text: Incident Response The Southern Company system has adopted a CIRP that applies in the event of certain cybersecurity threats or incidents to provide a standardized guide for responding to security incidents. The CIRP sets out a coordinated approach to investigating, containing, documenting, and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. In general, the incident response process follows the National Institute of Standards and Technology guidance and focuses on four phases: preparation; detection and analysis; containment, eradication, and recovery; and post-incident remediation. The CIRP is reviewed periodically to help ensure its applicability to any changing needs or circumstances and to provide users a tactical tool to effectively respond to incidents. The CIRP applies to all Southern Company system personnel (including third-party contractors, vendors, and partners) that perform functions or services requiring access to secure Southern Company system information and to all devices and network services that are owned or managed by the Southern Company system. A full tabletop exercise is performed at least annually, including stakeholders from business units beyond technology security, such as power delivery, legal, compliance, risk management, and corporate communications. In addition, the Southern Company system participates in sector-level and cross-sector exercises led by industry or the U.S. government. In the event of an incident, the technology security organization, the legal organization, and other stakeholders frequently review lessons learned after an incident has been remediated.


text: Material Cybersecurity Risks, Threats, and Incidents Due to evolving cybersecurity threats, it has and will continue to be difficult to prevent, detect, mitigate, and remediate cybersecurity incidents. Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Southern Company system, including its business strategy, results of operations, or financial condition. While the Southern Company system has not experienced any material cybersecurity incidents, there can be no guarantee that it will not be the subject of future successful attacks, threats, or incidents. Additional information on cybersecurity risks can be found in Item 1A "Risk Factors" of this Form 10-K which should be read in conjunction with the foregoing information.

companyName: SOUTHERN CO GAS

secItem: Item 1C


text: Refer to the Risk Management section of MD&A for a discussion of cybersecurity risk, which is incorporated by reference into this item.

companyName: TRUIST FINANCIAL CORP

ticker: TFC


text: The following is a discussion of Truist's cybersecurity risk management strategy and governance. Refer to the "Risk Management" section of Part II, Item 7 for additional discussion.


text: Cybersecurity risk management and strategy Like other financial services firms, Truist faces an increasingly complex and evolving cybersecurity threat environment. See Item 1A, "Risk Factors" for information on risks from cybersecurity threats. We maintain a risk-based cybersecurity framework that is part of our ERM Framework. It is implemented through people, processes, and technology, whereby we assess, identify, and manage material risks from cybersecurity threats, and seek to adapt our risk mitigation activities accordingly.


text: Foundationally, our cybersecurity framework is based upon the National Institute of Standards and Technology for Improving Critical Infrastructure Cybersecurity and is also designed to incorporate elements from additional industry standards, such as those of the Federal Financial Institutions Examination Council, to better suit the Company's cyber risk profile. In addition, our cybersecurity framework incorporates internal and third-party capabilities that drive the development and implementation of our data security strategy, which is designed to reduce cybersecurity risk while enabling Truist's corporate business objectives.


text: Processes for assessing, identifying, and managing material risks from cybersecurity threats We maintain an Information Security Program that specifies how we execute our cybersecurity framework. The Information Security Program is designed to assess, identify, and manage risks arising from the cybersecurity threats facing Truist. Truist maintains cybersecurity and information security policies, procedures, and technologies that are intended to protect our clients', teammates' and our own data against unauthorized disclosure, modification, and misuse. These policies, procedures, and technologies cover a broad range of areas, including identification of internal and external threats, access control, data security, protective controls, detection of malicious or unauthorized activity, incident response, and recovery planning. For example, to further mitigate the risks presented by an evolving cyber threat landscape, Truist: • provides data protection guidance to clients; • promotes data protection awareness and accountability through mandatory teammate training; and • conducts scenario-driven test exercises simulating impacts and consequences developed through analysis of real-world incidents as well as known and anticipated cyber threats. These exercises are designed to assess the viability of Truist's crisis response and management programs and provide the basis for improvement.


text: In addition, as a key part of the Company's Information Security Program, Truist participates in the federally recognized Financial Services Information Sharing and Analysis Center, as well as other industry organizations and initiatives that promote industry best practices, such as harmonized cybersecurity standards, cyber readiness, and secure consumer financial data sharing.


text: Our Cyber Incident Response Team is responsible for identifying, triaging, and containing cybersecurity threats and incidents, including, to the extent possible, those experienced by third-party service providers. Incidents with potential for higher impacts are routed to an enterprise response function that coordinates the response activities across impacted resource groups and business stakeholders. Through this structure, Truist manages its cyber, business, and legal obligations, including escalation to executive management and the Board, as appropriate, client and regulatory notifications, and remediation activities.


text: Our Information Security Program is also designed to help oversee, identify, and mitigate cybersecurity risks associated with our use of third-party service providers. Following an initial assessment of the level of enterprise risk potentially posed by use of the third party, the service provider is then subject to further risk-based assessments on its operational resilience and cybersecurity practices, including disaster recovery and business continuity plans that specify the time frame to resume activities and recover data. In its agreements with third-party service providers, Truist requires service providers to adhere to Truist's relevant cybersecurity and operational resilience standards, subject to certain exceptions that are managed on a case-by-case basis.


text: Our Information Security Program is assessed periodically to test the effectiveness of key controls through cybersecurity maturity measurements, technology risk oversight, compliance risk management testing and monitoring, internal audit review, and regulatory oversight. In addition, Truist maintains disaster recovery plans that are reviewed, modified, and approved annually.


text: Truist Financial Corporation 41 Management's role in assessing and managing material risks from cybersecurity threats Truist's Information Security Program is operated and maintained by management, including the CIO, interim CISO, and CRO. These senior officers are responsible for assessing and managing Truist's cybersecurity risks. Our Information Security Program also includes processes for escalating and considering the materiality of incidents that impact Truist, including escalation to executive management and the Board, which are periodically tested through tabletop exercises to assess Truist's preparedness. Our cybersecurity framework strategy, which is overseen by the interim CISO, is informed by various risk and control assessments, control testing, external assessments, threat intelligence, and public and private information sharing.


text: In addition, various management committees assess and manage Truist's cybersecurity risks. These committees promote visibility and awareness of cybersecurity risks and drive action and escalation as needed. The primary management committees involved in Truist's Information Security Program are the Enterprise Technology Risk Committee and the Technology Risk Oversight Committee, each of which is a sub-committee of the ERC. Truist's cybersecurity teams that implement the Information Security Program and the risk partners who oversee the program leverage these committees to report on and escalate current or emerging cybersecurity risks or other changes in the business environment which could affect Truist's risk profile or control environment.


text: As discussed in more detail in the "Risk Management" section of Part II, Item 7, the ERC is a cross-functional executive forum to promote awareness and dialogue on risk matters across the enterprise, including cybersecurity risks, oversee the execution of risk program requirements and sound risk management activities, and enact delegated decision-making authority and oversight routines from the BRC. Our CRO and CIO are members of the ERC. The interim CISO provides updates at every ERC meeting on cybersecurity and information security risk.


text: The Enterprise Technology Risk Committee provides business unit oversight of key management activities, including the Company's Information Security Program. The Technology Risk Oversight Committee provides oversight of key risk management activities to identify, assess, monitor, mitigate, and report on technology (including core technology, data and cybersecurity) risk across the enterprise. These sub-committees serve as governing forums for monitoring and escalating significant cybersecurity as well as other technology risk matters to the ERC.


text: The members of management that lead our Information Security Program and strategy have extensive experience in technology, cybersecurity, and information security. Our CRO previously served as our interim CIO and has more than 20 years of banking experience spanning a variety of roles in both the commercial and consumer segments, including credit risk, portfolio risk management, model management, acquisition integrations, technology, and vertically integrated operations for revenue producing businesses, including leading operational services across Truist for deposits, payments, credit card, capital markets, consumer and wholesale lending, fraud, and care centers across all products. Our CIO has over 25 years of experience leading technology teams at financial institutions, including in the areas of application development, infrastructure, information technology strategy, risk management, and information security. Following the departure of our CISO in November 2024, the CIO is serving as our interim CISO while our search for a permanent CISO continues. The CIO's direct reports have on average over 20 years of experience with technology management and information security at financial institutions, including in the areas of governance, operations, application and data protection, access management, and business information security.


text: Board of Directors' oversight of risks from cybersecurity threats Our Board has primary responsibility for the oversight of our enterprise risk management and exercises its oversight function in respect of cybersecurity risk through the BRC. The BRC is responsible for overseeing Truist's risk management function, including approving and reviewing Truist's risk management framework and policies, and overseeing management's implementation of such framework and policies. The oversight responsibility of our Board and the BRC is facilitated through management-reporting processes designed to provide visibility to the Board on cybersecurity matters. For example, members of the BRC receive regular reports from our CRO and interim CISO related to information technology and cybersecurity risks to Truist. The BRC meets periodically with risk management advisors and discusses with executive management any cybersecurity recommendations received. Management also discusses urgent cybersecurity developments with the Chairs of the BRC and BTC between Board and committee meetings, as appropriate. The Board annually reviews and approves our Information Security Program and Information Security Policy. Additionally, the BTC provides oversight of Truist's technology strategy, including elements of it that involve cybersecurity.


text: Truist provides ongoing development and education to its directors with respect to cybersecurity, including presentations at Board meetings on special topics, such as updates on cybersecurity legislation and regulation. The Board also conducts a cybersecurity tabletop exercise at least every other year to simulate Truist's analysis and response to hypothetical cybersecurity incidents. In addition, Truist provides directors with a Board Cybersecurity Handbook that provides details on key Truist practices, resources, and protocols relating to cybersecurity protection, response, and preparedness. Finally, as required by the Gramm-Leach-Bliley Act, the Board receives an update at least annually on Truist's Information Security Program.


text: Risk Assessment and Management The Company is increasingly dependent on the use of complex technology and systems to run its operations and support its strategic objectives. These technologies and systems include, among others, the Company's website and reservation system; flight dispatch and tracking systems; flight simulators; check-in kiosks; aircraft maintenance, planning, and record keeping systems; telecommunications systems; flight planning and scheduling systems; crew scheduling systems; human resources systems; and financial planning, management, and accounting systems. Additionally, the Company must receive certain confidential or personal information related to its Customers and Employees to run its business, and the Company's operations depend upon secure collection, processing, retention, and transmission of such information. Therefore, the performance, reliability, and security of the Company's technology infrastructure and information systems are critical to the Company's operations and initiatives.

companyName: SOUTHWEST AIRLINES CO

ticker: LUV


text: The Company has an enterprise risk management ("ERM") program to identify, evaluate, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with the Company's broader business goals and objectives. The Company believes that integrating cybersecurity risks into its ERM program fosters a proactive and holistic approach to cybersecurity, which helps safeguard the Company's operations, financial condition, and reputation in an ever-evolving threat landscape.


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and Employee training, education, and awareness initiatives. The Company's cybersecurity risk management also includes a Security Operations Center ("SOC") that conducts ongoing monitoring of networks and systems for potential signs of suspicious activity. The SOC is a centralized function that monitors security alerts to initiate triage, verification, and remediation activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe. The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Further, the Company's cybersecurity program is periodically reviewed by its Cybersecurity Leaders (as defined below) and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.


text: Incident Response The Company has a dedicated cybersecurity incident response team responsible for managing and coordinating the Company's cybersecurity incident response efforts. This team also collaborates closely with other teams in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks cybersecurity incidents to help identify and analyze them. The Company's cybersecurity incident response team partners with the Company's internal cybersecurity teams as well as with external legal advisors, communication specialists, and other key stakeholders as appropriate to respond to cybersecurity incidents. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide hands-on training for the participants and helps the Company assess its processes and capabilities in addressing cybersecurity threats.


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. The Company engages cybersecurity consultants, auditors, and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments, penetration testing, and vulnerability assessments to identify weaknesses and recommend improvements. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions. This includes a managed security service provider to augment the Company's dedicated SOC team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.


text: Oversight of Third-Party Service Providers. The Company also uses third-party service providers to support its operations and many of its technology initiatives. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture or a recommendation of specific mitigation controls. Following an evaluation, the Company determines and prioritizes service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company has experienced cyberattacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place by the Company. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1.A Risk Factors—Information Technology Risks."


text: The Board is responsible for overseeing management's assessments of major risks facing the Company and for reviewing options to mitigate such risks. The Board's oversight of major risks, including cybersecurity risks, occurs at both the full Board level and at the Board committee level through the Audit Committee.


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, members of senior management, and other personnel and advisors, as requested by the Board, report on the Company's financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. Based on these reports, the Board requests follow-up data and presentations to address any specific concerns and recommendations. Additionally, the Audit Committee has opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: The Audit Committee. The Audit Committee reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile at its regularly scheduled meetings. The Company's Chief Information Officer ("CIO"), Chief Information Security Officer ("CISO"), members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company's technology, data privacy, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Audit Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. The Audit Committee further reviews with management the Company's business continuity and disaster recovery plans and capabilities and the effectiveness of the Company's escalation procedures. Based on these management reports, the Audit Committee may request follow-up data and presentations to address any specific concerns and recommendations. In addition to this regular reporting, significant cybersecurity risks or threats may also be escalated on as needed basis to the Audit Committee.


text: Management's Role The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's CISO, who reports to the Company's CIO. The CISO and CIO (collectively, the Company's "Cybersecurity Leaders") are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department. The CIO holds an undergraduate degree from Cornell and has served in various roles in information technology for over 20 years, including Vice President, Senior Director, Manager and Consultant. • The CISO is responsible for all aspects of cybersecurity across the Company's facilities, airports, and aircraft fleet, which includes security engineering, security operations, incident response, threat intelligence, risk and compliance, and vulnerability management. The CISO has served in various roles in information technology for nearly 40 years at numerous technology companies and consulting firms. The CISO earned a Bachelor of Science in Industrial Engineering from Louisiana State University, a Master of Science in Management Information Systems from The University of Texas at Dallas, and a Master of Business Administration from Southern Methodist University.


text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, security architecture, and incident response. These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility of major issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents to senior management. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates with external legal advisors, communication specialists, and other key stakeholders.


text: Risk Assessment and Management The Company is increasingly dependent on the use of complex technology and systems to run its operations and support its strategic objectives. These technologies and systems include, among others, the Company's website and reservation system; mobile application; flight dispatch and tracking systems; flight simulators; check-in kiosks; aircraft maintenance, planning, and record keeping systems; telecommunications systems; flight planning and scheduling systems; crew scheduling systems; human resources systems; and financial planning, management, and accounting systems. Additionally, the Company must receive and process certain confidential or personal information related to its Customers and Employees to run its business, and the Company's operations depend upon secure collection, processing, retention, and transmission of such information. Therefore, the performance, reliability, and security of the Company's technology infrastructure and information systems are critical to the Company's operations and initiatives.


text: The Company maintains a cybersecurity program that is designed to identify, protect from, detect, respond to, and recover from cybersecurity threats and risks, and protect the confidentiality, integrity, and availability of its information systems, including the information residing on such systems. The National Institute of Standards and Technology Cybersecurity Framework helps the Company inform its cybersecurity agenda and prioritize its cybersecurity activities. The Company takes a risk-based, threat-informed approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks or threats that could affect the Company's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are evaluated and prioritized based on their potential impact, likelihood, velocity, and vulnerability, considering both quantitative and qualitative factors. Risk mitigation strategies are developed and implemented based on the specific nature of each cybersecurity risk or threat. These strategies include, among others, the application of cybersecurity policies and procedures, implementation of administrative, technical, and physical controls, and Employee training, education, and awareness initiatives. The Company's cybersecurity program also includes a Security Operations Center ("SOC") that conducts ongoing monitoring of networks and systems for potential signs of suspicious activity. The SOC is a centralized function that monitors security alerts to initiate triage, verification, and remediation activities. Additionally, the Company's cybersecurity program provides mechanisms for Employees to report any unusual or potentially malicious activity they observe. The Company tracks key performance indicators and cybersecurity metrics to evaluate the efficacy of its cybersecurity controls and practices. Further, the Company's cybersecurity program is periodically reviewed by its Chief Information Officer ("CIO") and Chief Information Security Officer ("CISO" and, together with the CIO, the Company's "Cybersecurity Leaders") and adjusted in an effort to maintain the program's agility and responsiveness as circumstances evolve, new cybersecurity threats emerge, and regulations change.


text: Incident Response The Company has a dedicated cybersecurity incident response team responsible for managing and coordinating the Company's cybersecurity incident response efforts. This team collaborates closely with other internal teams as well as with external legal advisors, communication specialists, and other key stakeholders, as appropriate, in identifying, protecting from, detecting, responding to, and recovering from cybersecurity incidents. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. Additionally, this team tracks cybersecurity incidents to help identify and analyze them. The Company maintains a cybersecurity incident response plan to prepare for and respond to cybersecurity incidents. The incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board. Additionally, the Company conducts at least one cybersecurity tabletop exercise on an annual basis, where members of a cross-functional team engage in a simulated cybersecurity incident scenario. This preparedness exercise is intended to provide hands-on training for the participants and helps the Company assess its cybersecurity response plan and its processes and capabilities in addressing cybersecurity threats.


text: Use of Third Parties Cybersecurity Service Providers and Third-Party Consultants. The Company engages cybersecurity consultants, assessors, and other third parties to assess and enhance its cybersecurity practices. These third parties conduct assessments, penetration testing, and vulnerability evaluations to help identify potential weaknesses and recommend improvements. Additionally, the Company leverages a number of third-party tools and technologies as part of its efforts to enhance cybersecurity functions, such as a managed security service provider to augment the Company's dedicated SOC team, an endpoint detection and response system for continuous monitoring, detection, and response capabilities, and a security information and event management solution to automate real-time threat detection, investigation, and prioritization of high-fidelity alerts.


text: Oversight of Third-Party Service Providers. The Company also uses third-party service providers to support its operations and many of its technology initiatives. The Company evaluates third-party service providers from a cybersecurity risk perspective, which may include an assessment of that service provider's cybersecurity posture and/or a recommendation of specific mitigation activities. Following an evaluation, the Company determines and prioritizes service provider risk based on potential threat impact and likelihood, and such risk determinations drive the level of due diligence and ongoing compliance monitoring required for each service provider.


text: Risks from Material Cybersecurity Threats As of the date of this report, the Company has not identified any cybersecurity threats that have materially affected or are reasonably likely to have a material effect on the Company's business strategy, results of operations, or financial condition. Although the Company has not experienced cybersecurity incidents that are individually, or in the aggregate, material, the Company and its service providers have experienced cyber-attacks in the past, which the Company believes have thus far been mitigated by preventative, detective, and responsive measures put in place. For a detailed discussion of the Company's cybersecurity related risks, see "Item 1A Risk Factors—Information Technology, Cybersecurity, and Data Privacy Risks."


text: The Board. The Chief Executive Officer, the Chief Operating Officer, the Chief Financial Officer, members of senior management, and other personnel and advisors, as requested by the Board, report on the Company's financial, operating, and commercial strategies, as well as major related risks, which may include cybersecurity risks, at regularly scheduled meetings of the Board. Based on these reports, the Board may request follow-up information and presentations to address any specific concerns and recommendations. Additionally, the Audit Committee has opportunities to report regularly to the entire Board and review with the Board any major issues that arise at the committee level, which may include cybersecurity risks.


text: The Audit Committee. The Audit Committee reviews with management the Company's technology and cybersecurity frameworks, policies, programs, opportunities, and risk profile as needed at its regularly scheduled meetings. The Company's CIO, CISO, members of the cybersecurity team, or other advisors, as requested by the Audit Committee, report quarterly on the Company's technology, data protection, and cybersecurity strategies and risks. Cybersecurity topics are presented to the Audit Committee on a quarterly basis and generally highlight any significant cybersecurity incidents, the cyber threat landscape, cybersecurity program enhancements, cybersecurity risks and related mitigation activities, and any other relevant cybersecurity topics. Management believes that this regular cadence of reporting helps to provide the Audit Committee with an informed understanding of the Company's dynamic cybersecurity program and threat landscape. As needed, the Audit Committee reviews with management the Company's business continuity and disaster recovery plans and capabilities and the effectiveness of the Company's escalation procedures. Based on these management reports, the Audit Committee may request follow-up information and presentations to address any specific concerns and recommendations. In addition to this regular reporting, cybersecurity risks or threats may also be escalated on an as-needed basis to the Audit Committee.


text: Management's Role The Company has a dedicated cybersecurity organization within its technology department that focuses on current and emerging cybersecurity matters. The Company's cybersecurity function is led by the Company's CISO, who reports to the Company's CIO. The Cybersecurity Leaders are actively involved in assessing and managing cybersecurity risks. They are responsible for implementing cybersecurity policies, programs, procedures, and strategies. The responsibilities and relevant experience of each of the Cybersecurity Leaders are listed below: • The CIO provides leadership for the Company's technology department. The CIO holds an undergraduate degree from Cornell and has served in various roles in information technology for over 20 years, including Vice President, Senior Director, Manager and Consultant. • The CISO is responsible for leading the Company's cybersecurity strategy and department while ensuring the protection of data and assets across the Company's facilities, airports, and aircraft. The CISO has served in various roles in cybersecurity for over 15 years. The CISO earned a Bachelor of Business Administration in Management Information Systems from The University of Oklahoma and holds a Certified Information Systems Security Professional certification. The CISO also participates in the Aviation Information Sharing and Analysis Center Board and is the Vice Chair of the Cybersecurity Council at Airlines for America.


text: The Company's cybersecurity department is comprised of teams that engage in a range of cybersecurity activities such as threat intelligence, incident response, security operations, vulnerability management, risk and compliance and security engineering. These teams conduct vulnerability management and penetration testing to identify, classify, prioritize, remediate, and mitigate vulnerabilities. Leaders from each team regularly meet with the Cybersecurity Leaders to provide visibility of relevant issues and seek alignment with strategy. As noted above under "Incident Response," the Company's cybersecurity incident response plan includes standard processes for reporting and escalating cybersecurity incidents, as appropriate, to senior management, the Audit Committee, and the Board. Cybersecurity incidents that meet certain thresholds are escalated to the Cybersecurity Leaders and cross-functional teams on an as-needed basis for support and guidance. The Company's incident response team also coordinates, as needed, with external legal advisors, communication specialists, and other key stakeholders.


text: SPS is a wholly owned subsidiary of Xcel Energy. As such, its cybersecurity processes are maintained by Xcel Energy management and governed by its Board of Directors. As described in Item 1A – Risk Factors, Xcel Energy operates in an industry that requires the continued operation of sophisticated information technology, control systems and network infrastructure, as such, our business is subject to the risk of interruption by cybersecurity incidents that range from attacks common to most industries, such as phishing and denial-of-service, to attacks from more sophisticated adversaries, including nation state actors, that target the critical infrastructure used in the operation of our business.

companyName: SOUTHWESTERN PUBLIC SERVICE CO


text: Cybersecurity Risk Management and Strategy We maintain an enterprise-wide approach to risk management through which we identify, manage and mitigate significant risks, including those related to our information systems. Our cybersecurity risk management program, which applies to our global operations, focuses on our people, processes and technology, and is designed to secure our information systems by preventing, detecting and responding to current and emerging cybersecurity threats.

companyName: STANDARD MOTOR PRODUCTS, INC.

ticker: SMP


text: Our employees are a key element of our cybersecurity risk management program. All of our employees are required to adhere to our cybersecurity practices, and undertake routine training to raise awareness and reinforce safe practices. Our training program includes bi-annual online training courses, group tabletop exercises, phishing and malicious email simulations, and information security bulletins. We also maintain policies that govern, and provide specific guidance to employees regarding how they may use our information systems.


text: Another key element of our cybersecurity risk management program is our use of processes and technologies to create information security safeguards and controls, and target specific users or business needs. Our processes and technologies include firewalls, email security software and encryption, endpoint detection and response, access controls, backup and recovery procedures, system patches and updates, vulnerability scanning, penetration testing by third party vendors, incident response procedures, and internal and external audits of our information systems.


text: Through these internal and external assessments, we continuously identify areas for remediation and opportunities to improve the security of our information systems, including by evaluating our program against industry standards and best practices, such as the Cybersecurity Framework established by the National Institute of Standards and Technology (NIST) and the CIS Critical Security Controls established by the Center for Internet Security. We also track key performance indicators that we believe are indicative of the effectiveness of our cybersecurity risk management program.


text: For additional information related to cybersecurity risks that could have a material and adverse effect on our business, financial condition or results of operations, see "Our operations could be adversely affected by interruptions or breaches in the security of our computer and information systems" in Item 1A of this Report.


text: Cybersecurity Governance The Audit Committee of our Board of Directors oversees the adequacy and effectiveness of our internal controls, policies and procedures regarding cybersecurity, information security and data protection, and compliance with applicable laws and regulations concerning privacy. Our Chief Information Officer ("CIO"), in turn, is responsible for managing the Company's cybersecurity risk management program and incident response procedures. On a quarterly basis, and more frequently as circumstances warrant, our CIO briefs the Audit Committee on our cybersecurity risks, our strategies for preventing, detecting, responding to and mitigating such risks, including the effectiveness of our incident response procedures, and our information security controls. Our CIO has extensive knowledge and expertise regarding our information systems and security, having served in a variety of senior information technology positions across our organization for more than thirty years, and as an executive officer of the Company since 2006.


text: Additionally, our CIO leads an incident response team ("IRT"), charged with the on-going management of our cybersecurity program. This team is responsible for the prevention, mitigation, detection and remediation of cybersecurity risks and incidents affecting our operations pursuant to our incident response procedures. The IRT is composed of information security professionals, who collectively bring decades of relevant information security and cybersecurity experience to their roles. In the event that a cybersecurity incident is detected, the IRT performs a multi-factor, risk-based assessment to determine the appropriate level of response. Depending upon the results of the assessment, including the nature and magnitude of the event, our incident response procedures provide for oversight and management of an incident by the IRT, under the direction of the CIO, or, in the event of escalation, under the direction of the executive officers of the Company, with reporting to and oversight by the Audit Committee.


text: Chevron's business and proprietary information, information technology (IT) and operational technology (OT) networks are essential to its success. The company's cybersecurity program is designed to protect its information assets and operations from external and internal cyber threats by identifying and appropriately managing and mitigating risks while ensuring business resiliency. This program is integrated within the company's Enterprise Risk Management (ERM) process, which is the company's systematic approach to identifying, managing and assessing major risks and safeguards, including cybersecurity risks. Chevron uses a risk-based information security process aligned with the National Institute of Standards and Technology (NIST) Cybersecurity Framework to identify, prioritize and mitigate cyber risks.

companyName: CHEVRON CORP

ticker: CVX


text: The company's worldwide team of cybersecurity professionals undertakes a range of preemptive activities to protect its people, assets and reputation globally. The company also leverages internal and external resources to monitor cybersecurity threats to its systems and networks and to understand the broader threat environment. The company seeks to remove exploitable weaknesses in its systems or devices before they become a threat. Chevron security experts use automated threat intelligence feeds to increase vulnerability awareness, taking action to mitigate the highest risks. The company's cybersecurity guardrails, which are high-level design requirements expected to be built into any new digital solutions being deployed, are also updated on an ongoing basis to align with changes in industry standards and the evolving threat environment.


text: Chevron's cyber risk management process includes testing and risk assessments of technologies, third-party suppliers, and its IT and OT networks. These assessments ensure that our focus is on the highest priorities to maintain the security of our company's assets. To further protect the company's systems and data, Chevron's cybersecurity organization has threat intelligence capabilities to monitor security breaches impacting third-party suppliers. As third-party risks increase, the company's approach to third-party supplier risk management and qualification continues to evolve, including the ongoing expansion of its current supplier risk management program beyond IT vendors to other high-risk, third-party vendors.


text: Chevron's Chief Information Security Officer (CISO) leads a global cybersecurity team that operationalizes and manages the company's cybersecurity program and strategy. Chevron's CISO has more than 20 years of cybersecurity experience and is responsible for providing a single and consolidated view of the company's enterprise cybersecurity risk. Before joining Chevron, he held a leadership role in cyber threat analysis with the U.S. Department of State's Bureau of Diplomatic Security. Chevron's CISO reports to the Chief Information Officer (CIO) who is responsible for Chevron's broader IT program, including resiliency and ability to remediate and recover from a cybersecurity incident to minimize impacts to the business and operations. He has more than 30 years of experience in IT and the oil and gas industry.


text: Chevron operates four Cyber Intelligence Centers around the world, some co-located with critical assets, with cyber professionals who monitor and respond to cyber threats 24 hours a day, 365 days a year, to limit the scope and impact of cyber incidents in its networks. Chevron's CISO regularly receives cybersecurity operations reports detailing prevention, detection, mitigation and remediation efforts associated with cyber incidents, both on Chevron's networks and third-party supplier networks. The CISO has authority to mobilize a cross-functional cyber incident response team, including outside cybersecurity experts, to drive mitigation and remediation actions. Status updates on incidents are provided to senior management and to the Board, as appropriate.


text: The company's dedicated cyber risk organization meets regularly with business units to raise cyber risk awareness and keep diverse cybersecurity skill sets connected across the enterprise. Chevron has invested in broad cybersecurity awareness and required training to educate those with access to Chevron's networks on company policy and best practices. The company conducts regular phishing tests to train and assess its workforce's ability to identify malicious emails.


text: Chevron's Corporate Audit Department has a dedicated team responsible for IT and information security (including cybersecurity) audits. Chevron also leverages external resources to reinforce its cybersecurity capabilities. On a regular basis, external consultants provide a maturity assessment of the company's cybersecurity program.


text: The company's approach to managing risks, including cybersecurity risks, is embedded within the enterprise Operational Excellence (OE) Management System (OEMS). The OEMS provides a systematic process that enables the company to manage risk and implement safeguards and foster a culture of learning across different focus areas for Chevron's business, including cybersecurity. The company's Business Continuity Planning OE Process, a component of the OEMS, is designed to prepare Chevron to continue operations during an unplanned event or disruption, which aligns with its OE objective to prevent high-consequence security and cybersecurity incidents. Chevron works to identify critical business processes and dependent IT applications and document the processes for continuing operations without IT systems. Cross-functional teams also conduct regular multidisciplinary exercises, including an expansive cybersecurity exercise in 2023, to test and improve response plans.


text: The Board provides oversight of Chevron's cybersecurity program, receives reports from management on cybersecurity risks in connection with Chevron's operations and projects, and also reviews cybersecurity risks as part of the company's broader annual ERM process. In support of the Board's oversight of the company's policies and processes with respect to risk management and the company's major financial risk exposures, including cybersecurity, the Audit Committee meets with Chevron's CISO and CIO at least twice a year to review cybersecurity risks and implications, including the results of independent third-party assessments. The CISO and CIO present cybersecurity matters to the Board of Directors at least annually. The CISO and CIO also provide new Board members with a cybersecurity briefing as part of the onboarding process. In 2023, the Audit Committee hosted an external expert to discuss cybersecurity and digital risk management topics.


text: To date, the company has not experienced a cybersecurity threat or incident that has materially affected or is reasonably likely to materially affect the company, including its business strategy, results of operations or financial condition; however, the company has experienced and will continue to experience cyber incidents of varying degrees. Despite the cybersecurity measures that the company is taking to mitigate such risks, there can be no guarantee that such measures will be sufficient to protect the company's systems, information, intellectual property and other assets from significant harm and that future cybersecurity incidents will not have a material adverse effect on the company or its results of operations or financial condition or cause reputational or other harm to the company. Refer to Item 1A. Risk Factors on pages 21 through 22 for further discussion of cyberattacks and the associated risks to Chevron's business.


text: Chevron's Chief Information Officer (CIO) oversees Chevron's broader IT program, which includes the company's cybersecurity program and its ability to remediate and recover from a cybersecurity incident to minimize business and operational impacts. Chevron's CIO joined Chevron in 2024, bringing more than 20 years of experience leading global innovation initiatives in digital, data, full supply chains, vehicle commerce, energy, and IT operations for technology and automotive companies. Chevron's Chief Information Security Officer (CISO) reports to the CIO and leads a global cybersecurity team.


text: Chevron operates four Cyber Intelligence Centers around the world, some co-located with critical assets, with cyber professionals who monitor and respond to cyber threats 24 hours a day, 365 days a year, to limit the scope and impact of cyber incidents in its networks. The cybersecurity organization provides the IT leadership, which includes Chevron's CIO, with regular cybersecurity operations reports detailing prevention, detection, mitigation and remediation efforts associated with cyber incidents, both on Chevron's networks and third-party supplier networks. The leadership of the cybersecurity organization has authority to mobilize a cross-functional cyber incident response team, including outside cybersecurity experts, to drive mitigation and remediation actions. Status updates on incidents are provided to senior management and to the Board, as appropriate.


text: The company's approach to managing risks, including cybersecurity risks, is embedded within the enterprise Operational Excellence (OE) Management System (OEMS). The OEMS provides a systematic process that enables the company to manage risk and implement safeguards and foster a culture of learning across different focus areas for Chevron's business, including cybersecurity. The company's Business Continuity Planning OE Process, a component of the OEMS, is designed to prepare Chevron to continue operations during an unplanned event or disruption, which aligns with its OE objective to prevent high-consequence security and cybersecurity incidents. Chevron works to identify critical business processes and dependent IT applications and document the processes for continuing operations without IT systems. Cross-functional teams also conduct regular multidisciplinary exercises to test and improve response plans.


text: The Board provides oversight of Chevron's cybersecurity program, receives reports from management on cybersecurity risks in connection with Chevron's operations and projects, and also reviews cybersecurity risks as part of the company's broader annual ERM process. In support of the Board's oversight of the company's policies and processes with respect to risk management and the company's major financial risk exposures, including cybersecurity, the Audit Committee meets with Chevron's CISO and CIO at least twice a year to review cybersecurity risks and implications, including the results of independent third-party assessments. The CISO and CIO present cybersecurity matters to the Board of Directors at least annually. The CISO and CIO also provide new Board members with a cybersecurity briefing as part of the onboarding process.


text: The Company has implemented a comprehensive cybersecurity program to assess, identify and manage risks from cybersecurity threats that may result in adverse effects to the confidentiality, integrity, and availability of its information systems and oversee compliance with applicable regulatory, operational, and contractual requirements.

companyName: STANLEY BLACK & DECKER, INC.

ticker: SWK


text: Board of Directors The Board has delegated the primary responsibility for oversight of cybersecurity matters to the Audit Committee. The Audit Committee regularly reviews compliance and disclosure control procedures for cybersecurity matters. Members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information Officer (the "CIO"), Chief Information Security Officer (the "CISO") and the Senior Vice President, General Counsel and Secretary (the "General Counsel"), provide regular updates to the Audit Committee regarding data protection and cybersecurity risks and the Company's new and existing cyber risk controls intended to mitigate them. The Audit Committee regularly briefs the full Board on these matters, and the full Board also receives briefings from management and third-party cybersecurity advisors on the Company's cybersecurity program, as appropriate. The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Audit Committee and the full Board.


text: At the management level, oversight of risks from cybersecurity threats has been integrated into the Company's overall risk management processes. The Senior Risk Council has broad oversight of the Company's risk management processes, and is also responsible for the assessment and management of risks from cybersecurity threats. The Senior Risk Council is comprised of senior management personnel representing different functional and business areas, including the Chief Executive Officer; Chief Financial Officer; General Counsel; Treasurer; and CIO, as well as other senior business leaders. The Company believes the experience that Senior Risk Council members have from serving on the Senior Risk Council provides them with an understanding of the Company's risk management process overall, and individual members are able to provide further insight to the risk analysis process based on their functional area of expertise within the business. The CIO also has extensive leadership experience in computer product engineering and information technology fields, including responsibility for overseeing cybersecurity risk management and digital risk management. The CIO also holds a bachelor's degree in computer science. The Senior Risk Council meets regularly to discuss the risk management measures implemented by the Company, including measures to identify and mitigate data protection and cybersecurity risks. The Senior Risk Council receives regular updates on cybersecurity incidents from the CISO and CIO.


text: The Company's CISO is the member of management principally responsible for overseeing the Company's cybersecurity risk management program, in coordination with the CIO and other business leaders across the Company, including legal, product engineering management, internal audit, finance and risk management. The CISO has extensive cybersecurity knowledge and skills gained from over 20 years of technical and business experience in the cybersecurity and information security fields, including as a Chief Information Security Officer and through other leadership and technical roles in IT governance and strategy, security risk and compliance, corporate product security and data privacy, and IT infrastructure. She also holds a Master of Science degree in Information and Cybersecurity from the University of California, Berkeley. The CISO reports directly to the CIO who in turn reports directly to the Chief Executive Officer. The CISO receives reports on cybersecurity threats from members of the Cyber Security Office on an ongoing basis and, in conjunction with the Senior Risk Council, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with the Company's legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.


text: Internal Cybersecurity Team The Company's Cyber Security Office, led by the CISO, is responsible for the implementation, monitoring, and maintenance of cybersecurity governance, operations and data protection practices across the Company. Reporting to the CISO are a number of experienced information security directors responsible for various parts of the Company's business, each of whom is supported by a team of trained cybersecurity professionals. The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, and Certified Ethical Hacker, among others. In addition to its internal cybersecurity capabilities, the Company also regularly engages assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: Risk Management & Strategy The Company has adopted information security policies that establish requirements and responsibilities with respect to the protection of the Company's interests and information technology assets against loss, improper disclosure and unauthorized modification. The Company regularly educates and shares best practices with its employees to raise awareness of cybersecurity threats and the Company's information security program, which the Company believes creates a culture of shared responsibility for the security of sensitive data and the Company's network. All employees are regularly offered information security and protection training, including specialized training for employees exposed to sensitive information, which prompt them to certify their awareness of and compliance with applicable information technology policies and additional technology and cybersecurity standards. The Company deploys technical safeguards that are designed to protect the Company's information systems from cybersecurity threats, including firewalls, encryption intrusion prevention and detection systems, anti-malware functionality, data monitoring, endpoint extended detection and response, architecture controls, access controls and ongoing vulnerability assessments.


text: The Company has adopted a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the IRP. Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Board and the Audit Committee when appropriate, as discussed above. In general, the IRP leverages the National Institute of Standards and Technology guidance. The IRP applies to all Company personnel who provide or deliver technology systems (including employees or contractors and service providers).


text: As part of the Company's cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, such as engaging an independent third party to conduct regular assessments of its cyber security maturity against industry best practice frameworks and conducting tabletop exercises. The Company also engages in internal and external audits to meet its regulatory obligations or customer requirements. The assessment summaries and action plans are shared with the Audit Committee as part of the CISO's regular briefings, and in turn the Audit Committee Chair regularly updates the Board on such briefings.


text: The Company has processes and procedures as part of its centralized supplier risk management system to oversee, identify, assess and reduce cybersecurity threats and risks associated with key third-party service providers. As part of this process, the Company utilizes external frameworks and tools to provide assessment scoring, planning and monitoring against cybersecurity threats and risks and remediation recommendations, as applicable. Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Audit Committee as appropriate.


text: Cybersecurity Risks, Threats & Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition, and the Company does not believe that such risks are reasonably likely to have such an effect over the long term.


text: The Company deploys measures which leverage industry accepted frameworks to deter, prevent, detect, respond to, and mitigate these threats. The Company has invested and continues to invest in risk management and information security and data privacy measures in order to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses. Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information (the Company's or that of third parties) and the disruption of business operations. Refer to Item 1A. Risk Factors in Part I of this Annual Report on Form 10-K, which should be read in conjunction with the foregoing information, for additional information on cybersecurity risks the Company faces.


text: The Company has a comprehensive cybersecurity program to assess, identify and manage risks from cybersecurity threats that may result in adverse effects to the confidentiality, integrity, and availability of its information systems and oversee compliance with applicable regulatory, operational, and contractual requirements.


text: Board of Directors The Board of Directors (the "Board") has the primary responsibility for oversight of cybersecurity matters. This responsibility had been previously delegated to the Audit Committee. The Board regularly reviews compliance and disclosure control procedures for cybersecurity matters. The Board also receives quarterly briefings from members of management responsible for cybersecurity and digital risk management for the Company, including the Vice President and Chief Information Officer (the "CIO"), Chief Information Security Officer (the "CISO") and Senior Vice President, General Counsel and Secretary (the "General Counsel"), as well as third-party cybersecurity advisors, on the Company's cybersecurity program, including data protection and cybersecurity risks and the Company's new and existing cyber risk controls intended to mitigate them, as appropriate. The Company has protocols and procedures by which certain cybersecurity incidents are escalated within the Company and, where appropriate, reported promptly to the Board.


text: At the management level, oversight of risks from cybersecurity threats has been integrated into the Company's overall risk management processes. The Senior Risk Council has broad oversight of the Company's risk management processes, and is also responsible for the assessment and management of risks from cybersecurity threats. The Senior Risk Council is comprised of senior management personnel representing different functional and business areas, including the Chief Executive Officer; Chief Operating Officer ("COO"); Chief Financial Officer; General Counsel; Treasurer; and CIO, as well as other senior business leaders. The Company believes the experience that these senior management personnel have from serving on the Senior Risk Council provides them with an understanding of the Company's risk management processes overall, and individual members are able to provide further insight to the risk analysis process based on their functional area of expertise within the business.


text: The CIO also has extensive leadership experience in computer product engineering and information technology fields, including responsibility for overseeing cybersecurity risk management and digital risk management. The CIO also holds a bachelor's degree in computer science. The Senior Risk Council meets regularly to discuss the risk management measures implemented by the Company, including measures to identify and mitigate data protection and cybersecurity risks. The Senior Risk Council receives regular updates on cybersecurity incidents from the CISO and CIO.


text: The Company's CISO is the member of management principally responsible for overseeing the Company's cybersecurity risk management program, under the CIO's leadership and in coordination with other business leaders across the Company, including legal, product engineering management, internal audit, finance and risk management. The CISO has extensive cybersecurity knowledge and skills gained from over 20 years of technical and business experience in the cybersecurity and information security fields, including as a Chief Information Security Officer and through other leadership and technical roles in IT governance and strategy, security risk and compliance, corporate product security and data privacy, and IT infrastructure. She also holds a Master of Science degree in Information and Cybersecurity from the University of California, Berkeley. The CISO reports directly to the CIO who in turn reports directly to the COO. The CISO receives reports on cybersecurity threats from members of the Cyber Security Office on an ongoing basis and, in conjunction with the Senior Risk Council, regularly reviews risk management measures implemented by the Company to identify and mitigate data protection and cybersecurity risks. The CISO and CIO also work closely with the Company's legal department to oversee compliance with applicable legal, regulatory and contractual security requirements.


text: Internal Cybersecurity Team The Company's Cyber Security Office, led by the CISO, is responsible for the implementation, monitoring, and maintenance of cybersecurity governance, operations and data protection practices across the Company. The Information Technology organization, led by the CIO, is responsible for the implementation of cybersecurity technical controls. Reporting to the CISO are a number of experienced information security directors responsible for various parts of the Company's business, each of whom is supported by a team of trained cybersecurity professionals. The team also holds a number of industry recognized certifications such as Certified Information Systems Security Professional, Certified Information Security Manager, Certified in Risk and Information Systems Control, Certified Information Systems Auditor, Certified Network Defense Architect, Certified Cloud Security Professional, Certified Secure Software Lifecycle Professional, and Certified Ethical Hacker, among others. In addition to its internal cybersecurity capabilities, the Company also regularly engages assessors, consultants, auditors, or other third parties to assist with assessing, identifying, and managing cybersecurity risks.


text: The Company has adopted a Cybersecurity Incident Response Plan (the "IRP") that applies in the event of a cybersecurity threat or incident, which is designed to protect the Company's information systems from cybersecurity threats and to promptly respond to cybersecurity incidents. The IRP sets out a coordinated approach to investigating, containing, documenting and mitigating incidents, including reporting findings and keeping senior management and other key stakeholders informed and involved as appropriate. To facilitate the success of this program, multi-disciplinary teams throughout the Company are deployed to address cybersecurity threats and to respond to cybersecurity incidents in accordance with the IRP. Through the ongoing communications among these teams, the CISO, in coordination with the legal department and the Senior Risk Council, monitor the prevention, detection, mitigation and remediation of cybersecurity incidents, and report such incidents to the Board when appropriate, as discussed above. In general, the IRP leverages the National Institute of Standards and Technology guidance. The IRP applies to all Company personnel who provide or deliver technology systems (including employees, contractors and service providers).


text: As part of the Company's cybersecurity risk management strategy, the Company takes measures to test and improve its cybersecurity program, including reviewing and updating the information technology policies and IRP, engaging independent third-party consultants to conduct regular assessments of its cyber security maturity against industry best practice frameworks and recommend program enhancements, and conducting tabletop exercises. The Company also engages in internal and external audits to meet its regulatory obligations or customer requirements. The assessment summaries and action plans are shared with the Board as part of the regular briefings provided by the CIO and CISO.


text: The Company has processes and procedures as part of its centralized supplier risk management system to oversee, identify, assess and reduce cybersecurity threats and risks associated with key third-party service providers. As part of this process, the Company utilizes external frameworks and tools to provide assessment scoring, planning and monitoring against cybersecurity threats and risks and remediation recommendations, as applicable. Updates on third-party service provider risks are included in regular briefings to the Senior Risk Council by the CISO and CIO and escalated to the Board as appropriate.


text: Cybersecurity Risks, Threats & Incidents Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected the Company, including its business strategy, results of operations or financial condition, and the Company does not believe that such risks are reasonably likely to have such an effect over the long term. As of the date of this report, the Company has not experienced a cybersecurity incident or third-party information security breach in the last three fiscal years that has materially affected the Company, including its business strategy, results of operations or financial condition.


text: The Company deploys measures which it believes leverage industry accepted frameworks to deter, prevent, detect, respond to, and mitigate these threats. The Company has invested and continues to invest in risk management and information security and data privacy measures it believes are appropriate to protect its systems and data, including employee and critical service provider training, organizational investments, incident response plans, tabletop exercises and technical defenses. Despite these efforts, cybersecurity incidents (against the Company or parties with whom the Company contracts), depending on their nature and scope, could potentially result in the misappropriation, disclosure, destruction, corruption or unavailability of critical data and confidential or proprietary information (the Company's or that of third parties) and the disruption of business operations. Refer to Item 1A. Risk Factors in Part I of this Annual Report on Form 10-K, which should be read in conjunction with the foregoing information, for additional information on cybersecurity risks the Company faces.


text: The information required by this Item is provided under "Information Technology Risk Management" included in Item 7, Management's Discussion and Analysis in this Form 10-K, and is incorporated herein by reference.

companyName: STATE STREET CORP

ticker: STT


text: Cybersecurity risk is an integral part of our enterprise risk management and is managed as part of our overall information technology risk under the direction of our Chief Information Security Officer (CISO). Our CISO is an executive vice president at State Street and is responsible for our overall information security program.


text: Before joining State Street, our CISO worked at a global information technology firm for more than 10 years, holding various positions, including senior vice president and chief security officer, and, prior to that, chief information security officer for that firm's software division. Earlier on, she held leadership and general manager roles at an information management firm and an information security firm, each based in both the United States and Europe. She has worked with the World Economic Forum as a member of their Global Future Council on Cybersecurity. She holds a Doctor of Philosophy in information security and a Bachelor of Science in computer science.


text: We recognize the significance of cyber-attacks and take steps to mitigate the risks associated with them. We invest in building and maintaining a mature cybersecurity program to leverage people, technology and processes to protect our systems and the data in our care. We have also implemented a program to help us better measure and manage cybersecurity risk, including those risks we face when we engage third parties for products and services.


text: We design our information and systems access restrictions referencing the National Institute of Standards and Technology 800 53R5 and NIST CSF 2.0 Framework and use the supplemental requirements as implementation guidance. Our information security policies and standards are reviewed and updated for new regulatory changes and/or mandates. These standards are applicable to all corporate functions, business units, subsidiaries and controlled affiliates across the enterprise. Annual audits are conducted by internal and external parties to measure compliance and adherence to the standards.


text: All employees and third parties that have access to our systems or networks are required to adhere to our cybersecurity policy and standards. Our centralized information security group provides education and training. This training includes a required annual online training class for all employees and third parties that have access to our systems or networks, multiple simulated phishing attacks and regular information security awareness materials. Every employee and contractor has a defined role in protecting systems and information of State Street, our clients and others. They are responsible for complying with the information security program, reporting suspected violations and threats; and protecting the confidentiality of information assets of us, our clients and others at all times.


text: We employ Information Security Officers to help the business better understand and manage their information security risks, as well as to work with the centralized Global Cybersecurity team to drive awareness and compliance throughout the business.


text: We use independent third parties to perform ethical hacks of key systems and penetration tests of our network and certain applications to help us better understand the effectiveness of our controls and to implement more effective controls, and we engage with third parties to conduct reviews of our overall program to help us better align our cybersecurity program with what is required of a large financial services organization.


text: We have an incident response program in place that is designed to enable a coordinated response to mitigate the impact of cyber-attacks, recover from the attack and to drive the appropriate level of communication to internal and external stakeholders, including timely reporting of material incidents in accordance with SEC rules.


text: The TORC, an executive management committee, assesses and manages the effectiveness of our cybersecurity program, which is overseen by the TOPS of our Board. The TOPS receives regular cybersecurity updates throughout the year and is responsible for reviewing and approving the cybersecurity policy on an annual basis. We have not identified any risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected or are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition.


text: Additional information about our risk management governance and structure, including enterprise risk management, as well as information technology specific risk management and governance, is provided under the "Governance and Structure" and "Information Technology Risk Management" sections of Risk Management included in Item 7, Management's Discussion and Analysis in this Form 10-K.


text: Stewart recognizes the importance of protecting our customers', employees' and partners' confidentiality and data integrity. To that end, we continuously and methodically evaluate cyber risks, how they evolve and how they may affect us. We utilize considerable resources in our cybersecurity efforts, and we are committed to continuous cybersecurity education and training across our entire organization as well as our partners and customers. We continuously evaluate and monitor third-party risk relating to the protection of sensitive data. Our program focuses on a broad area of security domains, including, but not limited to: risk management, data protection, incident response, identity and access management, threat and vulnerability management, disaster recovery, business resiliency, and continuity.

companyName: STEWART INFORMATION SERVICES CORP

ticker: STC


text: Risk assessment and management Stewart has an enterprise risk management (ERM) program to assess, identify, and manage risks. Cybersecurity risks are evaluated alongside other critical business risks under the ERM program to align cybersecurity efforts with Stewart's broader business goals and objectives. The cybersecurity risk is assigned to the Vice President, Information Technology (IT), who is a member of the ERM committee, for monitoring. The cybersecurity risk is also under the management oversight of Stewart's Senior Leadership Team.


text: Stewart takes a risk-based approach to cybersecurity, which begins with the identification and evaluation of cybersecurity risks that could affect Stewart's operations, finances, legal or regulatory compliance, or reputation. Once identified, cybersecurity risks and related mitigation efforts are prioritized based upon their potential impact and likelihood. Risk mitigation strategies are developed and implemented based upon the specific nature of each cybersecurity risk. These strategies include the application of cybersecurity policies, procedures, and technologies, and employee training, education, and awareness. Additionally, Stewart's cybersecurity program provides mechanisms for employees to report any unusual or potentially malicious activity.


text: Stewart is regularly assessed against the cybersecurity frameworks of the National Institute of Standards and Technology (NIST CSF) and also evaluated for compliance with the SSAE-18 Systems and Organization Controls (SOC) standards of the American Institute of Certified Public Accountants (AICPA).


text: Stewart receives certain confidential or personal information related to its customers and employees. Stewart's operations depend upon the secure collection, processing, retention and transmission of such information by and through Stewart and its vendors. Therefore, the performance, reliability, and security of Stewart's technology infrastructure and information systems, and those of its vendors, are critical to Stewart's operations and initiatives.


text: Vendor risk management is an essential part of Stewart's Enterprise Governance Risk and Compliance (GRC) program. Critical vendors, which includes vendors that have access to personal information, are assessed and measured against standard security frameworks. Critical vendors are monitored for performance and compliance, and vendor security requirements are well defined and included with all master service agreements and contracts.


text: Incident response In the event of a material breach or an information technology disruption, management has an incident response team in place to take immediate action, work with local and national law enforcement, and notify the appropriate regulators, our Board of Directors and impacted parties. In addition, we would work with the NYSE to disclose the scope and effect of the breach or disruption through an appropriate Form 8-K filing, without providing information that could affect any law enforcement investigation.


text: Cybersecurity governance and board oversight The Board is responsible for overseeing management's assessment of significant risks facing Stewart. The Board approves management's strategy to manage these risks and monitors management's performance in implementing the strategy. The Board's oversight of cybersecurity risks occurs at both the full Board level and at the Board committee level through the Audit Committee.


text: The Board receives, at each regularly scheduled meeting, a risk report which includes an updated cybersecurity risk exposure assessment, a summary of existing cybersecurity controls and risk mitigations, and further planned controls and risk mitigation activities.


text: Our Chief Information Security Officer (CISO) reports quarterly to the Audit Committee concerning Stewart's cybersecurity program, operations, and other ad hoc updates. On a regular basis, management conducts a third-party assessment of Stewart's cybersecurity controls, the results of which are reported to the Audit Committee.


text: Management's role Stewart's cybersecurity function is led by Stewart's CISO, who reports to the Group President, Technology and Operations. The Group President, Technology and Operations, is responsible for all areas of Stewart's digital business strategy, enterprise technology solutions, innovation, and global information technology. The CISO leads a holistic security program to defend enterprises against emerging threats. He has served in various roles in information technology and security leadership for over 30 years.


text: Management uses third party consultants, as necessary, to assist in assessing, identifying and managing risks from cybersecurity threats. Annually, senior management participates in tabletop exercises to assess its readiness responding to cybersecurity incidents. Our cybersecurity team routinely challenges our employees and the effectiveness of existing controls.


text: Risk from cybersecurity threats While Stewart regularly defends against, responds to and mitigates risks from IT systems and software vulnerabilities, broader cybersecurity threats and data security incidents, as of the date of this report, Stewart has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization, however, there can be no guarantee that we will not experience such an incident in the future. Stewart experienced no known material cyber breaches during the three-year period ended December 31, 2023. For additional information concerning Stewart's risks related to cybersecurity, see Item 1A. Risk Factors.


text: Risk from cybersecurity threats While Stewart regularly defends against, responds to and mitigates risks from IT systems and software vulnerabilities, broader cybersecurity threats and data security incidents, as of the date of this report, Stewart has not identified any cybersecurity threats that have materially affected or are reasonably anticipated to have a material effect on the organization, however, there can be no guarantee that we will not experience such an incident in the future. Stewart experienced no known material cyber breaches during the three-year period ending December 31, 2024. For additional information concerning Stewart's risks related to cybersecurity, see Item 1A. Risk Factors.


text: Risk Management and Strategy We are heavily dependent on information technology systems and networks, including the Internet, third-party services and artificial intelligence, across our supply chain, including for product design, production, forecasting, ordering, manufacturing, transportation, sales, and distribution, as well as for processing financial information, external and internal reporting purposes, retail operations and other business activities. We maintain a comprehensive process for assessing, identifying and managing material risks from cybersecurity threats, including, but not limited to, risks from ransomware attacks, security breaches, cyber-attacks or other malicious activities by hackers, criminal groups, nation-states and nation-state-sponsored organizations and social-activist organizations, computer viruses or other malicious codes, unauthorized access, phishing attacks or unauthorized uses, as part of our overall risk management framework and processes. Our risk management framework considers cybersecurity risks alongside other company risks to evaluate their nature and severity, as well as to identify mitigations and assess the impact of those mitigations on residual risk.

companyName: LEVI STRAUSS & CO

ticker: LEVI


text: We maintain a comprehensive cybersecurity and information security framework that includes risk assessment and mitigation through a threat intelligence-driven approach, application controls and enhanced security with ransomware defense. The framework leverages the National Institute of Standards and Technology (NIST) Cyber Security Framework 2.0, as well as other standards. We utilize policies, software, training programs and hardware solutions to protect and monitor our environment, including multifactor authentication, firewalls, intrusion detection and prevention systems, vulnerability and penetration testing, identity management, security information and event management systems and insider threat management systems. We also carry insurance that provides protection against certain potential losses arising from a cybersecurity incident.


text: Our policies require that certain of our employees and contractors complete mandatory security awareness training upon hire or engagement and annually thereafter. The training covers essential topics such as phishing awareness, password security, data protection, social engineering, physical security and compliance requirements. Additionally, targeted training is provided based on roles, responsibilities and access levels to ensure relevance and effectiveness. The awareness and training program also includes practical exercises, such as simulated phishing attacks, to reinforce training objectives and improve understanding of security vulnerabilities. We also participate in a variety of initiatives and groups for collaboration and for increasing our security knowledge and awareness.


text: Our cybersecurity risk management processes include a third-party risk management program that assesses risks from vendors and suppliers. The program includes cybersecurity and data privacy assessments during vendor onboarding to identify and classify risk based on several factors, including the type of data handled by the third-party service provider and the potential impact to our business if there were a significant disruption to the third-party service or system.


text: We maintain a robust Cybersecurity Incident Response Program intended to help us respond to an incident, prevent or minimize system disruption or the loss of data, recover business-critical services and facilitate compliance with any applicable legal obligations. Our program includes a written response plan that provides a framework for handling cybersecurity incidents based on the severity of the incident and the formation of a cross-functional incident response team staffed in accordance with the relevant severity level. The plan also sets out a coordinated approach to assessing the severity of potential and actual incidents and their impacts, containing, investigating, documenting, mitigating and remediating incidents, including reporting findings and keeping senior management, the Board of Directors and other key stakeholders and third parties (such as insurance providers and incident response professionals) informed and involved as appropriate. Our cybersecurity team regularly tests our cybersecurity controls through penetration testing, vulnerability scanning, and attack simulation.


text: Additionally, in connection with our cybersecurity risk management processes, we engage consultants, including outside counsel, to review our processes or programs, benchmark and opine on best practices. We conduct tests on our ecommerce sites to identify control gaps and prioritize process improvements that align with our business and cybersecurity strategy. We also periodically engage a third-party independent review of our cybersecurity program against the NIST Cybersecurity Framework 2.0 to provide an independent assessment and perspective measured against industry standards. In addition, members of senior management participate in periodic tabletop exercises with third-party experts on crisis management best practices to apply their learnings to the company's business continuity, enterprise risk and cybersecurity programs.


text: Our business strategy, results of operations and financial condition have not been materially affected by risks from cybersecurity threats as a result of previous cybersecurity incidents, but we cannot provide assurance that they will not be materially affected in the future by such risks and any future material incidents. See "Risk Factors" in Item 1A of this Annual Report on Form 10-K for more information on risks from cybersecurity threats that are reasonably likely to materially affect our business strategy, results of operations and financial condition.


text: Our cybersecurity strategy is developed in close collaboration with business stakeholders and is led by our Chief Information Security Officer (CISO). This strategy forms the foundation of our information security programs and supports effective cybersecurity risk management. Cybersecurity risk management is the responsibility of our information security team, which is overseen by our CISO. Our cyber fusion team, a subset of the information security team, is responsible for incident response, endpoint security management, detection engineering, vulnerability management, and threat intelligence. The cyber fusion team partners with technology and business stakeholders to strengthen the resiliency of our systems. Our CISO is informed about and monitors the prevention, detection, mitigation and remediation of cybersecurity incidents pursuant to the escalation procedures in our Cybersecurity Incident Response Plan. As described above, for incidents assessed at elevated severity levels, our CISO, crisis management team and legal team promptly engage a cross-functional incident response team to assess and monitor the incident to comply with applicable legal requirements.


text: Our CISO has served in this position since 2021 and has over two decades of experience in developing robust security programs across various industries. His previous positions include Deputy CISO for the Federal Reserve System, Chief Business Security Officer at ADP and cybersecurity leadership roles at Equifax. Before joining Equifax, he held positions in information security, compliance and internal audit at McKesson Corporation, Fifth Third Bank and AT&T. He also holds numerous industry certifications and serves as the Board Secretary of the Retail & Hospitality Information Sharing and Analysis Center.


text: Board of Directors The Audit Committee of the Board of Directors is primarily responsible for the oversight of risks from cybersecurity threats. This includes the responsibility for reviewing and discussing with management and the Board of Directors our information technology use and protection, including, but not limited to, data governance, privacy, IT risks, compliance, cybersecurity and significant legislative and regulatory developments that could materially impact us, as well as the evaluation with management of the implementation and effectiveness of our controls to monitor and mitigate these risks and the oversight for any investigations related to specific cybersecurity or technology incidents. To fulfill this responsibility, the Audit Committee receives regular reports about cybersecurity risks from our CISO, and receives updates more often as needed, including in the event of a significant cybersecurity incident in accordance with our Cybersecurity Incident Response Plan. These regular reports periodically include information regarding the implementation and administration of the registrants cybersecurity processes, cybersecurity governance processes, status of projects relating to cybersecurity, cybersecurity matters relating to any particular products or services, summaries of any material cybersecurity threats or incidents and responses thereto, regulatory updates, updates on cybersecurity trends and the results of any assessments performed by internal stakeholders or third-party advisors.


text: Our Board of Directors retains responsibility for the oversight of our overall risk management systems and processes and our CISO provides periodic reports to the full Board of Directors on cybersecurity risk. The Board of Directors also participates in educational sessions relating to cybersecurity matters.


text: Cybersecurity Governance The Company's Board of Directors (the "Board") recognizes the critical nature of managing risks associated with cybersecurity threats and is responsible for oversight of the Company's information security programs, including risk of cybersecurity threats. The Audit Committee, which supports the Board of Directors in the oversight of the Company's information security program, oversees managements design, implementation and enforcement of our cybersecurity risk management program. The Audit Committee is composed of Board members with diverse expertise, including technology, financial and risk management experience.

companyName: ASCENT INDUSTRIES CO.

ticker: ACNT


text: The Audit Committee and full Board receive periodic briefings from management on our cyber risk management programs. The Company also has an internal disclosure committee made up of members of management to assist in fulfilling its obligations to maintain disclosure controls and procedures and to coordinate and oversee the process of preparing our periodic securities filings with the SEC. The disclosure committee meets on a quarterly basis to ensure they are appropriately informed of any matters that should be considered in advance of applicable public filings, including cybersecurity and data privacy matters, and to address the proper handling and escalation of information to the Board and Audit Committee as needed.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity and availability of our critical systems and infrastructure. This program includes the implementation of a set of system, network and application level controls to protect our data and systems. These controls are monitored for cybersecurity risks and incidents by internal staff and our third-party service provider and are updated as necessary to protect the Company.