents. We achieve this objective by: • Designing, implementing and maintaining solutions with appropriate security controls. • Sustaining solutions with required patching and vulnerability remediation. • Creating and executing controls in support of policy as well as regulatory compliance. • Ensuring that our policies, processes, practices and technologies proactively protect, shield, defend and remediate cyber threats. • Delivering quality communications and annual training to stakeholders on cyber awareness and computing hygiene.


text: We believe that the conduct of our employees is critical to the success of our information security. Through our security awareness program, we keep our employees apprised of threats, risks and the part that they play in protecting both themselves and the company. We conduct periodic compliance training for our employees regarding the protection of sensitive information, which includes training intended to prevent the success of cyberattacks. We also conduct regular phishing simulations to increase employee awareness on how to spot phishing attempts, and what to do if they suspect an email to be a phishing attack.


text: We execute penetration testing against our technical environment and processes, and continuously monitor our network and systems for signs of intrusion. We also retain consultants to enhance our penetration testing program with current trends and methodologies utilized against other companies, ensuring we are proactively reducing risk from emerging threats. These penetration tests are conducted at a random interval and target our infrastructure and certain of the products we deliver to our customers.


text: We have a rigorous process, including a formal IT risk assessment, to assess our service providers prior to allowing our information to be processed, stored or transmitted by third parties, and we include standardized contractual requirements in each contract where appropriate. We validate our service providers' security via questionnaires, open-source intelligence and, where appropriate, SOC1 reports on financially significant third-party service providers. Our process also includes regular monitoring of risk related to third parties on a periodic basis or when services or product purchases expand beyond their original scope or intended use.


text: Protections against insider threat is a critical component of our security strategy, particularly within our defense business units. Our insider threat detection processes are designed to identify and evaluate potential insider threats so that appropriate mitigation can be implemented.


text: Collaboration with our industry partners and government customers contributes to the protection of Textron's computing environment as well as our military stakeholders. Textron is engaged with various industry groups such as Aerospace Industries Association, National Defense Information Sharing & Analysis Center and our Defense Industrial Base colleagues to ensure that we are aware of and are addressing the latest adversarial threats. Additionally, we share cyber best practices with industry peers to help to make the industry more secure.


text: Our centrally defined cybersecurity policies and processes are based on industry best practices and are revisited regularly to ensure their appropriateness based on risk, threats and current technological capabilities. We use a multi-layered approach to security with processes and tools aligned with the National Institute of Standards and Technology Cybersecurity Framework. We monitor compliance with these policies and processes through frequent internal audits and a set of robust metrics that assist in protection of our environment. As a U.S. defense contractor, we are required to comply with extensive regulations, including requirements imposed by the Defense Federal Acquisition Regulation Supplement related to adequately safeguarding controlled unclassified information (CUI) and reporting cybersecurity incidents to the U.S. Department of Defense (DoD). We will also be required to achieve Cybersecurity Maturity Model Certification which will certify our compliance with the federally mandated CUI program.


text: We maintain Information Systems Incident Management Standards applicable to all our businesses that are intended to ensure information security events and weaknesses associated with information systems are communicated and acted on in a timely manner. Our disclosure controls and procedures address cybersecurity and include processes intended to ensure that security breaches are reported to appropriate personnel and, if warranted, analyzed for potential disclosure. While we have experienced cybersecurity attacks, such attacks to date have not materially affected the Company or our business strategy, results of operations, or financial condition. For more information regarding the risks we face from cybersecurity threats, see Item 1A. Risk Factors.


text: Management of Cybersecurity Risks Textron Information Services is led by our CIO who has held positions of increasing responsibility within our corporate, Bell and Textron Systems IT organizations since 2008, including leading the IT organizations at both segments in maintaining compliance with the DoD information security requirements, as well as with our enterprise information security policies and standards. He previously led strategic IT projects and teams responsible for delivering global IT solutions for several large U.S. based companies.


text: We believe that the conduct of our employees is critical to the success of our information security. Through our security awareness program, we keep our employees apprised of threats, risks and the part that they play in protecting both themselves and the company. We conduct periodic compliance training for our employees regarding the protection of sensitive information, which includes mandatory annual cyber safety training for all users with access to our computer network intended to reduce the likelihood of success of cyberattacks which target our employees. We also conduct regular phishing simulations to increase employee awareness on how to spot phishing attempts, and what to do if they suspect an email to be a phishing attack.


text: We execute penetration testing against our technical environment and processes, and continuously monitor our network and systems for signs of intrusion. We also retain consultants to enhance our penetration testing program with current trends and methodologies utilized against other companies, ensuring we are proactively reducing risk from emerging threats. In addition, we conduct tabletop exercises to prepare for responding to potential cybersecurity events.


text: Risk Management and Strategy Our business heavily relies on various IT and application systems that contain proprietary and confidential information about our operations, employees, agents, claimants, customers, and their employees and property, including personally identifiable information. These systems are connected to and/or accessed from the Internet, making them susceptible to cyber-attacks. A cyber-attack on our systems, distribution partners and their key operating systems, or any other third-party partners or vendors and their key operating systems may materially affect us. Potential impacts include prolonged interruption of our business operations, reputational harm, or substantial monetary damages. For a detailed description of the risks related to cybersecurity, refer to the "Risks Related to our General Operations" section in Item 1A. "Risk Factors." of this Form 10-K.

companyName: SELECTIVE INSURANCE GROUP INC

ticker: SIGI


text: We have a dedicated unit, led by the Senior Vice President ("SVP") of Enterprise Strategy and Execution, to implement cybersecurity controls, assess and report on cybersecurity risks, and consult with our ERM unit, which is responsible for identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.


text: We work with industry-leading security consulting and technology partners and employ a "defense-in-depth" approach that uses multiple security measures to protect the integrity of our proprietary and confidential information. This approach aligns with the National Institute of Standards and Technology Cyber Security Framework and provides preventative, detective, and responsive measures to identify and manage risks. We periodically review our strategy and modify its implementation based on threat trends, program maturity, the results of assessments, and the advice of third-party security consultants. We have documented policies, procedures, and guidelines related to information security, known as our "Written Information Security Program." Our program (i) balances responsiveness to rapidly changing threats with ensuring our IT security environment's sustainability and overall effectiveness and (ii) is reasonably likely to defend against risks of cybersecurity threats that would have a material impact on our business strategy, results of operations, or financial condition. This program focuses on the following six key areas used to monitor various IT performance and security metrics: • Proactive cybersecurity processes, including vulnerability scanning, penetration testing, and periodic program assessments by outside security consultants and assessors; • Reactive cybersecurity processes that we regularly evaluate using incident response and disaster recovery exercises based on realistic scenarios; • Endpoint technology that includes encryption, threat management, monitoring, investigation support, and backups; • Identity and access management controls that often include multi-factor authentication and additional safeguards for staff granted elevated privileges; • Employee cyber risk awareness and training that covers cybersecurity threats and actions to prevent or report attacks; and • Third-party risk management and security standards, including due diligence, continuous monitoring, cyber risk scoring, and contractual obligations. We review third-party control environments when possible and practical, aligning the risk exposure with our business requirements and risk tolerances.


text: Board Governance and Management The Executive Vice President ("EVP") & Chief Information Officer ("CIO") and the SVP of Enterprise Strategy and Execution provide quarterly written and in-person updates on the strength of our cyber risk control environment, emerging cyber threat issues, and the results of external assessments by outside security consultants and assessors to the Board's Audit Committee, which was responsible for the oversight of our ERM process in 2023. Effective January 1, 2024, the Board created a Risk Committee responsible for oversight of our ERM framework and practices, and to assist the Board in overseeing our operational activities and identifying and reviewing related risks, including our cyber risks and strategy.


text: In addition, the cybersecurity team, managed by the SVP of Enterprise Strategy and Execution, receives oversight and executive support through engagement with our ERC. The ERC is responsible for the holistic evaluation, management, and supervision of our aggregate risk profile. Similarly, the team works with our ERM function on business alignment and procuring cybersecurity insurance.


text: The following describes the expertise of key members of management and our committees who are responsible for assessing, managing, and presenting quarterly updates to the Board's Risk Committee about our cybersecurity risks: • John Bresney, EVP & CIO, reports directly to our Chief Executive Officer and is responsible for all of our IT operations, including oversight of the SVP of Enterprise Strategy and Execution's implementation of our cybersecurity program and enforcement of our cybersecurity policies. We have employed him for approximately 30 years, and he has held various technology and information security roles of increasing responsibility. He has a bachelor's degree in information systems and business, a Master's Certificate in Project Management, and a Columbia University CIO Program Certificate. • Robert McKenna, SVP of Enterprise Strategy and Execution, reports to our CIO and leads the implementation of our cybersecurity program, enforcement of our cybersecurity policies, technology planning, projects driving IT strategy, and enterprise IT risk management. He also oversees cybersecurity incidents under our Security Incident Response Plan ("IRP"). We have employed him for approximately 21 years in related positions of increasing responsibility. He has over 27 years of technology and information security experience. He has a master's degree in business administration, a Certificate in Project Management, and is a Certified Insurance Counselor. • Christopher Cunniff, SVP and CRO, reports formally to the Chief Financial Officer and on an interim-basis to our Chief Executive Officer, leads our Reinsurance and ERM teams, and chairs the ERC and the Emerging Risk Committee. We have employed him for approximately six years, and he previously was our SVP of Actuarial Reserving. He has over 32 years of insurance industry experience, serving in various key leadership positions. He has a bachelor's degree in mathematics, is a fellow of the Casualty Actuarial Society, and is a member of the American Academy of Actuaries.


text: Our IRP describes the circumstances that require internal and external notifications of cybersecurity incidents that (i) relate to any of our computer systems or networks and compromise the confidentiality, integrity, or availability of the systems or networks, (ii) compromise the confidentiality, integrity, or availability of any sensitive data that belongs to us or a third party and is in our care or custody, or (iii) involve one or more third parties with whom we share sensitive data. It describes the (i) involvement of the SVP of Enterprise Strategy and Execution, (ii) escalation process of such incidents to senior management, including the General Counsel, CIO, Chief Financial Officer, CRO, and Chief Executive Officer, (iii) reporting process to the Risk Committee and Board, and (iv) the notification and disclosure process to customers, distribution partners, regulators, and the SEC. The IRP also provides guidance on how to evaluate potential cyber events and suspicious cyber occurrences. We engage outside legal counsel and technical experts to regularly review the IRP and use internal teams and outside advisors with specialized skills to support the response and recovery efforts of proprietary and confidential information.


text: For additional information on our overall corporate governance structure and internal process of assessing our other significant risks, see the "Corporate Governance, Sustainability and Social Responsibility" section in Item 1. "Business." of this Form 10-K.


text: We have a dedicated unit, led by the Senior Vice President ("SVP") of IT Enterprise Strategy and Execution, to implement cybersecurity controls, assess and report on cybersecurity risks, and consult with our ERM unit, which is responsible for identifying, measuring, monitoring, and reporting on key enterprise-wide risks, including cybersecurity risks.


text: We work with industry-leading security consulting and technology partners and employ a "defense-in-depth" approach that uses multiple security measures to protect the integrity of our proprietary and confidential information. This approach aligns with the National Institute of Standards and Technology Cyber Security Framework and provides preventative, detective, and responsive measures to identify and manage risks. We periodically review our strategy and modify its implementation based on threat trends, program maturity, assessment results, and the advice of third-party security consultants. We have documented information security policies, procedures, and guidelines, known as our "Written Information Security Program." Our program (i) balances responsiveness to rapidly changing threats with ensuring our IT security environment's sustainability and overall effectiveness and (ii) is reasonably likely to defend against risks of cybersecurity threats that would have a material impact on our business strategy, results of operations, or financial condition. This program focuses on the following six key areas to monitor various IT performance and security metrics: • Proactive cybersecurity processes, including vulnerability scanning, penetration testing, and periodic program assessments by outside security consultants and assessors; • Reactive cybersecurity processes that we regularly evaluate using incident response and disaster recovery exercises based on realistic scenarios; • Endpoint technology that includes encryption, threat management, monitoring, investigation support, and backups; • Identity and access management controls that often include multi-factor authentication and additional safeguards for staff granted elevated privileges; • Employee cyber risk awareness, training, and testing that covers cybersecurity threats and actions to prevent or report attacks; and • Third-party risk management and security standards, including due diligence, continuous monitoring, cyber risk scoring, and contractual obligations. We review third-party control environments when possible and practical, aligning the risk exposure with our business requirements and risk tolerances.


text: Board Governance and Management The Executive Vice President ("EVP") & Chief Information Officer ("CIO") and the SVP of Enterprise Strategy and Execution provide quarterly written and in-person updates on the strength of our cyber risk control environment, emerging cyber threat issues, and the results of external assessments by outside security consultants and assessors to the Board's Risk Committee. The Board's Risk Committee oversees our ERM framework and practices and assists the Board in overseeing our operational activities, including the Company's information technology security program, and identifying and reviewing related risks.


text: The cybersecurity team, managed by the SVP of IT Enterprise Strategy and Execution, (i) receives oversight and executive support through engagement with our ERC, which is responsible for the holistic evaluation, management, and supervision of our aggregate risk profile and (ii) collaborates with our ERM function on business alignment and cybersecurity insurance procurement.


text: The expertise of key members of management and our committees responsible for assessing, managing, and presenting quarterly updates to the Board's Risk Committee about our cybersecurity risks is summarized as follows: • John Bresney, EVP & CIO, reports directly to our Chief Executive Officer and is responsible for all of our IT operations, including oversight of the SVP of Enterprise Strategy and Execution's implementation of our cybersecurity program and enforcement of our cybersecurity policies. He has worked for us for approximately 31 years, holding various technology and information security roles of increasing responsibility. He has a bachelor's degree in information systems and business, a Master's Certificate in Project Management, and a Columbia University CIO Program Certificate. • Robert McKenna, SVP of Enterprise Strategy and Execution, reports to our CIO and leads the implementation of our cybersecurity program, enforcement of our cybersecurity policies, technology planning, projects driving IT strategy, and enterprise IT risk management. He also oversees cybersecurity incidents under our Security Incident Response Plan ("IRP"). He has worked for us for approximately 22 years in related positions of increasing responsibility and has over 28 years of technology and information security experience. He has a master's degree in business administration, a Certificate in Project Management, and is a Certified Insurance Counselor. • Christopher Cunniff, SVP and CRO, reports to our Chief Financial Officer, leads our Reinsurance and ERM teams, and chairs the ERC and the Market Security Committee. He has worked for us for approximately seven years, and he previously was our SVP of Actuarial Reserving. He has over 33 years of insurance industry experience, serving in various key leadership positions. He has a bachelor's degree in mathematics, is a fellow of the Casualty Actuarial Society, and is a member of the American Academy of Actuaries.


text: The Company does not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. However, the Company could face risks from cybersecurity threats in the future that could have a material adverse effect on its business strategy, results of operations, or financial condition. For more information on the Company's cybersecurity-related risks, see Item 1A, Risk Factors of this Form 10-K.

companyName: FEDERAL SIGNAL CORP /DE/

ticker: FSS


text: Risk Management and Strategy The Company's processes for identifying, assessing, and managing material cybersecurity risks are incorporated into its overall Enterprise Risk Management process. The Company maintains a comprehensive cybersecurity risk management program, overseen by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), to support the security, confidentiality, integrity and availability of its critical information technology ("IT") systems and information.


text: The Company conducts internal risk assessments, with the assistance of independent third parties, against standards including the National Institute of Standards and Technology Cybersecurity Framework. The assessment results are used to develop responsive cybersecurity controls and risk mitigation strategies. The Company's cybersecurity risk management program provides the structure for managing the respective risks through the use of a combination of automated tools, technologies and third-party monitoring, as well as ongoing employee education via cybersecurity training and security awareness communications.


text: The Company's cybersecurity risk management program includes an incident response plan, which provides a documented framework to support the timely and effective resolution of actual or attempted cybersecurity incidents. Cybersecurity incidents across the Company, and relevant third-party service providers, are tracked and significant incidents, as applicable, are promptly escalated to a cross-functional cybersecurity task force so that decisions regarding public disclosure can be made in a timely manner by management and the Board of Directors.


text: The Company's Internal Audit function performs audits to evaluate and report on compliance with cybersecurity policies and procedures, reviews internal control certifications from relevant third-party service providers, and tests IT system and network controls as part of its annual assessment of the effectiveness of the Company's internal controls. Additionally, the Company engages third-party specialists to conduct periodic tests, incident simulations and assessments to verify and continuously enhance its cybersecurity risk management program.


text: The Board of Directors has overall responsibility for the oversight of risk management, and has delegated oversight of cybersecurity risk management to the Audit Committee. The Company's CIO and CISO regularly report to the Audit Committee on cybersecurity risks, updates on key initiatives and progress toward the Company's objectives. In addition, the CIO provides updates to the Board of Directors, at least annually, on the Company's broader IT strategy and key initiatives.


text: The CIO and CISO have primary responsibility over the Company's cybersecurity risk management program. Quarterly updates are provided to the Company's IT Council, comprised of executive, business unit and IT leaders from across the organization, regarding IT initiatives and risk management processes.


text: The Company does not believe that there are currently any known risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company's business strategy, results of operations, or financial condition. However, the Company could face risks from cybersecurity threats in the future that could have a material adverse effect on its business strategy, results of operations, or financial condition. For more information on the Company's cybersecurity-related risks, see Item 1A, Risk Factors, of this Form 10-K.


text: Risk Management and Strategy The Company's processes for identifying, assessing, and managing material cybersecurity risks are incorporated into its overall Enterprise Risk Management process. The Company maintains a comprehensive cybersecurity risk management program, overseen by the Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO"), to support the security, confidentiality, integrity, and availability of its critical IT systems and information.


text: The Company conducts internal risk assessments, with the assistance of independent third parties, against standards including the National Institute of Standards and Technology Cybersecurity Framework. The assessment results are used to develop responsive cybersecurity controls and risk mitigation strategies. The Company's cybersecurity risk management program provides the structure for managing the respective risks through the use of a combination of automated tools, technologies, and third-party monitoring, as well as ongoing employee education via cybersecurity training and security awareness communications.


text: The Company's cybersecurity risk management program includes an incident response plan, which provides a documented framework to support the timely and effective resolution of actual or attempted cybersecurity incidents. Cybersecurity incidents across the Company, and relevant third-party service providers, are tracked and significant incidents, as applicable, are promptly escalated to a cross-functional cybersecurity task force so that decisions regarding public disclosure can be made in a timely manner by management and the Board.


text: The Company's Internal Audit function performs audits to evaluate and report on compliance with cybersecurity policies and procedures, reviews internal control certifications from relevant third-party service providers, and tests IT system and network controls as part of its annual assessment of the effectiveness of the Company's internal controls. Additionally, the Company engages third-party specialists to conduct periodic tests, incident simulations, and assessments to verify and continuously enhance its cybersecurity risk management program.


text: The Board has overall responsibility for the oversight of risk management and has delegated oversight of cybersecurity risk management to the Audit Committee. The Company's CIO and CISO regularly report to the Audit Committee on cybersecurity risks, updates on key initiatives, and progress toward the Company's objectives. In addition, the CIO provides updates to the Board, at least annually, on the Company's broader IT strategy and key initiatives.


text: The CIO and CISO have primary responsibility over the Company's cybersecurity risk management program. Quarterly updates are provided to the Company's IT Council, which is comprised of executive, business unit, and IT leaders from across the organization, regarding IT initiatives and risk management processes.


text: Cybersecurity is an integral part of our overall enterprise risk analysis and discussions. We recognize the critical importance of assessing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the integrity, confidentiality, and availability of our company, customer, and employee data.

companyName: DAVEY TREE EXPERT CO


text: Our cybersecurity program draws from the recognized framework established by the National Institute of Standards and Technology and focuses on five key pillars of threat mitigation, which consist of identification, protection, detection, response, and recovery. We deploy various tools to address these areas, including robust password requirements, firewalls, limiting access to sensitive information, multi-factor authentication requirements, and anti-malware, intrusion prevention and detection systems. We periodically review and update Davey's policies, standards, processes, and procedures regarding cybersecurity threats and incidents, including by assessing current threat intelligence, conducting tabletop exercises, and performing vulnerability and security testing. Recognizing the complexity and evolving nature of cyberattacks, we also engage with a range of third-party experts to help identify and manage cybersecurity risk, including monitoring and evaluating traffic on our network, assisting with penetration testing and tabletop exercises, and consulting on best practices.


text: Davey Tree also uses third-party service providers to support its business operations and many of its technology platforms and is aware of risks associated with using such services. We periodically monitor and assess third-party service providers from a cybersecurity risk perspective and continuously seek to enhance our third-party risk management program.


text: Awareness and Training All Davey employees are offered multiple security awareness training opportunities throughout the year, including at the time of hire. The training is further supplemented by periodic phishing simulations as an interactive way to engage and train employees to help identify potential cybersecurity risks and further build threat resilience. Additionally, we provide specialized security training for certain employee roles such as application developers. Improper or illegitimate use of Davey's information system resources or violation of our information security policies and procedures may result in disciplinary action, including up to termination.


text: Cybersecurity Incident Response Plan A detailed Cybersecurity Incident Response Plan ("CIRP") is maintained and practiced at least annually. The CIRP provides organizational and operational structures, processes, and procedures designed to identify key incident response stakeholders, and allow our personnel to properly respond to material incidents that may affect the function and security of information technology assets, information resources, and business operations. We have a designated incident response team in place to carry out the CIRP, which consists of core members from our information technology group and an extended team consisting of key personnel from areas such as Legal, Finance, Human Resources and Public Relations that we can engage as deemed necessary, as well as third-party experts.


text: Risks from Cybersecurity Threats We face a number of cybersecurity risks in connection with our business and have, from time to time, experienced external threats seeking to compromise the security, confidentiality, or integrity of our data and systems, including malware and computer virus attacks. However, as of the date of this report, Davey Tree is not aware of any such risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition.


text: Management's Role A dedicated team of information technology leaders, led by our Chief Information Officer ("CIO"), plays a pivotal role in managing our enterprise-wide cybersecurity strategy, policies, standards, architecture, and processes, with a continuous focus on improvement. These individuals collectively have decades of experience managing the computing environment and have obtained various professional security certifications and advanced training in the field of cybersecurity and technology.


text: The CIO provides regular updates to the Chief Executive Officer ("CEO") and Chief Financial Officer ("CFO"), as well as other members of Davey's executive leadership team, as deemed necessary, on matters relating to cybersecurity. In addition to scheduled briefings, the CIO maintains an ongoing dialogue with our executive leadership team regarding emerging or potential cybersecurity risks.


text: Board of Directors Oversight The Board of Directors ("the Board") is acutely aware of the critical nature of managing risks related to cybersecurity threats. The CEO, CFO or CIO periodically briefs the Board on Davey Tree's cyber risks and threats, the status of projects to strengthen our information security systems, assessments of the information security program, and the emerging threat landscape, ensuring the Board has comprehensive oversight and can provide guidance on critical cybersecurity matters.


text: The Board recognizes its responsibility to oversee risk management. As part of this responsibility, the Board requires management to perform an overall assessment of risk annually. This enterprise-wide risk management assessment is designed to review and identify potential events that may affect us, including cybersecurity risks, manage risks within our risk profile and provide reasonable assurance regarding the achievement of our objectives. The Audit Committee has the responsibility of reviewing the enterprise-wide risk assessment and discusses with management our major financial risk exposures and the steps management has taken to monitor and control such exposures, including our financial risk assessment and risk management policies.


text: Risks from Cybersecurity Threats We face a number of cybersecurity risks in connection with our business and have, from time to time, experienced external threats seeking to compromise the security, confidentiality, or integrity of our data and systems, including malware and computer virus attacks. As of the date of this report, Davey Tree is not aware of any such risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect the Company, including our business strategy, results of operations, or financial condition. However, there can be no assurance that the Company, or its third-party service providers, will not experience a cybersecurity threat or incident in the future that could materially adversely affect the Company, including its business strategy, results of operations, or financial condition. For further discussion of the risks related to cybersecurity, see the risk factors discussed under Item 1A. "Risk Factors" in this Form 10-K.


text: Cybersecurity Risk Management and Strategy Strong performance and reliability of the Company's technology systems are critical to operating safely and effectively, and protecting personal and customer data is essential to maintaining stakeholder trust. The Company has implemented processes designed to assess, identify, and manage material cybersecurity risks, as described further below. CSX maintains a cybersecurity framework that is integrated across the organization through people, processes and technology to help protect the personal information of its customers, its contractors and its suppliers as well as protect the integrity of its own operations. Cybersecurity is also integrated into the Company's Enterprise Risk Management ("ERM") program. The Company equips CSX systems with various cybersecurity tools, conducts vulnerability scans and provides critical cybersecurity information to application users, as appropriate. The Company also takes proactive measures to advise CSX employees of how they can assist the Company in its cybersecurity practices. CSX informs employees on cybersecurity best practices, including how to identify cyber-related suspicious activity, how to report such activity and, as appropriate, proactive measures employees can take to safeguard company information and devices. The Company also provides cybersecurity awareness training to employees and conducts cybersecurity testing exercises to help maintain cybersecurity vigilance. With the assistance of third-party consultants, the Company conducts an annual cybersecurity exercise, which is often a "tabletop" scenario involving a cross-functional group responding to a hypothetical cybersecurity threat.

companyName: CSX CORP

ticker: CSX


text: The Company considers its material cybersecurity-related risks, as described in more detail below and at Item 1A. Risk Factors, and applies various frameworks to establish controls that are reasonably designed to identify, protect, detect, respond to, and recover from significant cybersecurity incidents. The Company also tests its cybersecurity program to assess whether enhancements to cybersecurity measures are appropriate, such as additional detection and prevention capabilities. These tests may include the use of internal or third-party external risk assessments, and penetration testing. The Company also conducts periodic cybersecurity assessments, as appropriate, pursuant to its annual risk assessment process. Third party resources may also be used for these assessments.


text: As part of its cybersecurity program, CSX partners with a third-party to provide a managed service that is designed to enable continuous monitoring at its Security Operation Center ("SOC"). The SOC has established processes to identify, address, and remediate cybersecurity threats or vulnerabilities. This includes the engagement, where necessary, of third-party experts, advisors, and other cybersecurity professionals that have been retained by the Company to assist in responding to cybersecurity incidents or threats. Company processes also include various procedures for notifying members of the company's cybersecurity department, Chief Information Security Officer ("CISO"), legal department, accounting department, and others as applicable.


text: The Company has processes designed to provide reasonable oversight for the identification of cybersecurity risks associated with certain third-party service providers. As appropriate, the Company requires certain third-party providers to complete a cybersecurity questionnaire, to provide Service Organization Control assessment results, if such results exist, or to agree to contractual language regarding cybersecurity and incident notification obligations in agreements with the company. CSX also has processes that help monitor risks associated with its key third-party vendors' technology systems, including, where appropriate, performing security assessments of cyber incidents through dashboard alerting for reported events. CSX's internal cybersecurity processes and disclosure protocols consider cybersecurity incidents involving key applications provided by third-parties.