text: Our CISO, who has extensive cybersecurity knowledge and skills gained from over 25 years of work experience, heads the team responsible for cybersecurity. Our CISO's team is responsible for leading enterprise-wide cybersecurity strategy, policy, standards and processes. The team includes senior professionals, many with more than 15 years of cybersecurity expertise and industry certifications such as Certified Information Security Systems Professional, CompTIA Security+, Global Information Assurance Certification, and Certified Ethical Hacker. Members of the team are provided with opportunities to attend external training, conferences, and other events to keep abreast of the latest cybersecurity trends. Our CISO receives ongoing updates from his team regarding the prevention, detection, mitigation, and remediation of cybersecurity incidents.


text: Our CISO meets with our Audit Committee at least annually to discuss cybersecurity risk and related issues. These meetings may encompass a broad range of topics, including: • cybersecurity initiatives and strategies, • cybersecurity events, • emerging threats, • regulatory requirements, and • industry standards.

companyName: FLUOR CORP

ticker: FLR

secItem: Item 1C


text: In the event of a cybersecurity incident, we have an incident response plan which sets forth a framework to report and document such incidents to our cybersecurity incident response team. This framework aims to enable the response team to take actions to monitor, mitigate and remediate such incidents in a timely manner. Cybersecurity incidents are regularly reported to the CIO and CISO and certain critical events are reported to the CEO and the crisis management team comprised of senior executives. We also have protocols in place by which certain cybersecurity incidents are reported to the Board of Directors as part of their oversight of cybersecurity matters.


text: As a key component of Polaris' Enterprise Risk Management process, Polaris' cybersecurity risk management program is designed to align with industry-standard cybersecurity frameworks and includes processes related to each of the following functions for assessing, identifying, and managing risks from cybersecurity threats: identification, protection, detection, response, and recovery. Examples of relevant processes include steps for: assessing the severity of a cybersecurity threat; identifying the source of a cybersecurity threat, including whether the cybersecurity threat is associated with a third-party service provider; implementing cybersecurity countermeasures and mitigation strategies; and remediating and escalating cybersecurity incidents using cross-functional expertise. Our cybersecurity risk management program also includes risk-based processes related to overseeing and identifying cybersecurity risks associated with the use of third-party providers, including processes related to: conducting cybersecurity assessments of third-party service providers, including cybersecurity obligations in contracts with third-party service providers; and receiving and responding to notification of cybersecurity incidents of third-party service providers. Our cybersecurity team engages third-party security experts to assist with our processes for assessing, identifying, and managing risks from cybersecurity threats, including, for example, assessment of the maturity of our cybersecurity risk management program, penetration testing, employee awareness testing, phish testing, and incident monitoring and response, including conducting tabletop exercises.

companyName: Polaris Inc.

ticker: PII


text: Our cybersecurity risk management program is under the direction of our Senior Vice President and Chief Digital and Information Officer, who has 30 years of technology leadership, and staffed by a cybersecurity team that includes personnel with a range of information and product security experience, from early-career professionals with cybersecurity degrees to seasoned professionals with multiple cybersecurity-related certifications and more than twenty years of experience. The Senior Vice President and Chief Digital and Information Officer receives reports from our cybersecurity team on the prevention, detection, mitigation, and remediation of cybersecurity incidents. Our Executive Cybersecurity Council meets as appropriate and receives updates from the Senior Vice President and Chief Digital and Information Officer and the cybersecurity team regarding our cybersecurity risks and risk management program; cybersecurity incidents and our response to them; and, as appropriate, developments in the external cybersecurity landscape, including learnings from external cybersecurity incidents.


text: In 2024, we did not identify any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations, or financial condition. However, despite our efforts, we cannot eliminate all risks from cybersecurity threats, or provide assurances that we have not experienced an undetected cybersecurity incident. For more information about these risks, please see "Risk Factors - Regulatory, Intellectual Property, Cybersecurity and Privacy Risks" in this Annual Report.


text: Risk Management and Strategy Cyber security risk management at Noble, along with all enterprise risks, is part of the Company's Enterprise Risk Management Program and risks from cyber security threats are assessed, identified, and managed by our Information Security Team. The Information Security Team reports to the Chief Information Officer ("CIO"). The Information Security Team is composed of the Director of Information Security, managers, and security analysts.

companyName: Noble Corp plc

ticker: NE


text: The Information Security Team is responsible for all of Noble's cyber security-related activities such as advising on governance requirements, setting cyber security policies, standards, and procedures, reporting, determining current risk appetite, setting security posture, evaluating security maturity, and ensuring compliance to cyber security frameworks. The team monitors both internal and external threats, potential compromising internet-based attacks, phishing activities, and aims to adapt with protective measures.


text: The Director of Information Security and information security managers carry broad manager level cyber security certifications, and the technical teams carry relevant specific technical certifications related to both Information Technology and Operational Technology security.


text: Noble has a process of monitoring all third parties with direct access into the Noble network via various implemented security tools that act as both detective and preventive controls. All third parties with such direct access are also monitored via procurement processes and are subject to specific legal terms and conditions. Noble also engages with various third-party partners in order to share intelligence regarding external threats. For any cyber incidents, Noble may engage applicable third-party partners for forensic purposes.


text: In the last fiscal year, Noble has not identified any known cyber security threats, incidents, or exposures that have materially affected Noble's business strategy, results of operations, or financial condition, but Noble faces certain ongoing cyber security risks that, if realized, could materially and adversely affect Noble. This does not guarantee that future incidents or threats will not have a material impact or that we are not currently the subject of an undetected incident or threat that may have such an impact. Potential cyber security risks to Noble are shared in Part I, Item 1A, "Risk Factors," which should be read in conjunction with the foregoing information.


text: The Audit Committee of the Board provides oversight of the Company's cyber security program. The Information Security Team keeps management informed about initiatives, threats, incidents, training, and best practices on an on-going basis via circulated memos or meetings. In addition to reporting through the Audit Committee and Enterprise Risk Management Program, the Board may periodically include cyber security as an independent agenda item and engages with the CIO and Information Security Team as well as external experts on cyber security matters.


text: The Information Security Team advises the CIO via cyber reports on prevention, detection, mitigation, and remediation of cyber security incidents. The CIO is responsible for the Information Security Team risk strategy, assessment, exceptions, risk acceptance, and management of the Company's material risks from cyber security risk appetites. Ongoing assessments cover applicable information technology and operations technology systems, applications, and software used to support Noble's corporate and rig operations. The outcome of these various assessments influences the IT risk appetite and risk identification, and acceptance is discussed and shared with the CIO, executive management, the Audit Committee, and the Board of Directors.


text: The CIO has extensive cyber security knowledge and skills gained from over ten years of relevant work experience at Noble including two years as Deputy CIO as well as Director, IT prior to the merger with Maersk Drilling with responsibility for cyber security. The CIO has multiple years of experience managing OT data and secure remote access for data management on and offshore. Prior to serving as Director, IT the CIO was the Manager, Business Systems responsible for application management and Enterprise Architecture. The Information Security Team advises the CIO on prevention, detection, mitigation, and remediation of cyber security incidents.


text: The Company has established polices, processes, controls and systems designed to identify, assess, measure, manage, monitor and report risks related to cybersecurity and help prevent or limit the impacts of potential cyber threats and attacks. As cyber threats continue to evolve, the Company expects to continue to expend significant resources to adapt to changes in the threat environment and enhance its measures to detect and prevent cyber attacks or to investigate and remediate known information security vulnerabilities and incidents. The risks faced by the Company from cyber threats that could materially affect the Company, including its business strategy, results of operations or financial condition, are discussed in Part I, Item 1A, "Risk Factors" within this Form 10-K.

companyName: M&T BANK CORP

ticker: MTB


text: Cybersecurity is integrated into the Company's Risk Framework through which the Company identifies, assesses, monitors, controls, communicates and escalates risks. The Risk Framework, which is reviewed and approved by the Risk Committee of the Board of Directors at least annually, represents the Company's overall risk management approach, including the policies, processes, controls and systems, through which the Company seeks to manage risk, including cybersecurity risk. It aims to provide a common foundation for all employees and officers as well as directors to help understand and communicate the types of risks that the Company faces in pursuit of its business objectives. The Risk Framework includes oversight by management through a multi-tiered committee structure responsible for overseeing proactive risk identification, developing an aggregated view of risks, and providing a consistent governance methodology across the Company. All such committees, including a management committee which has primary authority for oversight of cybersecurity, report up to the Management Risk Committee, which is chaired by the Chief Risk Officer, and serves as the executive level committee responsible for the implementation and oversight of the Risk Framework. The Risk Framework is designed to ensure the Board of Directors and its Risk Committee, which is the primary Board committee that oversees cybersecurity, are provided the information necessary to be effective in its risk management oversight responsibilities.


text: The Risk Committee of the Board of Directors, including a subcommittee of the Risk Committee, provides oversight of cybersecurity risks and receives regular reports on cybersecurity from the CISO. The CISO is responsible for the design and execution of the Company's Information Security Program, which is supported by the governance structure defined within the Risk Framework. The CISO reports as necessary to executive management, the Risk Committee of the Board and the Board of Directors on cyber and information security issues and the effectiveness of the Company's cyber and Information Security Program. The Risk Committee of the Board and the Board of Directors receive the results of the Company's annual cybersecurity risk assessment. Aligned with leading industry standards, including the U.S. Department of Commerce's National Institute of Standards and Technology Cybersecurity Framework, the Information Security Program is built upon a foundation of policies, standards and procedures, which leverage the National Institute of Standards and Technology standards and regulatory requirements, to help safeguard customer information and reduce the risk of cyber incidents and breaches. The Information Security Program features layered controls of network and endpoint intrusion detection and prevention, enterprise malware protection, threat-monitoring and a Security Operations Center that provides full-time support and additional operational measures to monitor and respond to data breaches and cyber attacks.


text: The Company has also established processes to oversee and identify cybersecurity risks from third-party service providers. Third-party service providers (including suppliers and business partners) are required to have security policies, standards and procedures that meet or exceed the information security guidelines as specified in the Information Security Program. The Company has an established third-party due diligence program designed to ensure vendors meet the Company's expectations as agreed to in their contract. Roles, responsibilities and expectations for service providers and other third parties are communicated and documented through contracts (and other associated agreements) and monitored through oversight as part of the Company's Third-Party Risk Management Program.


text: The Company's Cybersecurity Leadership Team includes the CISO who is responsible for overseeing and reporting on the development and implementation of the Company's Information Security Program. The CISO has over twenty years of experience in information security for large financial institutions and has served as chairman for the Bank Policy Institute's Technology Policy Division Information Security Committee and as a board member of Financial Services Information Sharing and Analysis Center. The CISO currently serves on the Advisory Council for New York University's Graduate School of Engineering, as well as the Advisory Board for University of North Carolina - Charlotte College of Computing and Informatics. The CISO reports to the Company's Chief Information Officer, Mr. Michael A. Wisler, who is an Executive Officer of M&T and has two decades of experience in the financial and technology industries. Prior to joining the Company in 2018, Mr. Wisler served as Chief Technology Officer of North American Credit Cards and Chief Information Officer of Europe at Capital One Financial Corporation. Mr. Wisler holds a Masters of Science in Management of Information Technology from the University of Virginia. In addition, the Cybersecurity Leadership Team includes management with expertise in vulnerability management, digital forensics, threat intelligence, software development, cybersecurity operations, and project management. Many individuals on the Cybersecurity Leadership Team hold cybersecurity-relevant certifications.


text: The Company's Information Security Awareness Program, a component of the Information Security Program, is designed to ensure that all employees and contingent workers are aware of relevant cyber-related policies, principles, standards and practices, as well as new and current regulatory requirements related to safeguarding customer and corporate information assets. Cybersecurity awareness initiatives and resources are regularly provided to employees and contingent workers, including through mandatory annual cybersecurity awareness training, ongoing simulated phishing email exercises and communications from the Company's Cybersecurity Division on the Company's internal communication channels.


text: Threats can come from many sources, including, but not limited to, ransomware, malicious software, credential loss or theft, supervisory control and data acquisition system takeover, equipment theft, supply chain attacks, phishing attacks, identity-based attacks, denial-of-service attacks or the actions of employees either intentional or accidental. Ransomware whereby hackers take control of a company's systems and/or data has been identified as the most significant threat to Registrant's critical infrastructure systems and is getting harder to detect and encrypted files are becoming harder to recover. Threat actors using ransomware have also increased their use of data, not only for direct ransom and data destruction, but also to release the data to the public. Registrant believes a breach of customer personally identifiable information is one of the most significant financial risks to it as the costs incurred could exceed the amount of its cybersecurity insurance coverage. Nevertheless, in order to continue meeting Registrant's technological business needs and as more vendors build solutions in the cloud, Registrant expects to further expand its use of cloud-computing environments. As such, Registrant expects risks from cyberattacks and data breaches to increase due to the growth of its technological footprint in the cloud environments.

companyName: AMERICAN STATES WATER CO

ticker: AWR


text: As cyberattacks have become more frequent and sophisticated, including against third-party technology providers, Registrant expects to continue to increase its investment in information and operational technology to monitor and address cyber threats and attempted cyberattacks, and to improve its posture in addressing security vulnerabilities. Registrant has implemented robust cybersecurity systems and controls to prevent any unauthorized access to information. Its platform was designed to be consistent with industry best practices such as the U.S. National Institute of Standards and Technology ("NIST")


text: cybersecurity frameworks. In addition, Registrant has dedicated employees with cybersecurity technical expertise and also leverages outside cybersecurity firms. Registrant has adopted multi-layered safeguards and educational measures to protect its operations, assets and digital information. Registrant conducts mandatory quarterly cybersecurity training for all employees. Registrant also conducts specialized training for ASUS employees annually on protecting certain types of information relating to the work ASUS and its subsidiaries do with the U.S. government to comply with U.S. government contracting requirements. In addition, Registrant conducts periodic and unannounced phishing tests with all employees and vulnerability assessment and penetration tests.


text: To keep threat and vulnerability information up-to-date, the cybersecurity team subscribes to multiple national and state-level threat and vulnerability information disclosure services, both general-purpose and industry-specific in nature. Updates from these sources include general information delivered on a daily basis and more threat-specific information delivered as required. Tools are in place within Registrant's environment to monitor for anomalous behavior and provide rapid alerting for emerging threats and, in some cases, automated responses to threats. Registrant's cybersecurity team meets regularly with product vendors for these tools to ensure optimal configurations are in place to protect its environment.


text: To determine the risk to Registrant's systems, it engages in a continuous vulnerability management lifecycle process to identify and remediate vulnerable systems and system configurations. In this regard, Registrant leverages the NIST cybersecurity frameworks. To supplement Registrant's internal process, the cybersecurity team regularly contracts consultants to assess system configurations, both passively through exercises such as configuration review and actively through penetration testing, and response procedures, such as tabletop exercises, to identify areas for improvement. In addition, Registrant supplements its day-to-day operations with around the clock identification, assessment and mitigation of cyber risks with third-party security services as well. Registrant is working on implementing across AWR and its subsidiaries a comprehensive, risk-based approach to identify and oversee cybersecurity risks presented by third parties, including vendors, service providers and other external users of its systems and data, as well as the systems of third parties that could adversely impact Registrant's business in the event of a cybersecurity incident affecting those third-party systems.


text: Cybersecurity updates are provided periodically to Registrant's senior management, including its CEO, CFO and senior vice presidents of Registrant's operations, and to the senior management of Registrant's subsidiaries. Cybersecurity risk management extends beyond Registrant's and its subsidiaries' senior management teams. Registrant's Board of Directors (the "Board") oversees enterprise risk management, or ERM, performed under the direction of Registrant's senior management team. Cybersecurity updates, including recent findings, changes to processes or personnel changes, are provided to the ERM liaison to the Board, who is a member of the Board, and to the full Board on a quarterly basis or more frequently if needed. Cybersecurity is one component of an overall ERM framework that involves Registrant's Board. The Board satisfies its oversight responsibility by obtaining information from the ERM liaison and senior management of Registrant, with input from the senior management of Registrant's subsidiaries as necessary. On a quarterly basis, Registrant's senior management will discuss plans to mitigate cybersecurity risks with the ERM liaison. The ERM liaison and Registrant's senior management will then provide a report to the full Board regarding the critical cybersecurity risks discussed, mitigation plans and implementation of the ERM program that addresses cybersecurity risks.


text: In addition, Registrant's plans require members of its senior management, such as its CEO and CFO, as well as members of management from its, and its subsidiaries', Operations, Information Technology, Human Capital Management, Accounting and Legal teams to participate in Registrant's Cybersecurity Incident Response Team ("CIRT") and to be kept current on all aspects related to a cyberattack, if a cybersecurity incident were to occur.


text: Responses to cyberattacks are fast-moving and dynamic and would require an assessment of actual or potential damage performed by Registrant's cybersecurity team. If a cyberattack were to occur, continuous engagement, communication and collaboration between Registrant's cybersecurity team and members of its CIRT as well as third parties would likely be necessary in order to gather accurate and complete information, perform a comprehensive evaluation and assessment of the cyberattack, manage and contain the cybersecurity threat, and develop and execute a remediation and recovery plan. Members of its CIRT team would work together to determine whether a cybersecurity breach is material and required to be reported to the Board and publicly under applicable law and regulation.


text: To ensure that members of Registrant's Board are informed of material cyberattacks, Registrant's CFO and IT Director have been designated as key members of management that will provide current updates to Registrant's ERM liaison and the Board. The communication will include but not be limited to, the nature and status of the cyberattack and Registrant's plan to contain and mitigate the cyber threat and ultimately the remediation and recovery plan to return to "business as usual" state. Registrant's CFO has over 15 years overseeing the Company's risk management area. Registrant's IT Director has over 25 years in Information Technology designing, implementing and supporting various cybersecurity and technical solutions, along with ensuring compliance with multiple cybersecurity regulations.


text: Risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect Registrant, including its business strategy, results of operations or financial condition. However, the risk of cybersecurity threats could be significant if a cyberattack disrupts Registrant's critical operations, service or financial systems. See "Information Technology Risk Factors" under Item 1A. In addition, any unauthorized access to sensitive information or data breaches could be detrimental to Registrant's operations, critical corporate information and reputation and relationships with its customers, vendors, employees, directors and could negatively affect the future of contract awards at ASUS and could result in a termination of one or more of its existing contracts or the assessment of penalties. The cost of responding to a cyberattack could be significant depending on the severity of the cyberattack and could go beyond financial costs as operations and services provided by Registrant could be delayed and coordinated resources in response could be significant. Registrant could also be assessed penalties if it is determined that applicable data privacy laws have been violated.


text: The Company has implemented controls based on the National Institute of Standards and Technology Cybersecurity Framework (the "NIST CSF") and the Sarbanes-Oxley Act of 2002. Our Information Technology organization is led by the Chief Information Officer ("CIO") who is responsible for cybersecurity risk management. The Audit Committee of the Board of Directors is tasked with oversight of our overall enterprise risk management program, including cybersecurity, and receives recurring cybersecurity updates throughout the year with at least two cybersecurity reports to the full Board of Directors annually. Directors with experience in cybersecurity and technology play crucial oversight roles for our digital and cybersecurity strategies.

companyName: Ingersoll Rand Inc.

ticker: IR


text: As of the date of this report, we do not believe any risks from cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. For a discussion of the risks and uncertainties that cybersecurity incidents may have on us, see "Risk Factors: Information systems failure or disruption, due to cyber terrorism or other actions, may adversely impact our business and result in financial loss to the Company or liability to our customers" in this Form 10-K.


text: Risk Management and Strategy We have a risk management process and strategy in place for assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity risk management framework is closely aligned with the National Institute of Standards and Technology's ("NIST") Cybersecurity Framework ("CSF") and is incorporated into our enterprise risk management process, information systems, vendor engagement process and employee training programs. We focus on people, processes and technology to build a defensive posture against cybersecurity threats that minimizes disruption to our business while maximizing the security and resiliency of the organization.

companyName: CHIMERA INVESTMENT CORP

ticker: CIM


text: We believe that one of the first lines of defense against cybersecurity threats is our employees. Accordingly, we require all new employees to complete cybersecurity training. In addition, we provide quarterly cybersecurity training to existing employees, conduct simulated phishing tests, and perform security awareness proficiency assessments to create more effective and targeted training campaigns to strengthen the human firewall. We also require our employees to annually re-affirm adherence to company-wide IT and related policies designed to protect our information and communications systems. As part of our cybersecurity risk management process, we also conduct third-party led tabletop exercises to practice and prepare to respond to a confirmed or suspected security incident and to highlight any areas for potential improvement.


text: We also maintain policies, procedures and governance structures designed to help us identify, assess and respond to cybersecurity risks. We have a written cybersecurity framework that closely aligns with the NIST's CSF. In addition, we maintain a cyber incident response plan to facilitate our response to cybersecurity incidents and formed an Incident Response Team composed of the Chief Information Security Officer & Head of IT Infrastructure ("CISO"), the Chief Credit & Risk Officer, the Chief Legal Officer, the Head of Operations, the Chief Compliance Officer of the RIA, the Head of Data Science, and the Associate General Counsel. The foregoing officers also include within their working teams, non-management employees who are best positioned to identify, assess, respond to and galvanize both internal and third-party resources necessary in the event of a cybersecurity incident. We test the resiliency of our systems through penetration and disaster recovery tests to continually improve our business continuity plan against an ever-changing threat landscape, create redundancies where appropriate for the protection of the Company's assets, have engaged a security operations center to provide 24/7 monitoring of our environment to detect and respond to suspicious activities in the network, and have cybersecurity insurance. We periodically perform an independent third-party cybersecurity maturity assessment of our systems, policies and procedures focused on the NIST's CSF and the SEC's Office of Compliance Inspections and Examinations cybersecurity guidance.


text: We have also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, including requiring key service providers to provide evidence that their systems meet appropriate cybersecurity requirements. We collaborate with service providers to help assess the sufficiency of their cybersecurity measures and require service providers to notify us promptly of cyber incidents that may affect our systems or data.


text: Lastly, we use technology to minimize our exposure to cybersecurity vulnerabilities and promote a safe information and communications systems environment. We avail ourselves of third-party technologies and tools, including tools provided by the Cybersecurity and Infrastructure Security Agency (CISA), other government agencies and third-party cybersecurity experts.


text: In December 2024, we completed the Palisades Acquisition and have aligned all new employees acquired through such acquisition with our cybersecurity training and governance framework, including the Incident Response Team, which now includes legacy Palisades employees. We are conducting comprehensive risk assessments to identify additional steps that may be necessary to fully align the legacy Palisades information systems and cyber security practices with our systems and practices.


text: To date, no risks from cybersecurity threats, including those resulting from any previous cybersecurity incidents, have materially affected us, or, to our knowledge are reasonably likely to materially affect us including our business strategy, results of operations or financial condition. For further discussion, please see the risk factor titled "We are dependent on information technology and systems, including those of third parties, and their failure, including through a cyber-attack, could significantly disrupt our business or result in the disclosure or misuse of confidential or other information, including personal information, which could damage our reputation, result in regulatory sanctions, subject us to litigation and/or increase our costs and cause losses that have a material adverse impact on our business, financial results and financial condition" in Item 1A. "Risk Factors" in this Annual Report on Form 10-K.


text: Our Board of Directors, in coordination with the Audit Committee and the Risk Committee, oversees management of cybersecurity risk. They receive regular reports from senior management and our CISO on, among other things, the threat landscape, the Company's cybersecurity program, infrastructure improvements, cybersecurity incident investigations and information security vulnerabilities. The Audit Committee focuses on cybersecurity risk, particularly as it relates to enterprise risk management within the audit and financial reporting process, while the Risk Committee focuses on cybersecurity risk within the Company's overall business risk profile. Refer to Item 7A, "Quantitative or Qualitative Disclosures about Market Risk - Risk Management" included in this 2024 Form 10-K for additional information on our enterprise risk management.


text: The Company's CISO has a Bachelor of Engineering degree in information technology and more than 25 years of experience in the information technology space, including extensive experience leading our internal IT infrastructure and cybersecurity team. The CISO receives regular updates on cybersecurity matters from his internal IT infrastructure and cybersecurity team as well as outside vendors and advisors that we have engaged. Employees outside of the IT infrastructure and cybersecurity team also elevate any potential cybersecurity issues, whether internal or at a third party with whom we do business, to the CISO.


text: The Incident Response Team and the non-management employees who support the Incident Response Team identify, assess, respond to and coordinate both internal and third-party resources in the event of a cybersecurity incident. In the event of a potentially material cybersecurity event, all members of the Incident Response Team are notified and a preliminary assessment of the situation is made. Designated individuals within the Incident Response Team notify the Chief Executive Officer, and if the situation so warrants, the Board of Directors, cybersecurity experts, outside counsel and other advisors to help further assess and formulate an appropriate response to the situation and regulatory and other government authorities as applicable and as required by law.


text: Our efforts are led by ACV's Chief Information Officer ("CIO") with the oversight of our Audit Committee, Chief Legal Officer and Chief Financial Officer, who oversees a team of cybersecurity professionals (the "Cybersecurity Department") dedicated to identifying, assessing, escalating, responding to, and recovering from cybersecurity threats on a day-to-day basis.

companyName: ACV Auctions Inc.

ticker: ACVA


text: Risk Management and Strategy We have implemented processes for overseeing, identifying and managing material risks from cybersecurity threats and have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level and that cybersecurity risk remains a key component of management activities, including continuously assessing, identifying, and managing material risks from cybersecurity threats. Our cybersecurity program is based on the U.S. National Institute for Standards and Technology standards and other applicable country-specific and industry frameworks.

companyName: LAUREATE EDUCATION, INC.

ticker: LAUR


text: Our CISO (who also serves as our Chief Information Officer) leads our information security organization and has primary responsibility for information security strategy, policy, managing our cybersecurity threat detection and response plan, and assessing and managing material risks from cybersecurity threats. With over 25 years of experience in information security, IT infrastructure and cybersecurity and with several industry certifications such as the Certified Chief Information Security Officer certification, our CISO brings a wealth of expertise to the role. Our CISO oversees our cybersecurity governance programs, monitors and assesses cybersecurity threats, monitor compliance with industry best practices and standards, and leads our ongoing employee cybersecurity training and awareness program.


text: Our Director of Information Security leads the Information Security Program and reports to the CIO, who also provides additional oversight of the Program. The Director of Information Security has over 19 years of experience in the information technology and information security fields and the CIO has over 29 years of experience in the information technology and information security fields. In addition, we have established a Security Steering Committee that provides guidance and direction to the CIO regarding the Information Security Program, including approval of the Program mission and its objectives. The Security Steering Committee meets at least quarterly and its membership includes, at a minimum, the Director of Information Security, the CIO, the COO, the CFO, the Sr. Vice President of Engineering and Operations, the VP of Legal/General Counsel and the CEO. Information security risks are reviewed with the Security Steering Committee periodically or as needed.

companyName: SHENANDOAH TELECOMMUNICATIONS CO/VA/

ticker: SHEN


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity program intended to manage risk, and protect the confidentiality, integrity, and availability of our critical systems and information. We design, assess and benchmark our program based on the National Institute of Standards and Technology Cybersecurity Framework.

companyName: ARDELYX, INC.

ticker: ARDX


text: Our cybersecurity risk management program is integrated into our overall enterprise risk management program, and shares common methodologies, reporting channels and governance processes that apply across the enterprise risk management program, in areas such as legal, compliance, strategic, operational and financial risk.


text: Key elements of our cybersecurity program include but are not limited to the following: • risk assessments designed to help identify material risks from cybersecurity threats to our critical systems and information; • a security team principally responsible for managing (1) our cybersecurity risk assessment processes, (2) our security controls and (3) our response to cybersecurity incidents; • the use of external service providers, where appropriate, to assess, test or otherwise assist with aspects of our security processes; • cybersecurity awareness training of our employees, including incident response personnel and senior management; • a cybersecurity incident response plan that includes procedures for responding to cybersecurity incidents; and • a third-party risk management process for service providers, suppliers and vendors that have access to our critical systems and information based on our assessment of their criticality to our operations and respective risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our operations, business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized are reasonably likely to materially affect us, including our operations, business strategy, results of operations or financial condition. For more information, see the section titled "Risk Factors— We and our collaborators, CROs and other contractors and consultants depend on information technology systems, and any failure of these systems could harm our business. Security breaches, loss of data, and other disruptions could compromise sensitive information related to our business or prevent us from accessing critical information and expose us to liability, which could adversely affect our business, results of operations and financial condition."


text: Cybersecurity Governance Our board of directors considers cybersecurity risk as part of its risk oversight function and has delegated to the Audit and Compliance Committee (Committee) oversight of cybersecurity risks, including oversight of management's implementation of our cybersecurity risk management program, maintains a strategic role in coordinating cyber risk initiatives and policies, and confirming their efficacy.


text: The Committee receives annual reports from management on our cybersecurity posture. In addition, management updates the Committee where it deems appropriate regarding any cybersecurity incidents it considers to be significant or potentially significant.


text: The Committee reports to the full board of directors regarding its activities, including those related to cybersecurity. The board of directors also receives periodic briefings from management on our cybersecurity program. The board members receive presentations on cybersecurity topics from our Chief Information Officer, internal security staff or external experts as part of the board of directors' continuing education on topics that impact public companies.


text: Our Chief Information Officer has over 20 years of experience in overseeing cybersecurity and risk management. In addition, our Chief Legal and Administrative Officer has over 25 years of risk management experience and our Chief Financial and Operations Officer has over 20 years of experience in overseeing risk management and cybersecurity. This team is responsible for assessing and managing our material risks from cybersecurity threats and has primary responsibility for our overall cybersecurity risk management program and supervises both our internal cybersecurity personnel and our retained external cybersecurity consultants. Our management team's experience includes experience running cybersecurity programs at similarly situated commercial biotechnology organizations and navigating the associated risk landscape.


text: Our management team takes steps to stay informed about and monitor efforts to prevent, detect, mitigate, and remediate cybersecurity risks and incidents through various means, which may include briefings from internal security personnel, threat intelligence and other information obtained from governmental, public or private sources, including external consultants engaged by us and alerts and reports produced by security tools deployed in the IT environment.


text: We manage risks from cybersecurity threats through our overall enterprise risk management process. Management has created an information security program, which encompasses a dedicated information security team and policies, procedures, and processes for assessing, identifying, and managing risks from cybersecurity threats. We "proactively" assess, identify, and manage risks from cybersecurity threats through various mechanisms, which from time to time may include internal audits, external audits, penetration tests, and engagement of third parties to conduct analyses of our information security program. Through our centralized enterprise risk management function, we also maintain processes for overseeing and identifying risks associated with third party service providers with whom we do business, including risks related to cybersecurity.

companyName: LAMAR ADVERTISING CO/NEW

ticker: LAMR


text: While to date we have not had a major cyber incident against our platforms, nor experienced significant data loss or any material financial losses related to cybersecurity attacks, it is possible that we could experience a significant event in the future. Risks and exposures related to cybersecurity attacks are expected to remain high for the foreseeable future due to the rapidly evolving nature and sophistication of these threats. See Item 1A. "Risk Factors." – "Our business and operations could suffer in the event of cybersecurity breaches and we may incur significant legal and financial exposure." for further discussion of potential risks related to cybersecurity incidents.


text: Our Senior Vice President of Technology and Innovation and Vice President of Network Infrastructure and Cyber Strategy oversee our cybersecurity program. They hold degrees in industrial engineering and computer science and information systems and decision science, respectively. The team responsible with administering our cyber security program has a combined 37 years of experience in cybersecurity, information security and information technology risk management, governance, risk, and compliance. Our board of directors and our audit committee are regularly updated on cyber security as part of their oversight of relevant cybersecurity risks. These reports address key cybersecurity topics, including the implementation and operation of preventative controls and the detection, mitigation and remediation of cybersecurity incidents.


text: Risk Management and Strategy Our enterprise risk management includes a comprehensive cybersecurity risk management program with policies, standards, processes and practices based on recognized industry standards and frameworks such as the National Institute of Standards and Technology (NIST), Cybersecurity Framework (CSF) and the Center for Internet Security (CIS) critical security controls.

companyName: Crane NXT, Co.

ticker: CXT


text: Our cybersecurity program includes regular training for personnel, an incident response protocol tested at least annually as part of our enterprise-wide crisis response program, cybersecurity insurance, and regular assessments through activities such as penetration testing, and compliance audits performed on our information technology networks and systems by both our internal cybersecurity teams and external service providers.


text: Although we have continued to invest in our due diligence, onboarding, and monitoring capabilities over external partners with whom we do business, including our third-party vendors and service providers, our control over the security posture of, and ability to monitor the cybersecurity practices of, such external partners remains limited, and there can be no assurance that we can prevent, mitigate, or remediate the risk of any compromise or failure in the cybersecurity infrastructure owned or controlled by such external partners. When we do become aware that an external partner has experienced such compromise or failure, we attempt to mitigate our risk, including by terminating such external partner's connection to our information technology networks and systems where appropriate. For more information on cybersecurity risks and how they affect our business, operating results and financial condition, refer to Item 1A, Risk Factors. As of the date of the filing of this Current Report on Form 10-K, we have not identified any risks from a cybersecurity threat or incident that we believe has materially affected or is reasonably likely to materially affect the Company.


text: Governance, Oversight and Leadership Our Board of Directors has charged the Audit Committee with responsibility for monitoring the Company's processes and procedures for enterprise risk identification, assessment and management, and cybersecurity represents an important component of our overall approach to enterprise risk management.


text: The Audit Committee receives regular reports at least twice annually from our Chief Information Security Officers ("CISO") on a wide range of cybersecurity topics, including our cybersecurity program's performance, results of assessments, emerging threats, capability enhancements, and recent developments and trends.


text: Our CISO, who reports to our Chief Financial Officer ("CFO"), leads our cybersecurity program and has more than 20 years of cybersecurity experience. The cybersecurity teams reporting to our CISO are staffed by highly skilled cybersecurity professionals, including both internal staff and external partners, with broad knowledge of cybersecurity issues from experience and through training and certifications. Our cybersecurity teams are responsible for detecting, mitigating, and responding to cybersecurity threats through a network of technologies, capabilities, and best practices on a 24/7 basis. Our CISO, in coordination with our cybersecurity teams, and members of our senior leadership team such as our Chief Executive Officer ("CEO"), CFO and General Counsel ("GC"), works collaboratively across the Company to operate a program designed to protect our business from cybersecurity threats and respond to any cybersecurity incidents in accordance with our incident response and recovery plans in real time.


text: We have established internal reporting processes designed to ensure that our Board of Directors and the Audit Committee receive information regarding any cybersecurity incident that meets established reporting thresholds, as well as ongoing updates regarding any such incident until it has been addressed. In the event of a cybersecurity incident, the materiality of the incident will be evaluated and determined with appropriate input from the CEO, CFO, GC, CISO and other key participants in our cybersecurity program, including external advisors to the extent appropriate.


text: Cybersecurity Risk Management and Strategy We have developed and implemented a cybersecurity risk management program intended to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program includes a cybersecurity incident response standard.

companyName: SLM Corp

ticker: SLM


text: We use the Cyber Risk Institute Profile (which is based on the National Institute of Standards and Technology Cybersecurity Framework), the Federal Financial Institutions Examination Council Information Technology Examination Handbook, and the Payment Card Industry Data Security Standards as guides to help us identify, assess, and manage cybersecurity risks relevant to our business and develop and implement our cybersecurity risk management program. This does not imply that we meet any particular technical standards, specifications, or requirements.


text: Our cybersecurity risk management program includes the following key elements: • risk assessments designed to help identify material cybersecurity risks to our critical systems, information, services, and our broader enterprise information technology ("IT") environment; • a team comprised of IT security, IT infrastructure, and IT compliance personnel principally responsible for directing (i) our cybersecurity risk assessment processes, (ii) our security processes, and (iii) our response to cybersecurity incidents; • the use of external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • cybersecurity awareness training of employees with access to our IT systems; • a cybersecurity incident response standard and Crisis Management Policy that guide our response to cybersecurity incidents; and • a third-party risk identification and management process for service providers.


text: We face certain ongoing risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, and/or financial condition. See Item 1A. "Risk Factors – OPERATIONAL RISKS – We depend on secure information technology and a breach of those systems or those of third-party vendors could result in significant losses, unauthorized disclosure of confidential customer information, and reputational damage, which could materially adversely affect our business, financial condition, and/or results of operations and could lead to significant financial, legal, and reputational exposure" in this Form 10-K.


text: Cybersecurity Program Overview The Company's cybersecurity program is structured around the cybersecurity framework ("Cybersecurity Framework") of the National Institute of Standards and Technology ("NIST"), an agency of the U.S. Department of Commerce. The Cybersecurity Framework provides best practices to prevent, detect, identify, respond to, and recover from cyber-attacks. The Company's cybersecurity program involves establishing information security policies, procedures and standards, investing in and implementing information protection processes, security measures and technologies, ongoing monitoring of systems and networks on which the Company relies, cybersecurity training and collaborating with public and private organizations on cyber threat information and best practices. We also assess and identify potential cyber and information security risks relating to third-party technology providers. These efforts may include due diligence to assess the party's cybersecurity practices, controls, and compliance with relevant statutes and regulations; the use of contractual agreements that outline certain cybersecurity requirements; and using outside services to perform ongoing monitoring of select suppliers and third-party service providers. We may also collaborate with third-party suppliers to develop and align incident response plans. The Company actively monitors the current threat landscape in an effort to identify material risks arising from new and evolving cybersecurity threats. The Company engages an external third-party cybersecurity assessor to perform an annual assessment or validation of the cybersecurity program in accordance with the Cybersecurity Framework and the HIPAA Security Risk Assessment Tool of the U.S. Health and Human Services Office for Civil Rights.

companyName: SELECT MEDICAL HOLDINGS CORP

ticker: SEM


text: Management's Role in Cybersecurity Risk Management The Company's management, including the Company's CIO and CISO, is responsible for assessing and managing material risks from cybersecurity threats. The Company's CIO and CISO each have more than 20 years of experience in cybersecurity. The Company provides formalized cybersecurity training for newly-hired employees and annually for existing employees. In addition, the Company provides cybersecurity awareness training and education throughout the year. The annual cybersecurity training curriculum includes modules on information security, the employee's role in protecting Company information, recognizing different cybersecurity incidents, identifying phishing emails, understanding the appropriate personnel to approach with information or questions, and acceptance of the Company's Information Security Policy. The Company's management is informed of cybersecurity incidents through ongoing monitoring and, in some cases, through receipt of notifications from third-party service providers. The CISO maintains and annually updates a Cybersecurity Incident Response Plan, which is a guide for the Company's cybersecurity team to respond effectively to cybersecurity incidents in a coordinated manner in the interest of minimizing the risk of harm. The team works with colleagues in various departments throughout the Company, including Information Technology, Human Resources, Legal, Risk Management and Compliance, to prevent, mitigate and remediate cybersecurity incidents impacting the Company.


text: Assessment of Cybersecurity Risk Management continuously assesses the potential impact of risks from cybersecurity threats on the Company, and regularly evaluates how such risks could materially affect the Company's business strategy, operational results, and financial condition. As noted above, an assessment of the cybersecurity program leveraging the Cybersecurity Framework is completed annually by an independent and qualified external third-party cybersecurity assessor. The Company has not experienced a cybersecurity breach or information security breach during the past four fiscal years. The Company, from time to time, has been notified of third-party information cybersecurity breaches, but none of them has had a material impact on the Company's operations or financial results. The Company annually purchases a cybersecurity risk insurance policy to help defray the costs associated with any covered cybersecurity incident. Although the Company did not experience a material cybersecurity incident during the year ended December 31, 2024, the scope and impact of any future incident cannot be predicted.


text: All companies that maintain sensitive or confidential data or utilize technology are subject to the threat of unauthorized persons gaining unapproved access to systems or components of systems. In order to mitigate this threat to our business, we take a comprehensive approach to cybersecurity risk management. We have devoted significant resources to implement and maintain cybersecurity measures to meet regulatory requirements and the expectations of our clients, trading partners, and other stakeholders. We intend to continue to evolve our cybersecurity defenses and strategy and to make significant investments to maintain the security of our data and cybersecurity infrastructure.

companyName: RYAN SPECIALTY HOLDINGS, INC.

ticker: RYAN


text: We face a number of cybersecurity risks in connection with our business. As of the date of this report, we are not aware of any cybersecurity incidents that materially impacted the Company in the last three years. Although such risks have not materially affected us, including our business strategy, results of operations or financial condition to date, we have, from time to time, experienced threats to and unauthorized persons gaining unapproved access to, including breaches of, our data and systems, including insider threats and phishing attacks. For more information about the cybersecurity risks we face, see " Risk Factors – We rely on the efficient, uninterrupted, and secure operation of complex information technology systems and networks to operate our business. Any significant system or network disruption due to a breach in the security of our information technology systems could have a negative impact on our reputation, regulatory compliance status, operations, sales, and operating results " included elsewhere in this Annual Report


text: Risk Management and Strategy Ryan Specialty's processes for assessing, identifying, and managing material risks from cybersecurity threats is integrated into our overall enterprise risk management program, which is overseen by the Audit Committee of the Board (the "Audit Committee"). The Audit Committee is charged with reviewing our cybersecurity processes for assessing key strategic, operational and compliance risks. The Audit Committee then provides updates on significant cybersecurity matters to the Board periodically. We have established comprehensive cybersecurity policies, standards, processes, practices, and controls to mitigate the risk of cyber threats, and we continually invest in prevention and detection technology and employee training to enhance our cybersecurity posture. Our cybersecurity risk management program leverages and strives to align with the U.S. National Institute of Standards and Technology Cybersecurity Framework, which organizes cybersecurity risks into five categories: identify, protect, detect, respond, and recover.


text: Our cybersecurity risks are identified and addressed through a comprehensive, cross-functional approach. Key security, risk, legal, compliance, IT, and business leaders meet regularly to develop strategies for preserving the confidentiality, integrity, and availability of Company, employee, and third-party information provided to us; identifying, preventing, and mitigating cybersecurity threats; and effectively responding to cybersecurity incidents. We maintain controls and procedures that are designed to ensure prompt escalation of certain cybersecurity incidents so that decisions regarding legal and regulatory compliance, public disclosure, and reporting of such incidents can be made by management and presented to the Audit Committee and the Board, as necessary, in a timely manner.


text: Risk Assessment and Technical Safeguards Our Information Security Steering Committee (the "Security Committee"), which is led by our Company's Chief Information Security Officer ("CISO"), meets quarterly to prioritize and align actions with business priorities, manage issues, and respond to changes in regulatory requirements. At least annually, we conduct a cybersecurity risk assessment that takes into account information from internal stakeholders, known security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants) and includes a tabletop exercise and external and internal penetration testing.


text: The results of the assessment are used to drive alignment on, and prioritization of, initiatives to enhance our preventive and detective security controls, make recommendations to improve processes, and inform a broader enterprise-level risk assessment that is presented to members of management, the Audit Committee, which is comprised solely of independent directors, and the Board, when necessary. Throughout the year we do vulnerability testing. We regularly assess and deploy technical safeguards designed to protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on industry best practices, vulnerability assessments, cybersecurity threat intelligence, input from consultants, and incident response experience.


text: Monitoring and Incident Response Plan Information Security risks are monitored by our security operations center team along with managed services providing 24x7x365 monitoring and response. Ryan Specialty retains third-party resources with a leading cybersecurity company for incident response when needed, including remediation. We apply lessons learned from our defense and monitoring efforts to help manage and prevent future incidents. We have established a comprehensive incident response plan that is regularly tested and evaluated to confirm its effectiveness. In the event our CISO determines a cybersecurity incident needs to be escalated, she engages our critical escalation team who, with the assistance of third-party consultants, will make the determination as to whether the incident is material and whether escalation to senior management, the Audit Committee, and/or the Board is required.


text: Third-Party Risk Assessments We conduct information security assessments before sharing or allowing the hosting of sensitive data in computing environments managed by third parties, and our standard terms and conditions contain contractual provisions requiring certain security protections and require those vendors and providers, that meet certain risk profiles, to meet appropriate security requirements, controls, and responsibilities.


text: Education and Awareness Our policies require each of our employees to contribute to our data security efforts. We regularly remind employees of the importance of properly handling and protecting Company, employee, and third-party data, including through annual privacy and security training to enhance employee awareness of how to recognize, detect, and respond to cybersecurity threats. In addition to the annual training requirements, we regularly send employees mock phishing emails to test their ability to assess incoming email threats.


text: For companies that we acquire, our integration efforts include, where appropriate, workable timelines for alignment on information security, data privacy, cybersecurity and employee education.


text: The Audit Committee oversees our overall enterprise risk assessment and risk management policies including risks related to cybersecurity. The Board and Audit Committee set the tone at the top by providing oversight and establishing expectations for the overall effectiveness and efficiency of the information security program. Each quarter, our CISO provides a quarterly update to the Audit Committee about our cybersecurity program, including detection, mitigation, and remediation of significant incidents, if any, that occurred during the quarter. Additionally, on an annual basis, the CISO delivers reports to the Board and Audit Committee with an annual cybersecurity risk assessment that includes information concerning the prevention, detection, mitigation, and remediation of cybersecurity incidents, if any, including material security risks and information security vulnerabilities. The Audit Committee provides a quarterly summary of all important issues to the full Board.


text: In addition, if warranted based on our response plan, cyber security incidents will be escalated to the attention of the Audit Committee while such incidents are ongoing.


text: Management's Role Primary responsibility for assessing and managing our cybersecurity risks rests with our CISO, who reports to our Executive Vice President, Operations, Technology & Data Analytics ("EVP OP"). Both are members of our Security Committee, which is a governing body that drives alignment on security decisions across the Company. The Security Committee includes management across the departments and functions of the organization to enable transparency and alignment with the business' strategic goals and objectives. The Security Committee responsible for managing and implementing the Company's cybersecurity programs has many years of valuable business experience managing risks and developing and implementing cybersecurity policies and procedures. Our CISO has extensive experience in information security, managing cybersecurity programs and cybersecurity risks, and has served in various roles in information technology and information security for almost 30 years, including serving as the CISO at another large public company.


text: She holds an undergraduate degree in Information and Decision Sciences. Our EVP OP has extensive enterprise risk management experience, developed over more than 25 years while holding senior leadership positions, including group CIO and divisional COO roles, at global brokerage and risk management firms, and serving clients as a management consultant. He holds an undergraduate degree in accounting.


text: We have committees, response and management teams, and dedicated positions for managing and assessing cybersecurity risk, including a Chief Information Security Officer, a Chief Risk Officer, an Enterprise Risk Management Committee, Computer Security Incident Response Team, Cyber Crisis Management Team, and a dedicated internal information security team. Our Chief Information Security Officer and Chief Risk Officer have extensive experience in the industry. Our Chief Information Security Officer has over a dozen years of experience leading information security programs including, experience in cybersecurity consulting, leading strategy and the implementation of cyber defenses for several of the top online retailers in the United States, as well as serving as Chief Information Security Officer for Cboe Digital Exchange and Cboe Clear U.S. Our Chief Information Security Officer is currently responsible for developing and executing the Company's global security strategy and roadmap along with its long-range plan to meet industry and regional regulatory compliance requirements. We have an information security department with associates who are located around the globe. Our Chief Risk Officer's tenure with Cboe spans 24 years, during which time he has held senior positions in information security and risk management. He is currently responsible for oversight of the Company's risk function including the enterprise risk management, information security, privacy, vendor management, and IT asset management programs.

companyName: Cboe Global Markets, Inc.

ticker: CBOE


text: The Board recognizes that our business depends on the confidentiality, integrity, availability, performance, security, and reliability of our data and technology systems and devotes time and attention to the oversight of cybersecurity and information security risk. In particular, the Board's Risk Committee receives recurring updates and reports on information security-related topics from senior management, including from the Company's Chief Compliance Officer, Chief Risk Officer, and Chief Information Security Officer. More specifically, the Risk Committee receives recurring presentations from senior management on cybersecurity, including architecture and resiliency, incident management, business continuity and disaster recovery, significant information technology changes, data privacy, insider threats, physical security, information related to third-party cyber assessments and risks associated with the use of third party service providers. The Risk Committee also reviews and approves any changes to the related information security and privacy program charter. Further, summaries of the proceedings from prior Risk Committee meetings are provided to the Board on a routine basis. Additionally, in 2024, the Board, along with senior management and third-party advisors, participated in a cybersecurity ransomware tabletop exercise.


text: Risk Management and Strategy Our cybersecurity program is designed from a risk- and compliance-based approach to achieve system-wide resilience and protection across our operations. We regularly assess risks from cybersecurity threats and monitor our information systems for potential vulnerabilities. We model our cybersecurity program after the National Institute of Standards and Technology Cybersecurity Framework to deliver clear and proactive processes, multi-layered defenses, and relevant technologies that are designed to control, audit, monitor, and protect access to sensitive information. Our cybersecurity program includes physical, administrative, and technical safeguards, and we maintain plans and procedures the objective of which is to help us prevent, detect and timely and effectively respond to, and as necessary, recover from, cybersecurity incidents. Through our cybersecurity risk management program, we have established operational processes to address issues including monitoring and patching of vulnerabilities, regularly updating our information systems, and evaluating new countermeasures made to defend against an evolving landscape of threats. This process is overseen by the Audit Committee of our Board of Directors.

companyName: ICHOR HOLDINGS, LTD.

ticker: ICHR


text: In addition, we periodically engage third-party consultants and providers to assist us in assessing, testing, enhancing and monitoring our cybersecurity risk management programs and responding to any incidents. These third parties work in conjunction with our information security team in an effort to continuously improve our cyber risk posture. Examples of third-party actions include the engagement of a security operations center for real-time monitoring and response to incidents, independent audits, risk assessments and security certifications. We have established processes to help identify and manage cybersecurity risks associated with the use of these third-party consultants and providers, which include the completion of due diligence before engaging with a third-party and assessments and reviews throughout the relationship.


text: We believe cybersecurity awareness is important in helping prevent cyber threats. To that end, we provide monthly cybersecurity awareness training and regular phishing awareness exercises to our tech-enabled employees. We monitor and assess the success rate of employees reporting phishing scams, and the results inform the development of our security trainings, systems and programs. Additionally, role-based security training is provided to employees in certain higher-risk positions (including those who handle sensitive information, technology or funds), which is tailored to the heightened cybersecurity risks they face.


text: We have experienced, and may in the future experience, whether directly or through our third-party service providers or other channels, cybersecurity incidents. While prior incidents have not had a material impact on us, future incidents could have a material impact on our business, operations and reputation. Although our processes are designed to help prevent, detect, respond to and mitigate the impact of such incidents, there is no guarantee that they will be sufficient to prevent or mitigate the risk of a cyberattack or the potentially serious reputational, operational, legal or financial impacts that may result. Refer to "Item 1A. – Risk Factors" in this Annual Report on Form 10-K, including, "We may be subject to interruptions or failures in our information technology systems," for additional discussion on our cybersecurity related risks.


text: Cybersecurity Governance Cybersecurity is an important part of our risk management and strategy activities and an area of focus for our Board of Directors and management. Our Board of Directors has delegated to the Audit Committee oversight of our cybersecurity and information security policies and our internal controls regarding cybersecurity and information security. Our Audit Committee receives regular reports from members of our senior management and other personnel that include assessments and potential mitigation of the risks and exposures to cybersecurity incidents.


text: Our cybersecurity risk management and strategy activities are overseen by executive management, made up of the IT Steering Committee and Chief Information Officer. Our Chief Information Officer has over 25 years of experience in information technology and security as well as extensive experience working in and leading our information systems and technology function. The IT Steering Committee and Chief Information Officer receive regular updates on cybersecurity matters, results of mitigation efforts and cybersecurity incident response and remediation through the management of, and participation in, the cybersecurity risk management and strategy activities described above, and report to the Audit Committee quarterly on any appropriate items.


text: We have an enterprise-wide information security program designed to identify, protect, detect and respond to and manage reasonably foreseeable cybersecurity risks and threats. To protect our information systems from cybersecurity threats, we use various security tools that help prevent, identify, escalate, investigate, resolve and recover from identified vulnerabilities and security incidents in a timely manner. These include, but are not limited to, internal reporting, and monitoring and detection tools to allow our information security team members to assist us in identifying vulnerabilities in our systems before they are exploited by malicious threat actors. Our information security activities are overseen by our Chief Technology Officer, who has over 25 years of experience in information technology, including security, encryption, system design, programming and compliance, and leaders from Information Technology, Legal and Finance teams, who have an average of 20 years of experience in information technology, security, compliance and auditing.

companyName: Proto Labs Inc

ticker: PRLB


text: At the executive and management level, the CIO has primary responsibility for the development, operation, and maintenance of the Company's information security program. The CIO has 20 years of experience in technology risk management, 12 of which have been with the Company (or its affiliates). In addition to the CIO, the Company's information security team under the direction of the CIO, implements and provides governance and functional oversight for cybersecurity controls and services. Information security processes include escalation of certain risks and incidents to the CIO and the executive team and quarterly dashboards also used to update the risk landscape.

companyName: Uniti Group LLC


text: Overall, the Company has implemented tactical processes for assessing, identifying, and managing material risks from cybersecurity threats to the company including governance at the Board level and accountability in our executive management for the execution of the Company's cyber risk management strategy and the controls designed to protect its operations. In addition, we maintain cyber insurance that is designed to protect us against certain losses related to cyber risks, and we believe the amount and scope of this insurance are customary for similarly situated companies in the telecommunications industry. See Item 1A. "Risk Factors" for additional information regarding the Company's cybersecurity risks. Those sections of Item 1A should be read in conjunction with this Item 1C.


text: The Company, as a part of its program has a documented cybersecurity incident response plan and conducts tabletop exercises to enhance incident response preparedness. Business continuity and disaster recovery plans are used to prepare for a potential disruption in technology we rely on. The Company is a member of cybersecurity intelligence and risk sharing organizations. Employees undergo security awareness training.

companyName: KELLANOVA


text: Risk Management and Strategy We have established information designed to identify, assess, and manage cybersecurity risks that could impact our critical information systems and confidential data. Our information security team employs a variety of methods to identify and evaluate material risks from cybersecurity threats, including risk and control self-assessments, vulnerability assessments and penetration testing, breach and attack simulations, ransomware table-top assessments, cyber threat intelligence reviews, as well as internal and external cybersecurity assessments.

companyName: ONITY GROUP INC.

ticker: ONIT


text: To mitigate and manage these risks, we have implemented various technical, physical, and organizational safeguards. Depending on the environment or system, these safeguards include, for example, information security policies and procedures, perimeter security controls such as firewalls and intrusion prevention systems, network security controls including multi-factor authentication and role-based access controls, and server and endpoint security controls such as anti-malware. Additionally, depending on the environment or system, we utilize certain application security controls, data security controls including encryption, data loss prevention controls, immutable data backups, and security awareness programs for our personnel.


text: Our assessment and management of material risks from cybersecurity threats are integrated into our broader enterprise risk management strategies. Cybersecurity risks are categorized according to our enterprise risk assessment guidelines and are tracked in a centralized enterprise risk system. Cybersecurity risks are periodically reviewed by our IT Risk Committee and Enterprise Risk and Compliance Committee (discussed further below). We also engage third-party service providers for assistance in identifying, assessing, and managing cybersecurity risks. In the past, these third parties have provided us with services that include external penetration testing, cybersecurity audits, legal counsel, threat intelligence information, forensic investigations, and managed security service.


text: In addition, we have processes in place for assessing and managing cybersecurity risks associated with third-party service providers. Vendors are categorized based on a set of criteria that assess the importance of their services and the sensitivity of the information and systems they have access to. Depending on the nature of the services provided, the sensitivity of information systems and data at issue, and the identity of the provider, our vendor management process may involve different levels of assessment designed to help identify cybersecurity risks associated with the provider, such as due diligence questionnaires and periodic assessments, and we track the status of reported third party risks within our centralized risk governance framework.


text: In 2023 and 2024, cybersecurity incidents occurred involving our vendors and other contractual counterparties that did not materially and adversely impact our operations. However, we cannot assure that future third party incidents will not materially and adversely impact us. For a description of the risks from cybersecurity threats that may materially affect us and how they may do so, see our risk factors under Part 1. Item 1A. Risk Factors in this annual report on Form 10-K, including "Cybersecurity risks and the failure to maintain the security, confidentiality, integrity, and availability of our information technology systems or data, and those maintained on our behalf, could result in a material adverse impact to our business, including without limitation regulatory investigations or actions, a material interruption to our ability to provide services to our customers, damage to our reputation and/or subject us to costs, fines and penalties or lawsuits and otherwise adversely affect our operations."


text: Cybersecurity Governance Our Board of Directors addresses Onity's cybersecurity risk management as part of its general oversight function. The Risk and Compliance Committee of the Board of Directors is responsible for overseeing Onity's overall risk management processes, including cybersecurity-related risks, and receives periodic updates from the Chief Information Security Officer (CISO) concerning Onity's significant cybersecurity threats and the processes Onity has implemented to address them. The Chair of our Risk and Compliance Committee and our Lead Independent Director have each received training and certification from the National Association of Corporate Directors Cyber-Risk Oversight Program.


text: Our cybersecurity risk assessment and management processes are implemented and maintained by the CISO and the information security team. The CISO is responsible for cybersecurity staffing and maintaining an up-to-date cybersecurity policy and processes framework designed to promote a strong cybersecurity resilience, drive security awareness, and facilitate a coordinated response to cybersecurity incidents. The IT Risk Committee, which is chaired by the Chief Information Officer (CIO) and includes the CISO, Chief Risk and Compliance Officer (CRCO) and other executive leadership team members, reviews cybersecurity risks and initiatives on a periodic basis. In addition to their decades of experience and qualifications in finance and management, our CIO holds a Bachelor's Degree in Computer Engineering and Master's Degree in Computer Science, our CISO holds a Bachelor's Degree in Electronics Engineering and has completed industry certifications including Certified Information Security Auditor, Certified Information Systems Security Professional, and ISO 27001 Lead Auditor, and our CRCO has received training in financial services cybersecurity risk management for legal professionals. In addition, all Onity executives, along with employees generally, are required to refresh their cybersecurity and IT threat-recognition training annually or more frequently if circumstances warrant.


text: Cybersecurity-related risk events are reported to Onity's Enterprise Risk and Compliance Committee, an executive level management committee designed to assist the Chief Executive Officer and CRCO in executing our Enterprise Risk Management Program, including with respect to cybersecurity. The Enterprise Risk and Compliance Committee provides a formal governance and oversight infrastructure for identifying and monitoring cybersecurity risks and compliance-related issues facing Onity, which includes escalation to the Risk and Compliance Committee of the Board as appropriate.


text: In addition, our cybersecurity incident response processes are designed to escalate material cybersecurity incidents to members of management as part of the enterprise level Crisis Management Framework. The CISO, CIO, CRCO and senior operating unit leaders are part of the crisis management team in an effort to promote the prompt investigation of and response to cybersecurity incidents.


text: We assess, identify and manage risks from cybersecurity threats through our Global Cybersecurity and Compliance Program (Cybersecurity Program). Cybersecurity risks identified in the Cybersecurity Program are integrated into our Enterprise Risk Management Program. In addition, the Cybersecurity Program seeks to incorporate consideration of cybersecurity risk into our product development, business strategy, financial planning and capital allocation decisions.

companyName: BAXTER INTERNATIONAL INC

ticker: BAX


text: The Cybersecurity Program is currently overseen by the Board of Directors (Board) and is managed by a dedicated Chief Information Security Officer (CISO), who in turn reports to the Chief Information Officer (CIO), who currently reports to the CEO. The CISO's organization has oversight responsibilities for cybersecurity strategy, policy, standards, architecture and processes for the security of our corporate and manufacturing enterprise network, information assets and medical device technologies. Our current CISO has over 20 years of experience in cybersecurity and risk and technology management, and has held numerous positions in the cybersecurity sector, including serving as Global Cyber Risk Officer at another Fortune 500 medical products and equipment company and CISO at other healthcare companies and health care delivery organizations. Our current CIO has over 30 years of experience in information technology and has served in a number of professional services leadership roles, including as CIO over the past 15 years at three companies. The CISO's organization monitors and manages, and works to identify and assess, cybersecurity risk through various technologies, resources, processes and policies that are updated as necessary to align with the changing threat landscape, our evolving business needs as well as global regulatory requirements. In addition, from time to time, we also utilize external auditors and assessors to help evaluate our Cybersecurity Program, including conducting penetration testing and vulnerability, risk and maturity assessments. We also actively engage with industry experts, regulatory agencies, advocacy groups, industry peers, intelligence and law enforcement communities as part of our continuing efforts to evaluate and enhance the effectiveness of our Cybersecurity Program and to stay abreast of the emerging cybersecurity landscape.


text: We use a range of defenses to help protect against cybersecurity threats and to work to secure our assets, reduce the time it takes to detect a cybersecurity threat and improve our recoverability capabilities. These defenses include the ongoing monitoring of our systems (including with the assistance of third-party vendors), conducting response and recovery exercises with employees and senior management (including our executive officers) to promote awareness of related matters and improve internal processes, and engaging with external cybersecurity rating agencies that assess our cyber risk. In addition, to help promote privacy and security awareness throughout the company, the CISO maintains a Cyber Awareness and Engagement Program. As part of this program, all employees with a Baxter email address receive annual training on the recognition and prevention of cybersecurity threats as well as training on how to report suspicious activity or potential breaches through the appropriate channels. Our Cyber Awareness team communicates cybersecurity best practices to our employees through internal communications, including the company intranet, newsletters and global virtual seminars, and also hosts ongoing cybersecurity awareness campaigns, including phishing simulations. Further, our Third-Party Risk Management Program utilizes a managed service that uses a standard framework to help identify, assess and monitor potential cybersecurity risks posed by third parties. Third-party cybersecurity risks (including reputational ones) are assessed by evaluating the third party's security practices (including those associated with data protection), compliance with applicable regulations and planning associated with business continuity and incident detection and response.


text: The Cybersecurity Program maintains a cybersecurity governance and oversight framework that seeks to drive accountability for all levels of employees, including senior management and executive officers. Cybersecurity matters are generally managed by a combination of working groups that report to the cybersecurity compliance committee and ultimately the cybersecurity executive oversight committee, as appropriate. Our cross functional cybersecurity compliance committee, which is led by the CISO, is composed of members of senior management, including the CIO, and reviews matters such as cybersecurity escalations, critical remediations and disclosure recommendations. The output from the cybersecurity compliance committee meetings is discussed at meetings of Baxter's cybersecurity executive oversight committee, which is led by the CISO and includes the CIO and other members of management.


text: In February 2024, we amended the charters of the Audit Committee and Quality and Regulatory Compliance (QRC) Committee of our Board to provide for the realignment of oversight over the company's innovation strategy and cybersecurity to the full Board, as these responsibilities now sit within the vertically integrated segments and are part of the business strategies themselves. The Board oversees information technology functions generally, including product related cybersecurity matters (which had previously been subject to the oversight of the QRC Committee). The Audit Committee is responsible for the oversight of certain significant cybersecurity incidents, including ones related to our products and services and receives related updates from management on those incidents. Consistent with this oversight responsibility, the Audit Committee is responsible for reviewing proposed disclosures in connection with any material cybersecurity incident consistent with our disclosure obligations under Item 1.05 of Form 8-K. The full Board receives periodic updates on information technology and cybersecurity matters from company management (including the CIO and CISO) and external advisors from time to time and the Audit Committee receives periodic updates (including as part of continuing director education) on the evolving cybersecurity landscape and regulatory reporting requirements.


text: The CISO maintains and annually updates a Cybersecurity Incident Response Plan which is a guide for our Cyber Security Incident Response Team and business to respond to cybersecurity incidents in a coordinated manner. Additionally, the CISO, in partnership with a third-party consultant, facilitates periodic cyber-crisis tabletop exercises with members of senior management (including our executive officers) to help us prepare for the occurrence of a significant cybersecurity event and our related response activities. Cybersecurity risks and threats, including any previous cybersecurity incidents, have not materially impacted us or our operations to date. However, we cannot provide any assurance that we will not be subject to a material cybersecurity incident in the future. See "Risks Relating to Our Operations—Breaches and breakdowns affecting our information technology systems or protected information, including from cyber security breaches and data leakage, could have a material adverse effect on our business, results of operations, financial condition, cash flows, reputation and competitive position" in Item 1A. Risk Factors of this Annual Report on Form 10-K for a discussion of cybersecurity-related risks.


text: Cybersecurity is a critical part of our enterprise risk management. The Board, through its Audit Committee, oversees enterprise risk management, including cybersecurity. To more effectively address cybersecurity threats, we have numerous security layers within our least privilege network approach which is managed by our Information Technology ("IT") department. Our cybersecurity programs align with numerous standards and continues to grow and develop as new technologies emerge. Further, we have regular user awareness testing and trainings in place which helps keep all end users and executive leadership up-to-date on the most current threats. The global head of our IT department has responsibility over cybersecurity management globally and reports directly to the Chief Financial Officer. He has degrees in both management information systems and cybersecurity - and has held a number of progressing roles, including management of global infrastructure, information security and technology operations at Balchem, in addition to managing a global team of information technology and cybersecurity experts. The IT department provides regular updates to senior management. Additionally, he provides at least an annual update, or more frequently if necessary, to both the Audit Committee and the full Board regarding the current threat landscape at Balchem, cybersecurity technologies, mitigation strategies, industry trends and best practices that we follow, major cybersecurity incidents (if any), and other areas of importance. Additional activities to maintain and enhance information security are discussed below.

companyName: BALCHEM CORP

ticker: BCPC


text: Board and Management's Role in Data Privacy and Cybersecurity Oversight Our board of directors recognizes the oversight of risk management as one of its primary responsibilities and central to maintaining an effective, risk-aware and accountable organization. While the board of directors maintains ultimate responsibility for the oversight of our data privacy and cybersecurity program and risks, it has delegated certain oversight responsibilities to our audit and risk committee. Our board of directors and audit and risk committee's principal role is one of oversight, recognizing that management is responsible for the design, implementation, and maintenance of an effective program for protecting against and mitigating data privacy and cybersecurity risks. The audit and risk committee assists the board of directors in enhancing its understanding of data privacy and cybersecurity issues by overseeing our data privacy and information security programs, strategy, policies, processes, and material risks, as well as overseeing responses to security and data incidents, as appropriate.

companyName: Block, Inc.

ticker: XYZ


text: The full board of directors receives an annual information security update by our Chief Information Security Officer ("CISO") and an annual privacy update, which covers, among other matters, our privacy and cybersecurity programs and risks. Our audit and risk committee receives updates, at least quarterly, on significant data privacy and security risks, including any significant incidents, relevant industry developments, threat vectors and significant risks identified in periodic penetration tests or vulnerability scans. The updates also include significant legal and legislative developments concerning data privacy and security, our approach to complying with applicable law, and significant engagement with regulators concerning data privacy and cybersecurity. Our audit and risk committee provides regular updates to the board of directors on such reports.


text: Our CISO oversees our cybersecurity policies and processes, including those described in "Risk Management and Strategy" above. Our data security governance, infrastructure security, product security, applied security engineering and security operations teams report directly to our CISO and provide regular updates on significant or potentially significant threats and incidents. Additionally, we have an incident response team and an incident response plan that outlines the roles and responsibilities of key personnel, including representatives from information security, compliance, and counsel, that are involved in responding to, remediating and escalating such incidents to the CISO, as appropriate. Our CISO reports directly to our Technology + Engineering Lead and indirectly to our audit and risk committee. Our CISO provides updates on significant or potentially significant threats and incidents to our Block Head and leadership team, in addition to the audit and risk committee and our board of directors as appropriate and in accordance with the processes detailed in the prior paragraph.


text: Our CISO is primarily responsible for assessing and managing our material risks from cybersecurity threats. Our CISO has over 20 years of experience in information security, including serving as head of cybersecurity and privacy response at a global public company and information security leadership positions with the United States government. Our CISO holds undergraduate and graduate degrees in computer information systems and computer science with an information security focus and possesses various certifications, including the Information Systems Security Professional (NSTISSI No. 4011) and Information Systems Security Officer (CNSSI No. 4014) certifications.