text: Risk Management and Strategy The security of our sensitive business-related information and the personal information we collect, as well as our information systems, is important for our business. In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding study participants in connection with clinical studies, sensitive third-party information and employee information. To protect this information, we have implemented a cybersecurity program, and have established oversight mechanisms designed to provide effective cybersecurity governance, risk management, and timely incident response. Our cybersecurity risk management is based on recognized cybersecurity industry frameworks and standards including NIST-CSF, ISO 27001/27002 as well as HIPAA.

companyName: Guardant Health, Inc.

ticker: GH


text: Our cybersecurity policies require that we implement and maintain monitoring and detection programs, network security precautions, encryption of critical data, and management of third-party risk. We maintain various protections designed to safeguard against cyberattacks, including but not limited to attack surface management, anti-phishing secure email gateways, centralized log monitoring and analysis, cloud security posture management, endpoint detection and response, and network intrusion detection and prevention systems. We also have processes in place to prevent unauthorized access to data processing systems and facilities, including two-factor authentication, tiered approval processes and password complexity, and our employees undergo mandatory privacy and security trainings annually. We have established and periodically test our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess effectiveness of our data security practices and compliance with applicable practices and standards. In addition, we maintain a third-party risk register to identify, prioritize and track risks, including those associated with our use of third-party service providers. We also maintain cybersecurity insurance coverage.

secItem: Item 1C


text: Our cybersecurity program is led by a team of cybersecurity professionals. The program incorporates industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Senior members of our management, including our Head of Information Security and Chief Information Officer, each of whom has over 10 years of experience in various roles involving information technology, including security, auditing, compliance, systems and programming, are responsible for assessing cybersecurity risk. Risk management is performed by the senior leadership of the cybersecurity team as well as members of our legal and privacy teams where relevant. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation of our incident response plan. Additionally, our threat intelligence software issues a quarterly report briefing to inform the security team about relevant cybersecurity events, significant vulnerabilities and vendor-related incidents.


text: Our Head of Information Security reports to the full Board of Directors and the Nominating and Corporate Governance Committee on two occasions per year on information security and cybersecurity matters, or more frequently as needed. These reports generally cover various topics, which may include summaries of recent industry events or notable topics that may influence our cybersecurity risk perspective and security priorities; any actions taken in response to such events or topics; and a review of our top cybersecurity concerns and priorities. Our Nominating and Corporate Governance Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively.


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. As of the date of this Annual Report on Form 10-K, we are not aware of any material cybersecurity incidents or threats that have impacted our business. However, we and our customers routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for additional information about the risks to our business associated with a breach or compromise to our information technology systems.


text: Risk Management and Strategy The security of our sensitive business-related information and the personal information we collect, as well as our information systems, is important for our business. In the normal course of business, we may collect and store personal information and other sensitive information, including proprietary and confidential business information, trade secrets, intellectual property, information regarding study participants in connection with clinical studies, sensitive third-party information and employee information. We manage and maintain our applications and data utilizing a combination of on-site systems and cloud-based data centers. We utilize external security and infrastructure vendors to manage parts of our data centers. To protect this information, we have implemented a cybersecurity program, and have established oversight mechanisms designed to provide effective cybersecurity governance, risk management, and timely incident response. Our cybersecurity program takes into account recognized cybersecurity industry frameworks and standards including NIST-CSF, ISO 27001/27002 as well as HIPAA.


text: Our cybersecurity policies require that we implement and maintain monitoring and detection programs, network security precautions, encryption of critical data, and management of third-party risk. We maintain various protections designed to safeguard against cyberattacks, including but not limited to attack surface management, anti-phishing secure email gateways, log monitoring and analysis, cloud security posture management, endpoint detection and response, and network intrusion detection and prevention systems. We also have processes in place to prevent unauthorized access to data processing systems and facilities, including two-factor authentication, tiered approval processes and password complexity, and our employees and applicable contractors undergo mandatory privacy and security trainings annually. We have established and periodically test our disaster recovery plan and we protect against business interruption by backing up our major systems. In addition, we periodically scan our environment for any vulnerabilities, perform penetration testing and engage third parties to assess the effectiveness of our data security practices and compliance with applicable practices and standards. In addition, we maintain a third-party risk register to identify, prioritize and track risks, including those associated with our use of third-party service providers. We also maintain cybersecurity insurance coverage though it may not be sufficient to cover all costs of a cybersecurity incident.


text: Our cybersecurity program is led by a team of cybersecurity professionals. The program incorporates aspects of industry-standard frameworks, policies and practices designed to protect the privacy and security of our sensitive information. Senior members of our management, including our Chief Information Security Officer and Chief Information Officer, each of whom has over 10 years of experience in various roles involving information technology, including security, auditing, compliance, systems and programming, are responsible for assessing cybersecurity risk. Cybersecurity risk management is performed by the senior leadership of the cybersecurity team as well as members of our legal and privacy teams where relevant. These individuals are informed about, and monitor the prevention, mitigation, detection and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management processes described above, including the operation and testing of our incident response plan. Additionally, our threat intelligence program issues a semi-annual report briefing to inform the security team about relevant cybersecurity events, significant vulnerabilities and vendor-related incidents.


text: Our Chief Information Security Officer reports to the full Board of Directors and the Nominating and Corporate Governance Committee on two occasions per year on information security and cybersecurity matters, or more frequently as needed. These reports generally cover various topics, which may include summaries of recent industry events or notable topics that may influence our cybersecurity risk perspective and security priorities; any actions taken in response to such events or topics; and a review of our top cybersecurity concerns and priorities. Our Nominating and Corporate Governance Committee has oversight responsibility for our data security practices and we believe the committee has the requisite skills and visibility into the design and operation of our data security practices to fulfill this responsibility effectively.


text: Despite the implementation of our cybersecurity program, our security measures cannot guarantee that a significant cyberattack will not occur. A successful attack on our information technology systems could have significant consequences to the business. As of the date of this Annual Report on Form 10-K, we are not aware of any material cybersecurity incidents or threats that have impacted our business. However, we and our customers have experienced cybersecurity incidents and routinely face risks of cybersecurity incidents, wholly or partially beyond our control, as we rely heavily on our information technology systems. While we devote resources to our security measures to protect our systems and information, these measures cannot provide absolute security. See Part I, Item 1A. "Risk Factors" of this Annual Report on Form 10-K for additional information about the risks to our business associated with a cybersecurity incident affecting our information technology systems.


text: Criteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), who is responsible for managing cybersecurity risks as well as protecting our networks and systems. Our CISO has extensive information technology and program management experience, and has served many years in our corporate information security organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security engineering, incident response, compliance, and software development.

companyName: Criteo S.A.

ticker: CRTO


text: Our Board of Directors is primarily responsible for the oversight of our risk management activities and has delegated to the Audit Committee the responsibility to assist in this task.


text: The Audit Committee regularly reviews and discusses with management and, as appropriate, the Company's auditors, the Company's guidelines and policies with respect to risk assessment and risk management, including the Company's data privacy and cybersecurity risk exposures and the steps taken to monitor and manage those exposures.


text: The CISO helps maintain a comprehensive security program that serves as a governance framework for information security at Criteo, supports the business goals of the company and details, across problem spaces and security core functions, the various initiatives, their scope, the associated risks and weaknesses, the roadmap and the current progress.


text: Criteo assesses and manages its cybersecurity risks in part through executive committees. The Governance Risk and Compliance Committee (the "GRCC"), composed of the CISO and certain members of our executive and leadership teams, meets several times a year to discuss strategic information security matters including the security program, major risks and incidents and significant key performance indicators ("KPIs"). The Information Security Committee (the "ISC"), a security-focused governance body including senior managers across the Company on information security activities, meets regularly to receive updates on KPIs and to review relevant standards and policies.


text: As a member of both the GRCC and the ISC, the CISO briefs the Audit Committee on the information security program, major risks and any cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors, at least annually, as part of Criteo's enterprise risk mapping ("ERM") program.


text: Quality Control of Security To help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third-party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization Standardization 27001 Information Security Management System Requirements ("ISO 27001") and the American Institute of Certified Public Accountants' Service Organization Control Type 2 ("AICPA SOC 2"). Various parts of our business maintain independently assessed security certifications, and we also run certification programs to expand the scope of our existing security certifications.


text: Our security team has several touch points within the business in order to adequately address and mitigate risks. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive testing to detect vulnerabilities and respond. Our technical security teams also build new tools and solutions in an effort to improve our security posture on an ongoing basis.


text: Our security compliance teams perform third-party risk assessments, respond to client inquiries about security, help the business to manage our security controls, and translate our external requirements into policies, standards, and actions for the rest of our business. Various parts of our team also participate in risks assessments during project kick-offs.


text: With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with our information systems and our data, assessing the security of the third-party (including through questionnaires), and obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not sanctioned, or otherwise identified as potentially corrupt.


text: The process of assessing, identifying and managing cybersecurity related risks is integrated into our overall ERM via a dedicated Information Security Risk Management program that is focused on cybersecurity risk and run by our security compliance team. Risks that are identified through our security processes go through a process of analysis, prioritization, treatment and monitoring. During the lifecycle of cybersecurity specific risks, risk owners, working alongside the security compliance team, are assigned to develop risk mitigation plans, which are followed by the team until a risk is sufficiently mitigated or resolved, at which point such risk reaches a monitoring state. Cybersecurity risks are aggregated into strategic business risks and incorporated into the ERM program.


text: Cybersecurity Incidents While we have experienced cybersecurity incidents in the past, there have been none to date which have materially affected, or are reasonably likely to materially affect, the Company, our financial position, results of operations and/or cash flows. We continue to invest in the cybersecurity and resiliency of our networks and to enhance our internal controls and processes, which are designed to help protect our systems and infrastructure, and the information they contain. For more information regarding the risks we face from cybersecurity threats, please see "Item 1A. Risk Factors – Risks Related to Data Privacy, Intellectual Property and Cybersecurity."


text: Criteo recognizes the critical importance of maintaining the safety and security of our systems and data and has a holistic process for overseeing and managing cybersecurity and related risks. Our security program is led by our Chief Information Security Officer ("CISO"), who reports directly to our Chief Technology Officer ("CTO"), who is responsible for managing cybersecurity risks as well as protecting our products, networks and systems. Our CISO has extensive information technology and program management experience and has served many years in our corporate information security organization. Our CISO manages our security organization, which is composed of dedicated teams of experts in security engineering, incident response, compliance, and software development.


text: Criteo assesses and manages its cybersecurity risks in part through an executive committee referred to as t he Governance Risk and Compliance Committee (the "GRCC"). The GRCC is composed of the CISO and certain members of our executive and leadership teams, and meets several times a year to discuss strategic information security matters including the security program, major risks and incidents and significant key performance indicators ("KPIs").


text: As a member of the GRCC, the CISO briefs the Audit Committee on the information security program, major risks and any cybersecurity incidents, typically at least annually. Additionally, cybersecurity risks are reported to the Board of Directors, at least annually, as part of Criteo's enterprise risk mapping ("ERM") program.


text: Quality Control of Security To help ensure that our security program functions in line with industry expectations, Criteo invests in identifying and remediating gaps in our security posture. To accomplish this, we use a mix of our internal expertise and external third- party expertise, as needed, to audit ourselves against industry standards, such as the National Institute of Standards and Technology ("NIST") Cybersecurity Framework, International Organization for Standardization 27001 Information Security Management System Requirements ("ISO 27001") and the American Institute of Certified Public Accountants' Service Organization Control Type 2 ("AICPA SOC 2"). Various parts of our business maintain independently assessed security certifications, and we also run certification programs to expand the scope of our existing security certifications.


text: Our security team has several touch points within the business in order to adequately address and mitigate risks. For instance, the team provides mandatory cybersecurity awareness training for all employees and a recurring phishing campaign. Our technical security teams use a combination of threat intelligence tools, defensive tools and proactive testing to detect vulnerabilities and respond. Our technical security teams also invest in building new tools and integrating solutions to improve our security posture on an ongoing basis.


text: With regards to third-party risk assessments, our process involves assessing how third parties interact and connect with our information systems and our data, assessing the security of the third-party (including through questionnaires), and obtaining independent proofs of security (including via security certification and/or penetration tests) depending on the associated level of risk, as evaluated by our team. Our procurement teams also run checks to ensure vendors are not sanctioned or otherwise identified as potentially corrupt.


text: In the ordinary course of our business, we and our third-party service providers, such as contract research organizations, collect, maintain and transmit sensitive data on our networks and systems, including our intellectual property and proprietary or confidential business information (such as research data and personal information). The secure maintenance of this information is critical to our business and reputation. In addition, we are heavily dependent on the functioning of our information technology infrastructure to carry out our business processes. While we have adopted administrative, technical and physical safeguards to protect such systems and data, our systems and those of third-party service providers may be vulnerable to a cyber-attack.

companyName: Acumen Pharmaceuticals, Inc.

ticker: ABOS


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include frameworks to respond to and assess internal and external threats to the security, confidentiality, and integrity of our data and information systems, along with other material risks to our operations, which we review at least annually or whenever there are material changes to our systems or operations.


text: Our IT department collaborates with our Chief Operating Officer to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards. As part of our risk management process, we conduct regular IT security audits to assess and respond to internal and external security threats.


text: We rely on third parties, including cloud vendors and consultants, for various business functions. Many of our third-party service providers have access to our information systems and data, and we rely on such third parties for the continuous operation of our business operations. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation, and scans or other technical evaluations. Governance.


text: Our Board of Directors has established oversight mechanisms to manage risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity, including the responsibility to review and discuss with management and the Company's auditors, as appropriate, management risks relating to data privacy, technology and information security, including cyber security and back-up of information systems, and the steps the Company has taken to monitor and control such exposures and the responsibility to confer with management and the Company's auditors the adequacy and effectiveness of the Company's information and cyber security policies and the internal controls regarding information security. The Audit Committee, or the Board of Directors as a whole, is briefed on any material cybersecurity incidents that may adversely affect the Company and on cybersecurity risks in general at least once each year.


text: At the management level, our cybersecurity program is managed by our Director of IT, who reports to our Chief Operating Officer. Our Director of IT has over 12 years of IT security experience in regulated industries such as government, energy, and biopharma. He has over 20 years of combined IT experience.


text: Our Director of IT and IT Department implement processes around security monitoring and vulnerability testing. Our Director of IT reports at least annually to the Audit Committee and such reporting will include topics such as our risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures.


text: Although we have experienced cybersecurity incidents in the past, as of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations, or financial condition. Despite our continuing efforts, we cannot guarantee that our cybersecurity safeguards will prevent breaches or breakdowns of our or our third-party service providers' information technology systems, particularly in the face of continually evolving cybersecurity threats and increasingly sophisticated threat actors. A cybersecurity incident may materially affect our business, results of operations or financial condition, including where such an incident results in reputational, competitive or business harm or damage to our Company, loss of intellectual property rights, significant costs or the Company being subject to government investigations, litigation, fines or damages. For more information, see "Our business and operations would suffer in the event of computer system failures, cyberattacks or a deficiency in our cybersecurity or a natural disaster."


text: We have adopted processes designed to identify, assess and manage material risks from cybersecurity threats. Those processes include frameworks to respond to and assess internal and external threats to the security, confidentiality and integrity of our data and information systems, along with other material risks to our operations, which we review at least annually or whenever there are material changes to our systems or operations.


text: Our IT department collaborates with our Chief Operating Officer to evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We have processes to detect potential vulnerabilities and anomalies through technical safeguards. As part of our risk management process, we conduct regular IT security audits to assess and respond to internal and external security threats. In addition, we consult with outside advisors and experts, when appropriate, to assist with assessing, identifying and managing cybersecurity risks, including to anticipate future threats and trends and their potential impact on the Company's risk environment.


text: We rely on third parties, including cloud vendors and consultants, for various business functions. We oversee third-party service providers by conducting vendor diligence. Vendors are generally assessed for risk based on the nature of their service, access to data and systems and supply chain risk and, based on that assessment, we conduct diligence that may include completing security questionnaires, onsite evaluation and scans or other technical evaluations. Governance.


text: Our Board of Directors has established oversight mechanisms with respect to risks from cybersecurity threats. Our Audit Committee has primary responsibility for oversight of cybersecurity, including the responsibility to review and discuss with management and the Company's auditors, as appropriate, management risks relating to data privacy, technology and information security. The Audit Committee, or the Board of Directors as a whole, is briefed on any material cybersecurity incidents that may adversely affect the Company and on cybersecurity risks in general at least once each year.


text: At the management level, our cybersecurity program is managed by our Director of IT, who reports to our Chief Operating Officer. Our Director of IT has over 13 years of IT security experience in regulated industries such as government, energy and biopharma. He has over 20 years of combined IT experience.


text: Our Director of IT and IT Department implement processes around security monitoring and vulnerability testing. Our Director of IT reports at least annually to the Audit Committee and such reporting includes topics such as our risk assessment, risk management and control decisions, service provider arrangements, test results, security incidents and responses and recommendations for changes and updates to policies and procedures.


text: As of the date of this report, we have not experienced a cybersecurity incident that resulted in a material effect on our business strategy, results of operations or financial condition, but we cannot provide assurance that we will not be materially affected in the future by such risks or any future material incidents. For more information on cybersecurity risks, see Item 1A. Risk Factors—"Our business and operations would suffer in the event of computer system failures, cyberattacks or a deficiency in our cybersecurity or a natural disaster."


text: Cybersecurity, data privacy, and data protection are critical to our business. In the ordinary course of our business, we collect and store certain confidential information such as personal information of homebuyers and borrowers and information about our employees, contractors, vendors, and suppliers. Our Financial Services business relies heavily on the secure processing, storage, and transmission of sensitive and confidential financial, personal, and other information in our computer systems and networks. As such, we have established information security practices leveraging the National Institute of Standards of Technology (NIST) Cybersecurity Framework to measure our security posture, deliver risk management, and provide effective security controls to protect the privacy and confidentiality of our information. Our information security practices include development, implementation, and improvement of policies and procedures to safeguard information and ensure availability of critical data and systems. Our program further includes review and assessment by external, independent third parties, who assess and report on our defense posture and internal incident response preparedness and help identify areas for continued focus and improvement.

companyName: Century Communities, Inc.

ticker: CCS


text: Role of Management We have an Information Security team that is led by our Chief Information Officer (CIO). Our CIO has led the Century Communities IT efforts since 2016, overseeing multiple acquisitions while modernizing the IT environment. He has held technology leadership roles in both the public and private sectors, with more than 20 years of experience as an IT leader in the homebuilding industry. In that time, our CIO has managed broad initiatives and teams, including IT operations, cybersecurity, business systems, mergers and acquisitions, communications, and business intelligence. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO reports to our Corporate General Counsel.


text: We are a member of the Center for Internet Security (CIS), which assists our management in policy and technical support. Some of the benefits of our CIS membership include direct access to cybersecurity advisories and alerts, vulnerability assessments and incident response for entities experiencing a cyber threat, secure information sharing through the Homeland Security Information Network (HISN) portal, tabletop exercises, and weekly malicious domains/IP reports.


text: The CIO, in his capacity, regularly informs the Corporate General Counsel, Chief Financial Officer (CFO) and Co-Chief Executive Officers (CEOs) of all aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we are facing.


text: The CIO and the other members of senior management play a key role in informing the Audit Committee on cybersecurity risks. They provide comprehensive briefings to the Audit Committee on a regular basis, with a minimum frequency of twice per year. These briefings encompass a broad range of topics, including emerging threats, status of ongoing cybersecurity initiatives and strategies, incident reports, and updates regarding compliance with regulatory requirements and industry standards. In addition to our scheduled meetings, the Audit Committee, CIO and other members of senior management maintain an ongoing dialogue regarding emerging or potential cybersecurity risks. Together, they receive updates on any significant developments in the cybersecurity field, ensuring the Board's oversight is proactive and responsive. Senior management actively participates in strategic decisions related to cybersecurity, offering guidance and approval for major initiatives, and is involved in incident materiality determinations that would trigger cybersecurity incident disclosure obligations. This active involvement ensures that cybersecurity considerations are integrated into our broader strategic objectives.


text: Since September 2022, we have engaged a seasoned cyber consultant from the global cybersecurity risk firm, Kroll, LLC, to provide CISO-level advisory services to assist our technology teams, business leadership and Board of Directors with guidance and direction as we strengthen our security systems and improve our cyber readiness, as well as to provide insight and intelligence on existing and emerging threat landscapes. The scope of service includes reviewing our current information security policies, past and current security reports, cybersecurity program, and staffing models to assess our ability to prevent and respond to cyberattack incidents and mitigate any impacts they may have.


text: In addition, we have retained special data security legal counsel at a leading U.S. law firm whose practice focuses on data breach response and security compliance issues. This legal counsel is specialized in investigating and responding to an event compromising information and systems security, working closely with client resources, third-party forensic consulting experts and law enforcement to identify the nature and scope of a compromise. We also have retained special data privacy legal counsel to assist us in our compliance with the data privacy laws in the various jurisdictions in which we operate our business.


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee our cybersecurity efforts and cyber related risks. The Audit Committee, which is comprised of entirely independent directors, oversees our (i) information security policies, including periodic assessment of risk of information security breach, training program, significant threat changes and vulnerabilities and monitoring metrics and (ii) effectiveness of information security policy implementation.


text: As mentioned above, our management team meets with the Audit Committee at least twice a year to review and discuss risk exposure related to our IT systems and data privacy. The purpose of these management updates is to inform the Audit Committee of any potential risks related to our IT systems and data privacy, as well as any relevant mitigation or remediation tactics being implemented. The management team and/or Audit Committee, in turn, regularly provide data protection and cybersecurity reports to the full Board of Directors.


text: The Audit Committee is composed of members with diverse expertise including, risk management, technology, and finance. Although none of the members of the Audit Committee have any work experience, degree, or certifications related to information security or cybersecurity, the Audit Committee has retained and consulted with Kroll to assist the Audit Committee in its cyber security oversight responsibilities. Because the method and sources of cyberattacks change frequently, Kroll provides invaluable, ongoing updates to inform and educate our Board of Directors on current trends of cybersecurity threats, emerging trends, and best practices. Kroll typically attends and presents at two Board meetings each year.


text: Risk Management and Strategy We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level. Our risk management team and Information Security team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We utilize the NIST Cybersecurity Framework to manage our cybersecurity-related risk. The NIST Cybersecurity Framework outlines 108 subcategories of security controls and outcomes over five functions: identify, protect, detect, respond and recover.


text: In November 2022, Kroll conducted a security maturity assessment of our security system. To perform its assessment, Kroll met with members of our key staff and requested to review documents including, but not limited to, our policies, procedures, past security assessments and penetration tests, documentation regarding network architecture, security road maps and plans. The Century Communities Information Security Team have been working with Kroll to identify potential deficiencies in each category and work to close the identified gaps. With Kroll's assistance, we have implemented several industry leading solutions, policies and practices to close those findings and matured Century's defense and resiliency postures. We also have developed an Information Security Incident Response Policy which has been peer reviewed by Kroll. Additionally, we have retained Kroll to assist us in conducting tabletop exercises to evaluate our incident response plan and response capabilities, most recently in September 2023.


text: The company primarily manages risks for cybersecurity threats associated with its third-party service providers through evaluations and assessments during vendor selection, contract negotiations and contract renewals.


text: Our Information Security team conducts annual information security awareness training for all employees. In addition, we have retained a third-party vendor to provide regular online awareness training modules for our employees on important topics such as spoof login, impersonation attack, identity theft, stolen laptop, and passwords. Each module contains a video vignette followed by a quick quiz.


text: Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within our Company and through our engagement of third-party service providers like Kroll.


text: Risk Management and Strategy We have integrated cybersecurity risk management into our broader risk management framework to promote a company-wide culture of cybersecurity risk management. This integration ensures that cybersecurity considerations are an integral part of our decision-making processes at every level.


text: Our risk management team and information security team works closely with our IT department to continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs. We leverage the NIST Cybersecurity Framework to manage our cybersecurity-related risk. The NIST Cybersecurity Framework outlines subcategories of security controls and outcomes over five functions: identify, protect, detect, respond, and recover.


text: Use of Consultants and Advisors We engage with a range of external experts, including cybersecurity assessors, consultants, and legal counsel in evaluating and testing our risk management systems. This enables us to leverage specialized knowledge and insights, ensuring our cybersecurity strategies and processes remain current.


text: Since September 2022, we have engaged a seasoned cyber consultant from a global cybersecurity risk firm to provide CISO-level advisory services to assist our technology teams, business leadership and Board of Directors with guidance and direction as we strengthen our security systems and improve our cyber readiness, as well as to provide insight and intelligence on existing and emerging threat landscapes. The scope of service includes reviewing our current information security policies, past and current security reports, cybersecurity program, and staffing models to assess our ability to prevent and respond to cyberattack incidents and mitigate any impacts they may have.


text: In addition, we have retained special data security legal counsel at a leading U.S. law firm whose practice focuses on data breach response and security compliance issues. This legal counsel is specialized in investigating and responding to events compromising information and systems security, and works closely with client resources, third-party forensic consulting experts and law enforcement to identify the nature and scope of a compromise. We also have retained special data privacy legal counsel to assist us in our compliance with the data privacy laws in the various jurisdictions in which we operate our business.


text: In 2024, a Security Posture Assessment was conducted by a leading global cybersecurity firm. To perform its assessment, the consultants met with members of our key staff and requested to review documents including, but not limited to, our policies, procedures, past security assessments and penetration tests, documentation regarding network architecture, and security road maps and plans. When such risk assessments are performed, we work with our CISO-level advisor to review any findings from the risk assessment and to identify potential deficiencies in each category and work to close the identified gaps. With our CISO-level advisor's assistance, we have implemented several industry leading solutions, policies, and practices to close those findings and matured Century's defense and resiliency postures. We also have developed an Information Security Incident Response Policy which has been reviewed by our CISO-level advisor. Additionally, we retain a variety of cybersecurity consulting firms, including our CISO-level advisor, to assist us in conducting tabletop exercises to evaluate our incident response plan and response capabilities, most recently in December 2024.


text: The Company primarily manages risks for cybersecurity threats associated with its third-party service providers through evaluations and assessments during vendor selection, contract negotiations and contract renewals. We have introduced a third-party vendor risk management solution and professional service to survey and monitor the Company's critical vendors at on-boarding and on a reoccurring basis.


text: In the past three years, we have not experienced any material computer data security breaches as a result of a compromise of our information systems and we are not aware and have not had a significant cybersecurity breach or attack that had a material impact or are reasonably likely to materially impact our business operations, operating results, or financial condition.


text: Maintaining a robust information security system is an ongoing priority for us and we plan to continue to identify and evaluate new, emerging risks to data protection and cybersecurity both within our Company and through our engagement of third-party service providers.


text: If we were to experience a material cybersecurity incident in the future, such incident may have an adverse effect, including on our business operations, operating results, or financial condition. For more information regarding these cybersecurity risks and potential related impacts on us, see "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: Role of Management Our information security team that is led by our Chief Information Officer (CIO) is responsible for implementing and operating our Cybersecurity Risk Management program.


text: Our CIO has led our efforts since 2016, overseeing multiple acquisitions while modernizing the IT environment. He has held technology leadership roles in both the public and private sectors, with more than 20 years of experience as an IT leader in the homebuilding industry. In that time, our CIO has managed broad initiatives and teams, including IT operations, cybersecurity, business systems, mergers and acquisitions, communications, and business intelligence. His in-depth knowledge and experience are instrumental in developing and executing our cybersecurity strategies. Our CIO reports to our Corporate General Counsel.


text: The CIO, in his capacity, regularly informs the Executive Chairman, Chief Executive Officer, Corporate General Counsel, and Chief Financial Officer, of aspects related to cybersecurity risks and incidents. This ensures that the highest levels of management are kept abreast of the cybersecurity posture and potential risks we are facing.


text: The Board of Directors is aware of the critical nature of managing risks associated with cybersecurity threats. Our Board of Directors has delegated to the Audit Committee the responsibility to oversee our cybersecurity efforts and cyber-related risks. The Audit Committee, comprised fully of independent directors, is responsible for oversight of our (i) information security policies, including periodic assessment of risk of information security breach, training programs, significant threat changes and vulnerabilities and monitoring metrics and (ii) effectiveness of information security policy implementation.


text: The CIO and members of management meet with the Audit Committee on a regular basis to review and discuss risk exposure related to our IT systems and data privacy. The purpose of these management updates is to inform the Audit Committee of potential risks related to our IT systems and data privacy, as well as any relevant mitigation or remediation tactics being implemented. The management team and/or Audit Committee, in turn, regularly provide data protection and cybersecurity reports to the full Board of Directors.


text: The Audit Committee is composed of members with diverse expertise including risk management, technology, and finance. Although none of the members of the Audit Committee have any work experience, degree, or certifications related to information security or cybersecurity, the Audit Committee relies on the CIO and independent feedback from outside advisors, such as our CISO-level advisor, on the current and future cybersecurity program to assist the Audit Committee in its cybersecurity oversight responsibilities. Because the method and sources of cyberattacks change frequently, our outside advisors, including our CISO-level advisor, provide invaluable, ongoing updates to inform and educate our Board of Directors on current trends of cybersecurity threats, emerging trends, and best practices.


text: Risk Management and Strategy At Stitch Fix, we recognize the importance of robust cybersecurity measures to protect our systems, data, and the interests of our stakeholders. We have implemented a comprehensive cybersecurity risk management strategy and governance framework to identify, assess, manage, mitigate, and respond to cybersecurity risks and threats.

companyName: Stitch Fix, Inc.

ticker: SFIX


text: Stitch Fix views its cybersecurity strategy through a multi-pronged lens encompassing prevention, detection, and response to ensure holistic coverage of the program and our environments.


text: Our cybersecurity program starts with prevention, which includes risk assessment and identification. We utilize that information to design an effective layer of controls as a baseline. We regularly conduct assessments to identify and evaluate potential cybersecurity risks. This process involves analyzing our systems, networks, and data infrastructure to identify vulnerabilities and potential threats. Our cybersecurity program also includes a dedicated function for third party risk management, in which we oversee the identification and mitigation of risk associated with outsourcing to third party vendors and service providers, particularly focused on vendors who process sensitive information. In addition to our risk assessment processes, we prioritize cybersecurity awareness and training programs for our employees. These initiatives aim to educate our workforce about potential threats, best practices for data protection, and the importance of maintaining security measures. We train our employees through annual security training, phishing simulations, and regular communications about cybersecurity topics and threats.


text: Our cybersecurity program includes tools and processes designed to detect unusual network activity, anomalous cybersecurity events, and breaches. We utilize a variety of preventative measures and detective tools.


text: We have developed an incident response plan to ensure a swift and effective response in the event of a cybersecurity incident. This plan includes predefined roles and responsibilities, communication protocols, and steps to contain and remediate any vulnerabilities that may lead to a breach.


text: Our Chief Information Security Officer ("CISO") oversees the Company's cybersecurity program. Our CISO, who reports to our Chief Technology Officer ("CTO"), has over 20 years of experience in information technology, risk, and cybersecurity leadership, and has previously held both CISO and CTO roles.


text: The Audit Committee of our Board of Directors provides oversight for our cybersecurity program and our enterprise risk management process, which evaluates enterprise level risks and strategies, including our cybersecurity risk. The Audit Committee receives updates from management on the effectiveness of our cybersecurity program. The Audit Committee also reviews plans on how management will enhance the program, receives updates on special topics that help the Committee provide effective oversight of the program, and is notified in the event of certain cybersecurity incidents.


text: Although we have not experienced a material cybersecurity breach, we cannot guarantee that we will not experience a cyber threat or incident in the future. For more information regarding the cybersecurity risks we face, see Item 1A. Risk Factors in this Annual Report.


text: Our management recognizes the importance of implementing and maintaining robust cybersecurity measures designed to address cybersecurity threats that pose risks to our business and operations. Therefore, we have established a comprehensive framework to identify, protect against, detect, respond to, and recover from cybersecurity incidents ("Incidents"). Our cybersecurity measures are designed to provide a structured approach to managing cybersecurity risks for an effective, efficient, an orderly response to any Incident.

companyName: Terra Income Fund 6, LLC

ticker: TFSA


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by the REIT Manager's Chief Compliance Officer and Cyber Security Committee ("CSC").


text: Our management, including the REIT Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring all our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We also assess third party risks when determining the selection and oversight of applicable third-party service providers.


text: Increased cybersecurity risk due to the diversification of our data across external service providers and cyber incidents may adversely affect our business by causing a disruption to our operations, compromise our confidential information and/or damage to our business relationships, all of which could negatively impact our financial results. As of the date of this Form 10-K, we are not aware of any risks from cybersecurity threats that have materially affected or are reasonably likely to materially affect us, including our financial position, results of operations and/or business strategy. While we have not, as of the date of this Form 10-K, experienced a cybersecurity threat or incident that resulted in a material adverse impact to our business or operations, there can be no guarantee that we will not experience such an incident in the future where we may be unable to implement effective preventative measures in a timely manner.


text: Further discussion of the potential impacts on our business from cyber intrusions is provided in "Risk Factors" in Part I, Item 1A of this Annual Report on Form 10-K.


text: As a critical component of our overall risk management process, we have adopted a framework that shares existing reporting channels and governance processes to identify, assess, manage and report cybersecurity threats on an ongoing basis. This risk management process is led by the REIT Manager's Chief Compliance Officer and Cyber Security Committee ("CSC"). The REIT Manager's Chief Compliance Officer has 17 years of experience in regulatory compliance, risk management, and cybersecurity governance, with expertise in implementing and overseeing security policies in financial and REIT sectors. [The CSC is composed of professionals with backgrounds in information security, IT risk management, and data protection, ensuring a well-rounded approach to cybersecurity oversight.


text: Our management, including the REIT Manager's Chief Compliance Officer and CSC, is authorized to take the appropriate steps deemed necessary to identify, assess, contain, mitigate, and resolve cybersecurity threats including by (a) maintaining (i) an Incident Response Plan in the event of an Incident and (ii) a Cybersecurity Policy which governs information technology security policies, (b) regularly monitoring all our systems and user accounts for any suspected Incidents, (c) performing annual audits on certain of our systems, and (d) providing general cybersecurity awareness and data protection training. In addition, depending on the circumstances of an Incident, we may engage third parties such as insurance carriers, outside legal counsel, forensic investigators, crisis communications or public relations firms, investor relations firms and response vendors and we may coordinate with regulators or law enforcement. We perform due diligence in order to identify and evaluate cyber risks of third party service providers. Third party service providers processing sensitive data are contractually required to meet applicable legal and regulatory obligations to protect sensitive data against cybersecurity threats and unauthorized access to the sensitive data. Third party service providers deemed critical undergo ongoing monitoring to ensure they continue to meet their security obligations and other potential cybersecurity threats.


text: Ladder has a cybersecurity risk management program that is designed to assess, identify, manage, and govern material risks from cybersecurity threats. Our cybersecurity risk management program is also a key component of our overall risk management program.

companyName: Ladder Capital Corp

ticker: LADR


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity threats or other security breaches could cause significant business disruption and could possibly compromise sensitive information belonging to us or our employees, borrowers, clients and other counterparties, and along with the emerging use of artificial intelligence ("AI"), could harm our business and our reputation and subject us to regulatory scrutiny" in Part I, Item 1A. "Risk Factors" for additional information.


text: Ladder leverages a senior cybersecurity team (the "Cybersecurity Team") comprised of the Chief Technology Officer ("CTO"), Chief Administrative Officer and General Counsel, Chief Compliance Officer and Senior Regulatory Counsel, as well as senior representatives from Ladder's outsourced technology firm. The Cybersecurity Team maintains Ladder's cybersecurity program, which is designed to identify, detect and manage cybersecurity risks. The Cybersecurity Team monitors technology trends and developments to inform improvements and adjustments to Ladder's information technology ("IT") infrastructure and oversees the Company's various cybersecurity training initiatives.


text: The members of the Cybersecurity Team have extensive on-the-job experience in cybersecurity matters, sharing responsibility for cybersecurity, as well as for regulatory, compliance and/or IT. Ladder's CTO has over 20 years of experience in the design, engineering, implementation, and management of information technology, including as the founder of an IT managed servicer provider for professional and financial services companies.


text: Ladder conducts routine risk assessments to identify cyber threats and vulnerabilities and assess the likelihood of occurrence and severity of the impact of such threats and vulnerabilities on the Company. Ladder regularly updates the risk assessment in order to inform Ladder's cybersecurity program and controls and to prioritize risk mitigation and remediation in an evolving threat landscape. Ladder maintains cybersecurity policies and procedures designed to manage these risks and ensure that the Cybersecurity Team and other relevant employees are informed of cybersecurity incidents in a timely manner. These policies include incident response, data classification, physical and network security polices, remote access, record retention and secure destruction policies. The Cybersecurity Team conducts a formal evaluation of Ladder's applicable policies and cyber risks and mitigants on at least an annual basis. Ladder's outsourced technology firm, as well as internal auditors, participate in this evaluation.


text: Ladder also maintains processes designed to oversee and identify material risks from cybersecurity threats associated with our use of third-party service providers based on the service provider's risk profile. Ladder does not generally maintain consumer data, and does not extensively leverage third parties to manage or process sensitive data. Most of the third parties that have access to sensitive information belonging to us or our borrowers, clients or other counterparties are lenders, law firms and other third parties that require such access in connection with Ladder's commercial lending activities. These third parties tend to be highly regulated and generally maintain mature cybersecurity programs and data security controls. When Ladder leverages third-party service providers that collect or maintain sensitive information, Ladder conducts initial diligence on such third parties and conducts ongoing monitoring that includes annual due diligence questionnaires and contractual data security protections. In addition to the policies and procedures discussed above, Ladder leverages industry standard third-party technology, tools and services to assist in monitoring, detecting and managing cyber threats, including managed security service monitoring, endpoint detection and response tools. Ladder also maintains other appropriate cybersecurity controls, including: • Annual penetration testing by rotating third-party vendors; • Vulnerability scans; • Company-wide cybersecurity training, including quarterly phishing exercises; • Tabletop exercises; • Vendor cybersecurity diligence; and • Cyber insurance.


text: The Audit Committee, on behalf of the board of directors, is responsible for oversight of the Company's strategies to assess and mitigate cybersecurity risks, as set forth in the Audit Committee's charter. The Audit Committee receives quarterly or as needed updates from the CTO regarding the cybersecurity risks the Company faces based on the current cybersecurity threat landscape, as well as the status of the measures undertaken by the Company to manage those risks.


text: To date, cybersecurity threats, including as a result of any previous cybersecurity incidents, have not materially affected and are not reasonably likely to materially affect the Company, including its business strategy, results of operations or financial condition. Refer to the risk factor captioned "Cybersecurity threats or other security breaches could cause significant business disruption and could possibly compromise sensitive information belonging to us or our employees, borrowers, clients and other counterparties, along with the emerging use of AI, could harm our business and our reputation and subject us to regulatory scrutiny" in Part I, Item 1A. "Risk Factors" for additional information.


text: Ladder leverages a senior cybersecurity team (the "Cybersecurity Team") comprised of the Chief Technology Officer ("CTO"), Chief Administrative Officer and General Counsel (the "GC"), Chief Compliance Officer (the "CCO") and Senior Regulatory Counsel, as well as senior representatives from Ladder's outsourced technology firm. The Cybersecurity Team maintains Ladder's cybersecurity program, which is designed to identify, detect and manage cybersecurity risks. The Cybersecurity Team monitors technology trends and developments to inform improvements and adjustments to Ladder's information technology ("IT") infrastructure and oversees the Company's various cybersecurity training initiatives.


text: The members of the Cybersecurity Team have extensive on-the-job experience in cybersecurity matters, sharing responsibility for cybersecurity, as well as for regulatory, compliance and/or IT. Ladder's CTO has over 20 years of experience in the design, engineering, implementation, and management of information technology, including as the founder of an IT managed servicer provider for professional and financial services companies. The GC helped establish and continues to oversee the Company's cybersecurity risk management framework, including a best practice approach to cybersecurity governance, testing and diligence. The CCO helps ensure adherence to regulatory standards and helps refine our cybersecurity policies and training initiatives.


text: Risk Management Strategy We have a comprehensive cybersecurity risk management strategy to assess, identify, and manage material risks from cybersecurity threats. The core of this strategy is our digital risk and security program, which is integrated into our overall enterprise risk framework and is based on industry standards and established frameworks such as National Institute of Standards and Technology (NIST) and other guidelines. Our program is designed to help protect our systems, data, and operations from potential cyber threats, ensure the continuity of business operations, ensure we comply with applicable privacy and other laws and regulations, and meet our commitments to our members, customers, suppliers, employees, and other stakeholders.

companyName: Premier, Inc.


text: We employ a comprehensive, cross-functional approach to our cybersecurity strategy across our technology, legal, compliance, risk, finance, and other teams to assess, identify, and manage cybersecurity threats and respond to cybersecurity incidents when they occur. This integration helps ensure that the breadth of potential impacts from cybersecurity risks are considered and that our approach to managing these risks is consistent and coordinated across teams within our business. Through our digital risk and security program, our cybersecurity risk is regularly evaluated, and we regularly report this assessment of our cybersecurity risk to our executive management team and to the Audit and Compliance Committee and the Board of Directors.


text: We have devoted, and expect to continue devoting, significant financial and personnel resources to maintain and improve our digital risk and security program.


text: Cybersecurity Tools Our digital risk and security program deploys technical safeguards designed to help protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence and incident response experience.


text: Risk Assessment; Third Party Assessments and Audits We use a combination of internal resources and external assessors, consultants, and auditors to conduct our cybersecurity risk assessments. At least annually, we conduct cybersecurity risk assessments that take into account information from internal stakeholders, known information security vulnerabilities, and information from external sources (e.g., reported security incidents that have impacted other companies, industry trends, and evaluations by third parties and consultants). We examine our cybersecurity controls, capabilities, programs, operating effectiveness, and incident response preparedness against industry standards and established frameworks, such as NIST and other guidelines. These assessments, which include third party audits for certain aspects of our cybersecurity, examine our end-to-end security practices, including data centers, infrastructure, and operations, and cover both physical as well as digital environments. Material results of assessments and audits are reported to our executive management team, the Audit and Compliance Committee, and the Board of Directors. The results of the assessment and audits are used to drive alignment on, and prioritization of, initiatives to enhance our cybersecurity, and we seek to adjust our cybersecurity strategies and resources accordingly. We have also obtained certain industry certifications and attestations that demonstrate our dedication to protecting the data our members, customers, suppliers, employees, and other stakeholders.


text: Incident Response Planning We have established an Incident Response Policy for identifying, responding to, containing, eradicating, and recovering from security breaches and other cybersecurity incidents, as well as communicating with relevant stakeholders. Our Incident Response Policy sets forth incident response and communication responsibilities for our employees, management, and Board of Directors. We regularly test and evaluate the effectiveness of the policy as part of our cybersecurity assessments described above.


text: Third-Party Vendors We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, suppliers, and other vendors. We use a variety of inputs in such risk assessments, including information supplied by vendors and in some cases attestations from objective, reputable, and licensed assessors. Where appropriate, our contracts with vendors require agreement and adherence to commercially reasonable security, confidentiality, and privacy contractual terms. Vendors are subject to security risk assessments at the time of onboarding and are thereafter periodically monitored and reassessed depending on risk level and our cybersecurity practices and in light of evolving cybersecurity standards and legal and regulatory requirements.


text: Education and Awareness We promote a culture of security awareness among our employees, and our policies require each of our employees to contribute to our cybersecurity efforts. We regularly remind employees of the importance of handling and protecting the data of members, customers, suppliers, employees and others, including through our Security Awareness Training Program delivered to new hires and on an annual basis. This training, which includes "phishing" exercises, is designed to enhance employee awareness of how to detect, respond to, and report potential cybersecurity threats as well as best behavioral practices to mitigate the risk of becoming subject to a cybersecurity incident.


text: Board of Directors Oversight The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit and Compliance Committee. The Audit and Compliance Committee oversees the development, implementation, and effectiveness of our strategies to monitor, mitigate, and respond to cybersecurity risks, as well as our procedures, policies and resources for risk assessment and risk management. In this role, the Audit and Compliance Committee receives updates from management on these matters, including the results of risk assessments and audits and the progress of risk reduction initiatives, on a quarterly basis or more frequently as needed. In addition, management updates the Audit and Compliance Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: The full Board of Directors receives updates from the Audit and Compliance Committee on its oversight of cybersecurity risk on a quarterly basis or more frequently as needed. In addition, the full Board of Directors also receives periodic briefings from management on the digital risk and security program.


text: Management's Role Our Chief Information Security Officer, Chief Privacy Officer, and Vice President, Risk Management and Compliance work in collaboration as our Digital Risk Management ("DRM") group and have primary responsibility for our digital risk and security program. These individuals have extensive experience in their roles at the Company and in prior roles at other companies in the areas of information technology and security, data protection and privacy, and risk management and compliance, respectively. The members of the DRM group, among other things, continuously review and evaluate our cybersecurity risks to: identify technical and business risks; assess the potential impacts of identified risks; develop mitigation strategies to control or reduce risk where needed; communicate to others to ensure that risk owners and stakeholders as well as executive leadership have visibility into identified risks; and monitor identified risks and applicable risk response efforts.


text: On a daily basis, our information technology team monitors, identifies, and classifies potential cybersecurity incidents or threats and is responsible for notifying members of the DRM group of such matters as appropriate based on risk to our organization. Upon learning of any material incidents or threats, the members of the DRM group are responsible for informing our executive leadership, other functional teams, and the Audit and Compliance Committee or Board of Directors, as appropriate.


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any cybersecurity threats that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition; however, see "Item 1A. Risk Factors" in this Annual Report for a discussion of effects that a cybersecurity threat or incident could have on our business strategy, results of operations or financial condition. We cannot provide assurances that we will not experience cybersecurity incidents in the future or that any future cybersecurity incidents will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Risk Management Strategy We have a comprehensive cybersecurity risk management strategy to assess, identify, and manage material risks from cybersecurity threats. The core of this strategy is our digital risk and security program, which is integrated into our overall enterprise risk framework and is based on industry standards and established frameworks such as National Institute of Standards and Technology (NIST) and other guidelines. Our program is designed to help protect our systems, data, and operations from potential cyber threats, ensure the continuity of business operations, ensure we comply with applicable laws and regulations, and meet our commitments to our members, customers, suppliers, employees, and other stakeholders.


text: Cybersecurity Tools Our digital risk and security program deploys technical safeguards designed to help protect our information systems from cybersecurity threats. Such safeguards are regularly evaluated and improved based on vulnerability assessments, cybersecurity threat intelligence, and incident response experience.


text: Third-Party Vendors We have implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, suppliers, and other vendors. We use a variety of inputs in such risk assessments, including information supplied by vendors and in some cases attestations from objective, reputable, and licensed assessors. Where appropriate, our contracts with vendors require agreement and adherence to commercially reasonable security, confidentiality, and privacy contractual terms. Vendors are subject to security risk assessments at the time of onboarding, and are thereafter periodically monitored and reassessed depending on risk level, our cybersecurity practices, and consideration of evolving cybersecurity standards and legal and regulatory requirements.


text: Education and Awareness We promote a culture of security awareness among our employees, and our policies require each of our employees to contribute to our cybersecurity efforts. We regularly remind employees of the importance of handling and protecting the data of members, customers, suppliers, employees, and others, including through our Security Awareness Training Program delivered to new hires and on an annual basis. This training, which includes regular "phishing" exercises, is designed to enhance employee awareness of how to detect, respond to, and report potential cybersecurity threats as well as best behavioral practices to mitigate the risk of becoming subject to a cybersecurity incident.


text: Board of Directors Oversight The Board of Directors considers cybersecurity risk as part of its risk oversight function and has delegated oversight of cybersecurity and other information technology risks to the Audit and Compliance Committee. The Audit and Compliance Committee oversees the development, implementation, and effectiveness of our strategies to monitor, mitigate, and respond to cybersecurity risks, as well as our procedures, policies, and resources for risk assessment and risk management. In this role, the Audit and Compliance Committee receives updates from management on these matters, including the results of risk assessments and audits and the progress of risk reduction initiatives, on a quarterly basis or more frequently, as needed. In addition, management updates the Audit and Compliance Committee, as necessary, regarding any material cybersecurity incidents, as well as any incidents with lesser potential impact.


text: Management's Role Our Chief Information Officer, Chief Privacy Officer (or in their absence, the Chief Ethics and Compliance Officer), and Vice President, Risk Management and Compliance work in collaboration as our Digital Risk Management ("DRM") group and have primary responsibility for our digital risk and security program. These individuals have extensive experience in their roles at the Company and in prior roles at other companies in the areas of information technology and security, data protection and privacy, and risk management and compliance, respectively. The members of the DRM group, among other things, continuously review and evaluate our cybersecurity risks to: identify technical and business risks; assess the potential impacts of identified risks; develop mitigation strategies to control or reduce risk where needed; communicate to others to ensure that risk owners and stakeholders as well as executive leadership have visibility into identified risks; and monitor identified risks and applicable risk response efforts.


text: Our information technology team monitors, identifies, and classifies potential cybersecurity incidents or threats and is responsible for notifying members of the DRM group of such matters as appropriate based on risk to our organization. Upon learning of any material incidents or threats, the members of the DRM group are responsible for informing our executive leadership, other functional teams, and the Audit and Compliance Committee or Board of Directors, as appropriate.


text: Risks from Cybersecurity Threats As of the date of this report, we are not aware of any cybersecurity incidents that have materially affected or are reasonably likely to materially affect our business strategy, results of operations or financial condition; however, see "Item 1A. Risk Factors" in this Annual Report for a discussion of effects that a cybersecurity threat or incident could have on our business strategy, results of operations, or financial condition. We cannot provide assurances that we will not experience cybersecurity incidents in the future or that any future cybersecurity incidents will not materially affect us, including our business strategy, results of operations, or financial condition.


text: Our process for identifying and assessing material risks from cybersecurity threats operates alongside our broader overall risk assessment process, covering all company risks. As part of this process, appropriate disclosure personnel collaborate with subject matter specialists, as necessary, to gather insights for identifying and assessing material cybersecurity threat risks, their severity, and potential mitigations.

companyName: Marcus & Millichap, Inc.

ticker: MMI


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • periodic comparison of our processes to standards set by the National Institute of Standards and Technology; • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual review of our consumer-facing policies and statements related to cybersecurity; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • conduct annual cybersecurity training for all employees and contractors, along with targeted training on a quarterly basis for specific subsets of employees identified through our phishing simulations; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • conduct regular network and endpoint monitoring and vulnerability assessments to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; • conduct vulnerability scans and leverage the scan results to continuously patch and manage our network as new threats emerge; and • active monitoring by our contracted 24x7 Security Operations Center.


text: Our incident response plan coordinates the activities we take to prepare for, detect, respond to and recover from cybersecurity incidents, which include processes to triage, assess severity for, escalate, contain, investigate, and remediate the incident, as well as to comply with potentially applicable legal obligations and mitigate brand and reputational damage. The incident response team assesses the severity and priority of incidents on a rolling basis, with escalations of higher severity cybersecurity incidents provided to our management team. If a cybersecurity incident is determined to be a material cybersecurity incident, our incident response processes define the steps to disclose such a material cybersecurity incident.


text: As part of the above processes, we regularly engage with assessors, consultants, auditors, and other third parties, including by regularly conducting technical and data reviews with our cybersecurity partners to help identify areas for continued focus, improvement and/or compliance.


text: Our processes also address cybersecurity threat risks associated with our use of third-party service providers, including those in our supply chain or who have access to our customer and employee data or our systems. Third-party risks are included within our broader overall risk assessment process, as well as our cybersecurity-specific risk identification program, both of which are discussed above. In addition, cybersecurity considerations affect the selection and oversight of our third-party service providers. We perform diligence on third parties that have access to our systems, data or facilities that house such systems or data, and continually monitor cybersecurity threat risks identified through such diligence. Additionally, we generally require those third parties that could introduce significant cybersecurity risk to us to agree by contract to manage their cybersecurity risks in specified ways, and to agree to be subject to cybersecurity audits, which we conduct as appropriate.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Technology and Cybersecurity Risks", which disclosure is incorporated by reference herein.


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee generally receives materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Officer. Members of the audit committee are also encouraged to regularly engage in ad hoc conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer. This individual has over 30 years of work experience in various technology roles involving managing information security, developing cybersecurity strategy, implementing effective information and cybersecurity programs. This experience has included positions at large public companies. Our CIO also holds a degree in electrical engineering.


text: The firm's senior executive team, inclusive of the CEO, CFO, COOs, CAO and Legal, are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: As discussed above, these members of management report to the audit committee about cybersecurity threat risks, among other cybersecurity related matters.


text: We also have a cybersecurity specific risk assessment process, which helps identify our cybersecurity threat risks. As part of this process, and our processes to provide for the availability of critical data and systems, maintain regulatory compliance, identify and manage our risks from cybersecurity threats, and to protect against, detect, and respond to cybersecurity incidents, as such term is defined in Item 106(a) of Regulation S-K, we undertake the below listed activities, among others: • periodic comparison of our processes to standards set by the National Institute of Standards and Technology; • closely monitor emerging data protection laws and implement changes to our processes designed to comply; • undertake an annual review of our consumer-facing policies and statements related to cybersecurity; • conduct regular phishing email simulations for all employees and all contractors with access to corporate email systems to enhance awareness and responsiveness to such possible threats; • conduct annual cybersecurity training for all employees and contractors, along with targeted training on a quarterly basis for specific subsets of employees identified through our phishing simulations; • through policy, practice and contract (as applicable) require employees, as well as third-parties who provide services on our behalf, to treat customer information and data with care; • conduct regular network and endpoint monitoring and vulnerability assessments to improve our information systems, as such term is defined in Item 106(a) of Regulation S-K; • carry information security risk insurance that provides protection against the potential losses arising from a cybersecurity incident; • conduct vulnerability scans and leverage the scan results to continuously patch and manage our network as new threats emerge; and • constant active monitoring by our contracted Security Operations Center.


text: We describe whether and how risks from identified cybersecurity threats, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations, or financial condition, under the heading "Item 1.A – Risk Factors – Technology and Cybersecurity Risks," which disclosure is incorporated by reference herein.


text: Our audit committee is responsible for the oversight of risks from cybersecurity threats. At least quarterly, the audit committee receives an overview from management of our cybersecurity threat risk management and strategy processes covering topics such as data security posture, results from third-party assessments, progress towards pre-determined risk-mitigation-related goals, our incident response plan, and material cybersecurity threat risks or incidents and developments, as well as the steps management has taken to respond to such risks. In such sessions, the audit committee generally receives materials indicating current and emerging material cybersecurity threat risks, and describing the company's ability to mitigate those risks, and discusses such matters with our Chief Information Officer. Members of the audit committee regularly engage in conversations with management on cybersecurity-related news events and discuss any updates to our cybersecurity risk management and strategy programs. Material cybersecurity threat risks are also considered during separate Board meeting discussions of important matters like risk management, operational budgeting, business continuity planning, mergers and acquisitions, brand management, and other relevant matters.


text: Our cybersecurity risk management and strategy processes, which are discussed in greater detail above, are led by our Chief Information Officer ("CIO"). The CIO has been responsible for cybersecurity for over ten years across multiple organizations, leading enterprise security programs, business continuity planning, cybersecurity response planning, and the implementation of the National Institute of Standards and Technology (NIST) cybersecurity framework. In the CIO's most recent role, the CIO established and led a dedicated Cybersecurity Department, developing comprehensive security strategies, implementing cutting-edge cybersecurity tools, and designing response plans to support the entire company. At our Company, the CIO continues to drive proactive risk management, regulatory compliance, and a culture of cybersecurity awareness.


text: The firm's senior executive team, inclusive of the CEO, CFO, COOs, CAO and CLO, are informed about and monitor the prevention, mitigation, detection, and remediation of cybersecurity incidents through their management of, and participation in, the cybersecurity risk management and strategy processes described above, including the operation of our incident response plan.


text: Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program that is designed to protect the confidentiality, integrity, and availability of our critical systems and information. Our cybersecurity risk management program is integrated with our overall enterprise risk management program and includes the following key elements: • We perform risk assessments designed to help identify material cybersecurity risks to our critical systems and services, and where appropriate, we engage external experts and consultants to assist us in performing certain of these risk assessments; • Our cybersecurity team is composed of security and infrastructure engineers and compliance personnel. This team is principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our responses to cybersecurity incidents; • We use external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • We conduct cybersecurity awareness trainings for employees who have access to our IT systems; • We maintain a cybersecurity incident response plan and a security operations function so we can respond to cybersecurity incidents; and • We have implemented a third-party risk management process for key third-party service providers. This includes, among other things, conducting security assessments of key third-party service providers, including prospective third-party service providers, prior to entering into or renewing business transactions with them or providing them access to our data or information systems and imposing contractual restrictions on such providers as appropriate based on their risk profile.

companyName: Maplebear Inc.

ticker: CART


text: We have not experienced any cybersecurity incidents over the past three years that have materially affected us, including our business strategy, results of operations, or financial condition. For certain risks from cybersecurity threats that may materially affect our business strategy, results of operations, or financial condition, see section titled "Risk Factors – Risks Related to Our Business and Industry - If we or the third parties we rely on experience a compromise to the confidentiality, integrity or availability of systems, or data of our customers, shoppers, partners', or Instacart, we may experience adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations; reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences."


text: Our board of directors delegates the cybersecurity risk oversight function to its audit committee. The audit committee oversees management's design, implementation, and enforcement of our cybersecurity risk management program. Management has overall responsibility for assessing, identifying, and managing material cybersecurity risks.


text: Our VP of Engineering Infrastructure and our Chief Information Security Officer ("CISO") lead the Company's cybersecurity function. Our CISO supervises both our internal cybersecurity personnel and our external cybersecurity service providers. Our CISO has significant global experience in managing and leading IT and cybersecurity teams, with over 20 years of experience in the cybersecurity industry in various positions. Our CISO is a Certified Information Systems Security Professional by the International Information System Security Certification Consortium. Our CISO reports to our VP of Engineering Infrastructure, who has over 18 years of experience in leading software engineering teams in the technology industry, including at Yahoo!.


text: The audit committee and our risk committee, a management committee overseeing our enterprise risk management program, receive reports from our CISO regarding key cybersecurity risks facing the company, our cyber risk management program, significant cybersecurity incidents involving us or our third-party service providers, and the progress of ongoing initiatives as well as the effectiveness of internal control and compliance mechanisms. The audit committee, in turn, briefs our board of directors on its cybersecurity oversight activities as appropriate or necessary.


text: Our management team, through our VP of Engineering Infrastructure and CISO, stays informed about and monitors the prevention, detection, mitigation, and remediation of cybersecurity risks and incidents through various means, which include briefings with internal security personnel, review of threat intelligence and other information obtained from governmental, public or private sources, including external cybersecurity service providers, and receiving alerts and reports produced by security tools deployed in our IT environment. Our CISO relies on close collaboration with other internal infrastructure, product, and engineering teams to implement our cybersecurity risk mitigation measures.


text: Risk Management and Strategy We have implemented and maintain a cybersecurity risk management program that is designed to identify, assess, and manage material risks from cybersecurity threats to our critical systems and information. Our cybersecurity risk management program is integrated with our overall enterprise risk management program and includes the following key elements: • We perform risk assessments designed to help identify material cybersecurity risks to our critical systems and services, and where appropriate, we engage external experts and consultants to assist us in performing certain of these risk assessments; • Our cybersecurity team is composed of security and infrastructure engineers and compliance personnel. This team is principally responsible for directing (1) our cybersecurity risk assessment processes, (2) our security processes, and (3) our responses to cybersecurity incidents; • We use external cybersecurity service providers, where appropriate, to assess, test, or otherwise assist with aspects of our security processes; • We conduct periodic cybersecurity awareness trainings for employees who have access to our IT systems; • We maintain a cybersecurity incident response plan and a security operations function so we can respond to cybersecurity incidents and comply with legal and disclosure obligations; and • We have implemented a third-party risk management process for key third-party service providers. This includes, among other things, conducting security assessments of key third-party service providers, including prospective third-party service providers, prior to entering into or renewing business transactions with them or providing them access to our data or information systems and imposing contractual restrictions on such providers as appropriate based on their risk profile.


text: We have not identified risks from known cybersecurity threats, including as a result of any prior cybersecurity incidents, that have materially affected us, including our business strategy, results of operations, or financial condition. We face risks from cybersecurity threats that, if realized, are reasonably likely to materially affect us, including our operations, business strategy, results of operations, or financial condition. For a description of these risks, see the section titled "Risk Factors – Risks Related to Our Business and Industry - If we or the third parties we rely on experience a compromise to the confidentiality, integrity or availability of systems, or data of our customers, shoppers, partners', or Instacart, we may experience adverse consequences, including but not limited to regulatory investigations or actions, litigation, fines and penalties, disruptions of our business operations; reputational harm, loss of revenue or profits, loss of customers or sales, and other adverse consequences."